Search code examples
azureazure-cognitive-searchazure-keyvault

Unable to create an index/synonym map in Azure Cognitive Search with "Customer" managed encryption key option

I am trying to create an index/synonym map with encryption using "Customer" managed key option however I am not able to do so.

I am constantly getting the following error back from the service:

Failed to verify account key (HTTP Status Code: 403).

Here's what my request body for synonym map looks like:

{
    "name":"test",
    "format":"solr",
    "synonyms":"",
    "encryptionKey":
    {
        "keyVaultKeyName":"AzSearchKey2",
        "keyVaultKeyVersion":"02cc721e41654f079c173744313f24b0",
        "keyVaultUri":"https://mykeyvault.vault.azure.net"
    }
}

I have completely followed the instructions specified here: https://learn.microsoft.com/en-gb/azure/search/search-security-manage-encryption-keys.

Here's what I have done so far:

  • I created a search service with "Basic" SKU (as this functionality is not available in "Free" tier).

  • I went to the "Identity" section of my search service and assigned that as managed identity.

enter image description here

  • I created a brand new Key Vault with "Standard" tier and defined an access policy for the above mentioned identity. I granted necessary "Key" permissions ("Get", "Wrap Key", "Unwrap Key") as mentioned in the documentation link above to the Search Service. This Key Vault is in the same region and resource group as that of the Search Service. Key vault also has "Soft Delete" and "Purge Protection" enabled.

enter image description here

  • I created a key and copied down the details (URI, key name and key version).

enter image description here

I believe I am doing everything that is mentioned in the documentation so I am not sure what am I doing wrong.

Interesting thing is that I was able to do this without any problem yesterday with another search service and key vault.

My guess is that I am missing some minor detail. Would appreciate if someone could point it out for me.

UPDATE

Big thanks to Cognitive Search team for working with me on this. The error message I am getting is because of an issue with the code (I was returning a standard message whenever the service returned 403 status code).

The service is still returning the error. The actual error message returned by the service is:

Could not use key vault key https://mykeyvault.vault.azure.net:443/keys/AzSearchKey2/02cc721e41654f079c173744313f24b0 
to wrap/unwrap the encryption key. The key vault key deletion-recovery level is insufficient. 
Soft-Delete and Purge Protection must be enabled on Key vault, see: https://aka.ms/key-vault-soft-delete
Solution

  • After following up privately with Gaurav, we came to the conclusion that it was due to the key retention period being too short (7 days retention instead of 90 days). We just updated the product code to support shorter retention periods (down to 7 days), and the patch will be deployed globally in the upcoming weeks. In the meantime, if you hit the same issue, please update your key retention policy to 90 days. You can recognize this error state if you receive the following message from Azure Search when creating an encrypted index or synonym map:

    DataPlaneApiException : Could not use key vault key (YOUR_KEY_URL) to wrap/unwrap the encryption key. The key vault key deletion-recovery level is insufficient. Soft-Delete and Purge Protection must be enabled on Key vault, see: https://aka.ms/key-vault-soft-delete.

    Thank you