1.0 Introduction
Welcome to the Fortanix-Data-Security-Manager (DSM) Azure Key Vault (AKV) Managed Hardware Security Module (HSM) Cloud Native Key Management Service (CNKMS) User Guide. This article describes how to perform native key lifecycle management in Azure Managed HSM using Fortanix DSM.
The Fortanix solution for Azure Managed HSM offers complete Cloud Native Key Management Service (CNKMS), as explained in this article, as well as Bring Your Own Key (BYOK) with complete lifecycle management for automation.
2.0 Getting Started with Fortanix Cloud Data Control
To understand which solution between CNKMS, Bring Your Own Key (BYOK), or Bring Your Own Encryption (BYOE) is right for you, refer to the Fortanix DSM - Cloud Data Control - Getting Started.
3.0 Fortanix Azure Managed HSM CNKMS Workflows Overview
Generate key: Navigate to a Managed HSM group, select "Generate in Azure", select a supported algorithm type and key size, and click Generate to generate the key in the Azure Managed HSM repository.
Rotate: Rotate the key that was originally generated in Azure Managed HSM by navigating to it in the Azure Managed HSM group. Otherwise, if the source is "Fortanix DSM", refer to the Fortanix DSM - Azure Managed HSM Bring Your Own Key.
Disable/Enable: Navigate to the detailed view of the key in the Azure Managed HSM group and disable or enable it from Fortanix DSM.
Schedule/Soft Key Deletion: Azure will not allow you to natively delete a key directly unless you explicitly schedule it for deletion and the mandatory waiting period expires (set at Managed HSM, default 90 Days). Additionally, there is an optional “Purge Protection” that you can enable using Azure to avoid manual Purge of keys, minimum 7 Days. For more information, refer to Azure Key Vault soft-delete overview.
Navigate to the detailed view of the key in the Azure Managed HSM group and in the Azure KEY DETAILS tab, schedule the key for deletion.
4.0 Fortanix DSM Managed HSM Security Objects
You can generate a key in a configured Azure Managed HSM (Managed HSM Pool).
4.1 Create a Key in Azure Managed HSM Group - Generate Key
This action will generate the configured key type in the software-backed or HSM-backed Azure, and it will be represented as a virtual key in the corresponding Azure Managed HSM group. This means that the virtual key in the Azure Managed HSM group will point to the actual key in the Azure Managed HSM Pool that stores the key material of this new key. The virtual key only stores the key information and key attributes, but it does not have the key material.
Perform the following steps to create a new key in Fortanix DSM UI:
Navigate to the Security Objects menu item in the DSM left navigation bar and click the + button on the Security Objects page to create a new key.
In the Add New Security Object form, do the following:
Enter a name for the Security Object (Key).
Select the This is an HSM/external KMS object check box to filter the groups to show only HSM/AWS KMS/Azure KMS groups in the Select group list.
In the Azure group list, select the Azure Managed HSM group into which the keys will be generated. The keys will be generated into the region that was selected in the Azure Managed HSM group.
Select the GENERATE IN AZURE radio button to initiate the generate key in Azure workflow.
Enter the required Azure key name. The Azure key name is the key name that will be stored in Azure Managed HSM. The Azure key name will be used to correlate between different versions of a key. All the key versions will have the same Azure key name.
In the Choose a type section, select the key type for the new Azure Managed HSM key.
NOTE
The allowed key types for an Azure key generated using the Generate Key workflow are:
RSA key pairs ( RSA_2048, RSA_3072, and RSA_4096).
AES 256
The RSA and AES key to be copied must have the “Export” permission enabled or the copy key operation will fail.
These key types can further be restricted by setting a cryptographic policy for the account or group. For more details about the crypto policy, refer to User's Guide: Cryptographic Policy.
The key types can also be restricted by setting a key metadata policy for the group. For more details about the Key metadata policy, refer to User's Guide: Key Metadata Policy.
Enter the Key size.
Enter the key Activation Date and key Deactivation Date.
Select the permitted key operations under the Key operations permitted section.
Add any key tags if required using ADD TAG button.
Add any attributes if required using the CUSTOM ATTRIBUTE button.
Click the GENERATE button to generate the key in Azure.
