Add customer-managed key (CMK) support for storage encryption

[sean-navapbc]

Description

Add support for customer-managed keys (CMK) stored in Azure Key Vault for storage account encryption to support regulated workloads.

Background

Compliance requirements (e.g., FedRAMP, HIPAA) may require clients to demonstrate ownership and control of encryption keys. Currently, the storage module uses Microsoft-managed keys.

Acceptance Criteria

• Create Key Vault resource or reference existing Key Vault
• Create customer-managed key in Key Vault
• Configure storage account to use customer-managed key for encryption
• Add proper RBAC permissions for storage account managed identity to access Key Vault
• Add variable to toggle between Microsoft-managed and customer-managed keys
• Update documentation with CMK configuration guidance
• Consider key rotation policy

References

• Current skip in infra/modules/storage/main.tf:40: checkov:skip=CKV2_AZURE_1:Customer managed key encryption can be added as a follow-up
• Azure Storage encryption with customer-managed keys

Related

Addresses the checkov skip currently in the storage module for customer-managed encryption keys.