Search code examples
azure-storageazure-table-storage

Azure tablestorage encrytped at rest


Just read a release that says all azure storage is encrypted at rest, looking for a way to verify this for non-blobs or files . Specifically Table Storage.

https://azure.microsoft.com/en-us/blog/announcing-default-encryption-for-azure-blobs-files-table-and-queue-storage/


Solution

  • Interesting question. There is no way for a confirm this with a code check as the data is encrypted/decrypted transparently during write/read. You can check to see if a particular blob is encrypted using get-blob - see https://learn.microsoft.com/en-us/rest/api/storageservices/get-blob

    x-ms-server-encrypted: true/false Version 2015-12-11 or newer. The value of this header is set to true if the blob data and application metadata are completely encrypted using the specified algorithm. Otherwise, the value is set to false (when the blob is unencrypted, or if only parts of the blob/application metadata are encrypted).

    Also see: https://learn.microsoft.com/en-us/azure/security/azure-security-encryption-atrest

    More detail: If I am parsing your question correctly, Azure has rolled out encryption by default in all regions in Public Azure. This means that any new storage account (Classic or ARM) created will have Encryption at Rest enabled by default. Encrypting data in existing Storage accounts is ongoing (ETA to be completed by end of the year). Encryption for Tables and Queues at rest is also in the works.

    You can check the blob and file headers per above to verify data is encrypted. Unfortunately there isn't a way currently to do such verifications for Tables and Queues.