The new Azure Key is created and represented with a special symbol 
to denote it is of type "External KMS". In the detailed view of the Azure key, you will notice the following things:
The “key state” - whether the key is in a pre-active/active state based on the “activation date” selected during the key creation.
The Azure Key Name appears on the top.
The group to which it belongs (in the Group field). It also shows if the group is mapped to Azure Managed HSM or not using the special icon
.How the key was created (in the Created by field). If it is an Azure Managed HSM key, this field shows the group that created this key. It also shows minor details such as if the group is “Connected” or “Not Connected”.
The new key will be added to the Security Objects table.
TIP
You can also access the new key from the Group detailed view from the SECURITY OBJECTS tab.
You can also add a new key from the Group detailed view from the SECURITY OBJECTS tab, click ADD SECURITY OBJECT, and follow Steps 2-3 above.
Go to the AZURE KEY DETAILS tab to see the properties of the Azure Key such as the Version Number and Resource ID of the key.
Log in to the Azure console and verify if the new key is generated successfully.
NOTE
When a new key is created in the Azure Managed HSM from Fortanix DSM, a backup blob for the key (along with its key versions) will be downloaded from Azure and saved into Fortanix DSM when a SYNC is performed on the group.
4.2 Sync Keys
Perform the following steps to edit the Azure Managed HSM connection details:
Go to the Azure KMS group detailed view.
Click the HSM/KMS tab.
Click the SYNC KEYS button to import the new virtual keys.
Fortanix DSM will then connect to Azure Managed HSM, fetch all available keys, and store them as virtual keys.
NOTE
When keys are synced with Azure Managed HSM, an encrypted backup of the newly discovered keys from the Managed HSM is escrowed into Fortanix DSM. In the event of a key being purged from the Managed HSM, this escrow can be used to restore the key. The actual key material for those keys is always stored in Azure Managed HSM.
Clicking SYNC KEYS only returns the keys from Azure Managed HSM that are not present in Fortanix DSM. That is, every click will append only new keys to Fortanix DSM.
The time taken to sync keys from the Azure Managed HSM to DSM is a function of the number of keys in the Azure Managed HSM and the network latency between the Azure location and DSM. It can take several minutes if there are hundreds of keys and significant network latency.
4.3 Attributes/Tags Tab
This tab will have all the attributes and tags of the Azure key. A tag is an optional metadata label that you can assign to an Azure resource. You can add new tags using the NEW TAG button and add custom attributes by using the ADD CUSTOM ATTRIBUTE button. These are user-defined security object attributes that can be added to the security object’s metadata.
4.4 Azure Key Details
This tab displays details of the Azure key properties such as Resource ID and Key version number.
The AZURE KEY DETAILS tab also contains SOFT DELETE KEY option, which is explained in Section 4.7: Soft-delete a Key in Azure Managed HSM.
4.5 Security Objects Table View
After you add new Azure keys, navigate to the Security Objects menu item in the DSM left navigation bar to view all the security objects from all the groups (Regular and HSM/External KMS).
In the table, you will notice that every key belongs to a group and some keys which are virtual keys added from an Azure Managed HSM, belongs to a group with a special symbol 
. The table shows all keys, whether they belong to an Azure Managed HSM group or not.
4.6 Deactivate a Key in Azure Managed HSM Group
When you deactivate an Azure key in Fortanix DSM, it deactivates the virtual key in Fortanix DSM and disables the actual key in the Azure Managed HSM.
Perform the following steps to deactivate a key:
Select the Azure key that you want to deactivate.
In the detailed view of the key, scroll down and click the DEACTIVATE button.
4.7 Soft-delete a Key in Azure Managed HSM
Soft-delete removes a key from an Azure Managed HSM which was already scanned in the Azure Managed HSM group in Fortanix DSM with an option to recover it.
When you click SYNC KEYS in Fortanix DSM:
The status of the key in the Azure Managed HSM group changes to soft-deleted in Azure.
The key can only be recovered for a retention period set in the Managed HSM.
If you want to recover this key, both the virtual key in Fortanix DSM and the actual key in Azure Managed HSM become active again.
If you do not want to recover the key within the retention period, the Azure Managed HSM will automatically purge and permanently delete.
