Configure data encryption in Azure Database for PostgreSQL flexible server

Use the Azure portal:

1. During provisioning of a new Azure Database for PostgreSQL flexible server, configure data encryption in the Security tab. For Data encryption key, select the Service-managed key option.

   

2. If you enable geo-redundant backup storage to be provisioned together with the server, the aspect of the Security tab changes slightly because the server uses two separate encryption keys. One key is for the primary region in which you're deploying your server, and one key is for the paired region to which the server backups are asynchronously replicated.

   

You can enable data encryption by using a system assigned encryption key while provisioning a new server by using the az postgres flexible-server create command.

az postgres flexible-server create \
  --resource-group <resource_group> \
  --name <server> ...

Use the Azure portal:

1. Create a user assigned managed identity, if you don't have one yet. If your server has geo-redundant backups enabled, you need to create two different identities. Each of those identities accesses each of the two data encryption keys.

1. Create an Azure Key Vault or create a Managed HSM, if you don't have a key store created yet. Make sure that you meet the requirements. Also, follow the recommendations before you configure the key store, and before you create the key and assign the required permissions to the user assigned managed identity. If your server has geo-redundant backups enabled, you need to create a second key store. That second key store keeps the data encryption key that encrypts your backups copied to the paired region of the server.

1. Create a key in your key store. If your server has geo-redundant backups enabled, you need one key on each of the key stores. By using one of these keys, you encrypt all your server's data (including all system and user databases, temporary files, server logs, write-ahead log segments, and backups). By using the second key, you encrypt the copies of the backups that are asynchronously copied over the paired region of your server.

2. During provisioning of a new Azure Database for PostgreSQL flexible server, configure data encryption in the Security tab. For Data encryption key, select the Customer-managed key radio button.

   

3. If you enable geo-redundant backup storage to be provisioned together with the server, the aspect of the Security tab changes slightly because the server uses two separate encryption keys. One key is for the primary region in which you're deploying your server, and one key is for the paired region to which the server backups are asynchronously replicated.

   

4. In User assigned managed identity, select Change identity.

   

5. From the list of user assigned managed identities, select the one you want your server to use to access the data encryption key stored in an Azure Key Vault.

   

6. Select Add.

   

7. Select Use automatic key version update, if you prefer to let the service automatically update the reference to the most current version of the chosen key, whenever the current version is rotated manually or automatically. To understand the benefits of using automatic key version updates, see automatic key version update.

   

8. Select Select a key.

   

9. Subscription is automatically populated with the name of the subscription on which your server is about to be created. The key store that keeps the data encryption key must exist in the same subscription as the server.

   

10. In Key store type, select the radio button corresponding to the type of key store in which you plan to store the data encryption key. In this example, choose Key vault, but the experience is similar if you choose Managed HSM.

    

11. Expand Key vault (or Managed HSM, if you selected that storage type), and select the instance where the data encryption key exists.

    

    Note

    When you expand the dropdown box, it shows No available items. It takes a few seconds until it lists all the instances of key vault which are deployed in the same region as the server.

12. Expand Key, and select the name of the key that you want to use for data encryption.

    

13. If you didn't select Use automatic key version update, you must also select a specific version of the key. To do that, expand Version, and select the identifier of the version of the key that you want to use for data encryption.

    

14. Select Select.

    

15. Configure all other settings of the new server and select Review + create.

    

Use the az postgres flexible-server create command to enable data encryption with user assigned encryption key, while provisioning a new server.

If your server doesn't have geo-redundant backups enabled:

az postgres flexible-server create \
  --resource-group <resource_group> \
  --name <server> \
  --geo-redundant-backup Disabled \
  --identity <managed_identity_to_access_primary_encryption_key> \
  --key <resource_identifier_of_primary_encryption_key> ...

If your server has geo-redundant backups enabled:

az postgres flexible-server create \
  --resource-group <resource_group> \
  --name <server> \
  --geo-redundant-backup Enabled \
  --identity <managed_identity_to_access_primary_encryption_key> \
  --key <resource_identifier_of_primary_encryption_key> \
  --backup-identity <managed_identity_to_access_geo_backups_encryption_key> \
  --backup-key <resource_identifier_of_geo_backups_encryption_key> ...

Use the Azure portal:

1. Select your Azure Database for PostgreSQL flexible server.

2. In the resource menu, under the Security section, select Data encryption.

   

3. To change the user assigned managed identity that the server uses to access the key store, expand the User assigned managed identity dropdown, and select any of the available identities.

   

   Note

   The combo box shows only the identities that your Azure Database for PostgreSQL flexible server assigned. Although it's not required, to maintain regional resiliency, select user managed identities in the same region as your server. If your server has geo-backup redundancy enabled, the second user managed identity, used to access the data encryption key for geo-redundant backups, should exist in the paired region of the server.

4. If the user assigned managed identity that you want to use to access the data encryption key isn't assigned to your Azure Database for PostgreSQL flexible server, and it doesn't exist as an Azure resource with its corresponding object in Microsoft Entra ID, create it by selecting Create.

