0

I have always encryption implemented in my azure sql database using column encryption key and column master key which are both stored in azure Keyvault1 and the keys backed up in azure Keyvault2 (located in a different geo region) as well.

In case of an event where keyvault1 goes down how can I switch the column master key path to point to keyvault2 so that my applications are up and running without much downtime?

From what I gathered so far, the solution seems to be decrypting the data, dropping the column encryption key, column master key and they repeating the steps in reverse order to utilize the keys in keyvault2.

Are there any other efficient solutions for this scenario or is this the limitation?

Bala P
  • 143
  • 1
  • 12
  • KV is geo-redundant by default (see https://learn.microsoft.com/en-us/azure/key-vault/key-vault-disaster-recovery-guidance) – Thomas Jul 06 '19 at 08:26
  • Thanks @Thomas. your direction helped me in making informed decision – Bala P Jul 31 '19 at 21:42

0 Answers0