{"id":2133,"date":"2018-10-03T00:00:00","date_gmt":"2018-10-03T00:00:00","guid":{"rendered":"https:\/\/azure.microsoft.com\/blog\/bring-your-own-keys-for-apache-kafka-on-hdinsight"},"modified":"2023-05-11T15:36:44","modified_gmt":"2023-05-11T22:36:44","slug":"bring-your-own-keys-for-apache-kafka-on-hdinsight","status":"publish","type":"post","link":"https:\/\/azure.microsoft.com\/en-us\/blog\/bring-your-own-keys-for-apache-kafka-on-hdinsight\/","title":{"rendered":"Bring Your Own Keys for Apache Kafka on HDInsight"},"content":{"rendered":"

One of the biggest security and compliance requirements for enterprise customers is to encrypt their data at rest using their own encryption key. This is even more critical in a post-GDPR world. Today, we\u2019re announcing the public preview of Bring Your Own Key (BYOK)<\/a> for data at rest in Apache Kafka on Azure HDInsight<\/a>.<\/p>\n

Azure HDInsight clusters already provide several levels of security<\/a>. At the perimeter level, traffic can be controlled via Virtual Networks and Network Security Groups. Kerberos authentication and Apache Ranger provide the ability to finely control access to Kafka topics<\/a>. Further, all managed disks are protected via Azure Storage Service Encryption (SSE). However, for some customers it is vital that they own and manage the keys used to encrypt the data at rest. Some customers achieve this by encrypting all Kafka messages in their producer applications and decrypting them in their consumer applications. This process is cumbersome and involves custom logic. Moreover, it doesn\u2019t allow for usage of community supported connectors.<\/p>\n

With HDInsight Kafka\u2019s support for Bring Your Own Key (BYOK), encryption at rest is a one step process handled during cluster creation. Customers should use a user-assigned managed identity<\/a> with the Azure Key Vault<\/a> (AKV) to achieve this. AKV provides a highly available, scalable, and secure storage for cryptographic keys.<\/p>\n

The data engineer authorizes the managed identity to have read access from AKV and then enables BYOK in HDInsight by providing the Azure Key Vault URL associated with the encryption key.<\/p>\n

All messages to the Kafka cluster including replicas maintained by Kafka, are stored in Azure Managed Disks. With BYOK turned on, the attached Managed Disks are encrypted with a symmetric Data Encryption Key (DEK), which in turn is protected using the Key Encryption Key (KEK) from the customer\u2019s key vault. The encryption and decryption processes are entirely handled by HDInsight. This setup is transparent to the customer; Kafka clients (producer and consumer applications) need not be modified. The cluster or key vault admin can safely rotate the keys in the key vault via the Azure portal or Azure CLI<\/a> and the HDInsight Kafka cluster will start using the new key within minutes.<\/p>\n

Customers must enable Soft-delete<\/a> for customer managed keys that help protect them against ransomware scenarios and accidental deletion.<\/p>\n

With BYOK on HDInsight Kafka, enterprise customers can now be more confident than ever in the security of their cluster. This feature unlocks Kafka for customers for whom BYOK is a prerequisite for data at rest. There is no additional charge for enabling this feature.<\/p>\n

To get started with BYOK on HDInsight Kafka, please refer to the following documentation:<\/p>\n