az acr encryption

Manage customer-managed encryption for a container registry.

For more information, see http://aka.ms/acr/cmk.

Commands

Name	Description	Type	Status
az acr encryption rotate-key	Rotate the customer-managed encryption key for a container registry.	Core	GA
az acr encryption show	Show the container registry's encryption details.	Core	GA

az acr encryption rotate-key

Edit

Rotate the customer-managed encryption key for a container registry.

The registry must already have customer-managed key encryption enabled. The managed identity must have permission to use the new Azure Key Vault or Managed HSM key. For more information, see http://aka.ms/acr/cmk.

az acr encryption rotate-key --name
                             [--acquire-policy-token]
                             [--change-reference]
                             [--identity]
                             [--key-encryption-key]
                             [--resource-group]

Examples

Rotate to a versionless Managed HSM key to enable automatic key rotation.

az acr encryption rotate-key --name myregistry --resource-group MyResourceGroup --identity myidentity --key-encryption-key https://myhsm.managedhsm.azure.net/keys/mykey

Rotate manually to a specific Azure Key Vault key version.

az acr encryption rotate-key --name myregistry --resource-group MyResourceGroup --identity myidentity --key-encryption-key https://myvault.vault.azure.net/keys/mykey/00000000000000000000000000000000

Required Parameters

--name -n

The name of the container registry. It should be specified in lower case. You can configure the default registry name using az configure --defaults acr=<registry name>.

Optional Parameters

The following parameters are optional, but depending on the context, one or more might become required for the command to execute successfully.

--acquire-policy-token

Acquiring an Azure Policy token automatically for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--change-reference

The related change reference ID for this resource operation.

Property	Value
Parameter group:	Global Policy Arguments

--identity

Client id of managed identity, resource name or id of user assigned identity. Use '[system]' to refer to the system assigned identity.

--key-encryption-key

Azure Key Vault or Managed HSM key URI. To enable automated rotation, provide a versionless key URI. For manual rotation, provide a versioned key URI.

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

Property	Value
Default value:	False

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

Property	Value
Default value:	False

--output -o

Output format.

Property	Value
Default value:	json
Accepted values:	json, jsonc, none, table, tsv, yaml, yamlc

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

Property	Value
Default value:	False

az acr encryption show