Perform the following steps to delete a key from Azure Managed HSM:
Navigate to the detailed view of an Azure virtual key and click the AZURE KEY DETAILS tab.
Click the link SOFT DELETE KEY button.
In the Soft Key Deletion in Azure Managed HSM window, select the confirmation “I understand that the key is not usable for Sign/Verify, Wrap/Unwrap or Encrypt/Decrypt operations once it is deleted” checkbox.
Click the SOFT DELETE KEY button to confirm the key for deletion.
You can recover the deleted key any time before the retention period ends using the RECOVER DELETED KEY link on the top of the screen in the detailed view of the virtual key. When the “Recover Key“ link is clicked, the key will be recovered back in Azure Managed HSM with all its versions.
NOTE
When the retention period ends, the key gets purged and deleted permanently. However, even if the key is purged in Azure Managed HSM, if the key was imported from Fortanix DSM, then the same key material can be re-imported into Azure Managed HSM from the backup blob.
In the Azure Managed HSM, when a key is deleted, all its versions get deleted along with it and when restored, all its versions are restored together.
4.8 Delete a Key in Azure Managed HSM Group
The DELETE KEY button will be enabled when the key material has been purged in Azure. When you click DELETE KEY, Fortanix DSM will remove the key backup blob, and hence the key cannot be restored.
Perform the following steps to delete a virtual key:
Select the Azure key that you want to delete.
In the detailed view of the security object, scroll down and click the DELETE KEY button.
5.0 Rotate a Key in Azure Managed HSM Group
The following section elaborates on key rotation in an Azure Managed HSM group. A key rotation occurs when you aim to retire an encryption key and substitute it by generating a new cryptographic key.
5.1 Rotating Azure Native Key* with Another Native Key
*Native key is one where the key material was generated by Azure Managed HSM.
When you rotate a virtual key in an Azure Managed HSM group, the action will rotate the key inside the Azure Managed HSM by generating another new version of the key within the configured Azure Managed HSM in a nested way by moving the key alias from the old key to the new key.
Perform the following steps to rotate a key in Azure Managed HSM:
Navigate to the Security Objects menu item in the DSM left navigation bar to go to the detailed view of an Azure virtual key and click the ROTATE KEY button.
In the KEY ROTATION window, the Generate new key radio button is selected by default.
Click the ROTATE KEY button to rotate a virtual key.
On the next screen, select both the check boxes to confirm your understanding about the action. Click the PROCEED button.
A new rotated key is now generated.
5.2 Rotating Azure Native Key to Fortanix DSM Owned Key
When an Azure Managed HSM virtual key whose key material is owned by Azure Managed HSM is rotated, you are given the option to rotate the virtual key with a Fortanix DSM-backed key. When you select this option and perform the rotation, a new virtual key is created, with corresponding key in Azure Managed HSM, which has the key material of the Fortanix DSM-backed key. As a result, the Azure Managed HSM virtual key is backed by a Fortanix DSM Source key and becomes a BYOK key.
Perform the following steps to rotate a virtual key with Fortanix DSM backed key:
Navigate to the Security Objects menu item in the DSM left navigation bar to go to the detailed view of an Azure virtual key and click the ROTATE KEY button.
In the Key Rotation window, the Generate new key radio button is selected by default.
Select the Rotate to DSM key check box.
Select the Fortanix DSM group that contains the source key and then select the required source key from the respective drop down menu.
Click the ROTATE KEY button.
On the next screen, select both the check boxes to confirm your understanding about the action. Click the PROCEED button.
The virtual key has been rotated and is now backed by the source key. To confirm, go to the detailed view of the newly rotated Azure virtual key and click the AZURE KEY DETAILS tab. You will notice that the SOURCE field now shows FortanixHSM instead of External.
6.0 Azure Managed HSM Group Setup and BYOK
For details on how to set up an Azure Managed HSM-backed group in Fortanix DSM, refer to the Fortanix DSM - Azure Managed HSM Setup.
For details on how to perform BYOK key lifecycle management in Azure Managed HSM using Fortanix DSM, refer to the Fortanix DSM - Azure Managed HSM Bring Your Own Key.