Search code examples
azureazure-blob-storageblob

How to archive a blob in azure if the blob is encrypted with encryption scope?

I am planning to use storage account in Azure to store my blobs. I am getting multiple options for redundancy while creating the account such as LRS, ZRS, GRS, etc.

Suppose i am creating a storage account with LRS as redundancy. I am planning to change the tier of any blob from hot to archive based on some condition. But i can see that if my blob is encrypted with encryption scope then i am not allowed to change the tier. I am getting the error as:

The blob is encrypted with customer specified encryption, but it was not provided in the request.

How to solve this problem? Can i get any solution how to archive or unarchive my blob whenever i want?

I created multiple encryption scopes on a storage account. Based on my condition, i can encrypt my blob with any of those encryption scope. But when i encrypted my blob i am unable to change the tier.

Solution

  • I got an answer after searching a bit.

    If you have encrypted your blob with an encryption scope, then you cannot change the tier of the blob directly. This is because the encryption scope is tied to the tier of the blob, and changing the tier would require re-encrypting the blob with a new encryption scope.

    One possible solution to this problem is to create a copy of the blob with a different tier and encryption scope. You can use the Copy Blob operation in Azure Storage to create a copy of the blob with a new encryption scope and tier. Once the copy is complete, you can delete the original blob if necessary.

    Here are the high-level steps to create a copy of a blob with a different tier and encryption scope:

    1. Create a new encryption scope for the target tier.
    2. Use the Copy Blob operation to create a copy of the blob with the new encryption scope and target tier. You can specify the new encryption scope in the x-ms-meta-encryption-scope header of the request.
    3. Verify that the new blob has the correct tier and encryption scope.
    4. Delete the original blob if necessary.

    Alternatively, you could also consider using Azure Blob Lifecycle Management to automatically move blobs between different storage tiers based on certain conditions. For example, you could create a rule that moves blobs that haven't been accessed in a certain number of days from hot to cool, and another rule that moves blobs that haven't been accessed in a longer period of time from cool to archive. This way, you won't have to manually change the tier of each blob, and you can ensure that your data is stored cost-effectively based on its access patterns.