MediVault Secure Infrastructure Demonstration Implementing Customer-Managed Key (CMK) Encryption & RBAC in Azure

[Virtual Presenter] Hello, my name is Petro Zubal, and this presentation demonstrates the implementation of Customer-Managed Key encryption and Role-Based Access Control within the MediVault Azure environment. The objective is to demonstrate how sensitive healthcare data can be protected using Azure-native security controls, while giving MediVault greater control over encryption keys, access permissions and key lifecycle management..

[Audio] Starting with our key-management boundary, this is the Azure Key Vault instance, kv-medivault-sec-01, deployed in the North Europe region. Soft-delete and purge protection are enabled to help protect cryptographic material against accidental or malicious deletion and to support controlled key lifecycle management..

[Audio] Our MediVault environment is deployed within resource group rg-medivault-prod-01. The architecture includes the Azure Key Vault, the storage account stmedivaultprod01, the medivault-records blob container and the user-assigned managed identity id-medivault-prod-01. These components work together to provide controlled encryption and access management through Azure RBAC..

[Audio] In healthcare environments, protecting electronic health records and other sensitive medical information is critical. MediVault therefore requires strong protection for data at rest, controlled access to resources and effective management of cryptographic keys. The configuration demonstrated here addresses these requirements by combining Azure Storage encryption, Key Vault and role-based access control..

[Audio] To establish customer control over the encryption key, an asymmetric RSA 4096-bit key named medivault-class4-cmk was generated in Azure Key Vault. The user-assigned managed identity id-medivault-prod-01 was then granted the Key Vault Crypto Service Encryption User role. This allows Azure Storage to access the customer-managed key through the managed identity without requiring credentials to be stored in the application or configuration..

[Audio] Next, Customer-Managed Key encryption was configured for the storage account stmedivaultprod01. The storage account was changed from Microsoft-managed key encryption to Customer-Managed Key encryption and associated with the Key Vault through the user-assigned managed identity. Azure Storage uses the customer-managed key to protect and control access to the encryption key used for the storage account's data encryption. The default encryption scope is applied at the account level..

[Audio] With this configuration in place, data uploaded to the storage account remains encrypted at rest. The customer-managed key provides MediVault with additional control over the protection of the storage encryption key, including the ability to manage key access, rotation and revocation. This provides an additional governance control for sensitive healthcare information..

[Audio] The next step was to create the medivault-records blob container with anonymous public access disabled. A test file named medivault-test-record.txt was then uploaded to the container. The purpose of this test is to demonstrate that data is successfully stored while Azure Storage encryption remains active..

[Audio] Here we can verify the uploaded blob through the Azure Portal. The blob properties show SERVER ENCRYPTED: true, confirming that server-side encryption is active for the stored object. The storage account is configured to use the customer-managed key through Azure Key Vault..

[Audio] We then performed a controlled cryptographic revocation test. The customer-managed key medivault-class4-cmk was disabled in Azure Key Vault. This demonstrates an important advantage of customer-managed keys: MediVault can revoke the storage service's ability to use the customer-managed key. When the key is disabled, affected data operations are blocked until access to the key is restored..

[Audio] After disabling the key, an attempt was made to access the stored blob. The operation returned an HTTP 403 Forbidden response, demonstrating that access to the encrypted data was blocked while the customer-managed key was unavailable. The key was then re-enabled in Key Vault. Following re-authentication and token refresh, access to the blob was restored. This demonstrates both cryptographic revocation and controlled service restoration..

[Audio] First, sensitive data is protected through encryption at rest using a customer-managed key. Second, MediVault retains greater control over key lifecycle management, including key access, rotation and revocation. Third, managed identities and Azure RBAC reduce the need for hardcoded credentials and support the principle of least privilege. Finally, the key-revocation test demonstrated that disabling the customer-managed key can block access to protected storage data until the key is restored..

[Audio] As demonstrated on screen, disabling the customer-managed key resulted in access to the protected blob being blocked with an HTTP 403 response. Re-enabling the key restored access to the data. This demonstration shows how Azure Key Vault, Customer-Managed Keys, managed identities and RBAC can be combined to provide strong encryption and key-management controls for the MediVault environment. Thank you for your time..