CustomerProvidedEncryptionKey Class

All data in Azure Storage is encrypted at-rest using an account-level encryption key. In versions 2021-06-08 and newer, you can manage the key used to encrypt file contents and application metadata per-file by providing an AES-256 encryption key in requests to the storage service.

When you use a customer-provided key, Azure Storage does not manage or persist your key. When writing data to a file, the provided key is used to encrypt your data before writing it to disk. A SHA-256 hash of the encryption key is written alongside the file contents, and is used to verify that all subsequent operations against the file use the same encryption key. This hash cannot be used to retrieve the encryption key or decrypt the contents of the file. When reading a file, the provided key is used to decrypt your data after reading it from disk. In both cases, the provided encryption key is securely discarded as soon as the encryption or decryption process completes.

Inheritance

azure.storage.blob._models.CustomerProvidedEncryptionKey

CustomerProvidedEncryptionKey

Constructor

CustomerProvidedEncryptionKey(key_value: str, key_hash: str)

Parameters

Name	Description
key_value Required	str Base64-encoded AES-256 encryption key value.
key_hash Required	str Base64-encoded SHA256 of the encryption key.

Variables

Name	Description
algorithm	str Specifies the algorithm to use when encrypting data using the given key. Must be AES256.

Attributes

algorithm

Specifies the algorithm to use when encrypting data using the given key. Must be AES256.

algorithm: str

key_hash

Base64-encoded SHA256 of the encryption key.

key_hash: str

key_value

Base64-encoded AES-256 encryption key value.

key_value: str