   

5. In the Create User Assigned Managed Identity panel, enter the details of the user assigned managed identity that you want to create, and automatically assign it to your Azure Database for PostgreSQL flexible server to access the data encryption key.

   

6. If the user assigned managed identity that you want to use to access the data encryption key isn't assigned to your Azure Database for PostgreSQL flexible server, but it exists as an Azure resource with its corresponding object in Microsoft Entra ID, assign it by selecting Select.

   

7. From the list of user assigned managed identities, select the one you want your server to use to access the data encryption key stored in an Azure Key Vault.

   

8. Select Add.

   

9. Select Use automatic key version update if you want the service to automatically update the reference to the most current version of the chosen key whenever the current version is rotated manually or automatically. To understand the benefits of using automatic key version updates, see [automatic key version update](../security/security-data-encryption.md##CMK key version updates).

   

10. If you rotate the key and don't enable Use automatic key version update. Or if you want to use a different key, update your Azure Database for PostgreSQL flexible server so that it points to the new key version or new key. To do that, copy the resource identifier of the key, and paste it in the Key identifier box.

    

11. If the user accessing Azure portal has permissions to access the key stored in the key store, you can use an alternative approach to choose the new key or new key version. To do that, in Key selection method, select the Select a key radio button.

    

12. Select Select key.

    

13. Subscription is automatically populated with the name of the subscription on which your server is about to be created. The key store that keeps the data encryption key must exist in the same subscription as the server.

    

14. In Key store type, select the radio button corresponding to the type of key store in which you plan to store the data encryption key. In this example, choose Key vault, but the experience is similar if you choose Managed HSM.

    

15. Expand Key vault (or Managed HSM, if you selected that storage type), and select the instance where the data encryption key exists.

    

    Note

    When you expand the dropdown box, it shows No available items. It takes a few seconds until it lists all the instances of key vault which are deployed in the same region as the server.

16. Expand Key, and select the name of the key that you want to use for data encryption.

    

17. If you didn't select Use automatic key version update, you must also select a specific version of the key. To do that, expand Version, and select the identifier of the version of the key that you want to use for data encryption.

    

18. Select Select.

    

19. When you're satisfied with the changes, select Save.

    

Use the az postgres flexible-server update command to configure data encryption with user assigned encryption key, for an existing server.

az postgres flexible-server update \
  --resource-group <resource_group> \
  --name <server> \
  --identity <managed_identity_to_access_primary_encryption_key> \
  --key <resource_identifier_of_primary_encryption_key> ...

Whether you want to change only the user assigned managed identity used to access the key, or you want to change only the key used for data encryption, or you want to change both at the same time, you must provide both parameters --identity and --key (or --backup-identity and --backup-key for geo-redundant backups). If you provide only one parameter, you get any of the following errors:

User assigned identity and keyvault key need to be provided together. Please provide --identity and --key together.

User assigned identity and keyvault key need to be provided together. Please provide --backup-identity and --backup-key together.

If the key you specify with the --key parameter (or --backup-key for geo-redundant backups) doesn't exist, or if the user assigned managed identity whose resource identifier you pass to the --identity parameter (or --backup-identity for geo-redundant backups) doesn't have the required permissions to access the key, you get the following error:

Code: AzureKeyVaultKeyNameNotFound
Message: The operation could not be completed because the Azure Key Vault Key name '<key_vault_resource>' does not exist or User Assigned Identity does not have Get access to the Key (/azure/postgresql/flexible-server/concepts-data-encryption#requirements-for-configuring-data-encryption-for-azure-database-for-postgresql-flexible-server).

If your server has geo-redundant backups enabled, you can configure the key used for encryption of geo-redundant backups, and the identity used to access that key. To do so, use the --backup-identity and --backup-key parameters.

az postgres flexible-server update \
  --resource-group <resource_group> \
  --name <server> \
  --backup-identity <managed_identity_to_access_georedundant_encryption_key> \
  --backup-key <resource_identifier_of_georedundant_encryption_key> ...

If you pass the parameters --backup-identity and --backup-key to the az postgres flexible server update command, and refer to an existing server that doesn't have geo-redundant backup enabled, you get the following error:

Geo-redundant backup is not enabled. You cannot provide Geo-location user assigned identity and keyvault key.

If you add identities to the --identity and --backup-identity parameters and they're valid, the system automatically adds them to the list of user assigned managed identities associated with your Azure Database for PostgreSQL flexible server. This action happens even if the command later fails with some other error. In such cases, you might want to use the az postgres flexible-server identity commands to list, assign, or remove user assigned managed identities assigned to your Azure Database for PostgreSQL flexible server. To learn more about configuring user assigned managed identities in your Azure Database for PostgreSQL flexible server, see associate user assigned managed identities to existing servers, dissociate user assigned managed identities to existing servers, and show the associated user assigned managed identities.