Whilst day dreaming at my desk this morning, something occurred to me and I have not been able to find an answer of yet. So I am hoping someone may shine some light for me or just have a good discussion about it.
Let me set the scene. Recently, I started to play around with disk encryption using the Azure Portal and the Key Vault service that they offer. It made a lot more sense than the older method using AD Applications. So I created my new keyvault in the resource group, created a key inside of this and set the cryptographic operations as I saw fit. I then put together a script, ran through the AzurePowerShell CLI and after a few minutes my disks on the VM (MS Server 2012r2) were encrypted. So I did this for the rest of my test environment just to check it really did work. No first time fluke here!
Then it occurred to me, when/if the key expires what happens next? Now obviously in the test environment I don't really care, I can pull everything down if that was to happen. However, as I talk to customers who have production environments that often ask about the security of machines running in Azure, I would like to know how easy it is to refresh these keys. Many people I speak to have set policies regarding key cycling, so do not want a key that won't expire for another 200 years. Their security would not entertain the idea for a second.
Does anyone know, what the best method of updating the keys is? My original thought which surely it can't be, was to un-encrypt the disk before expiry. And then re-run the script but with a brand new generated key to encrypt once more? This seems like such a long way of going about this, but maybe it is the only way?
Has anyone else had the same thought, or had to implement a key refresh using Azure Key Vault?