Deploy Common Dependencies from the service catalog into a workload

In this article, you:

• Deploy a service catalog template for common dependencies into an existing workload from the portal.

The common dependencies template includes options to create the following resources:

• Key Vault
• Customer Managed Key (CMK) for encryption
• Disk Encryption Set (DES) for disk encryption
• Storage Account. See the separate Storage Account service catalog template for more deployment customization.
• Managed Identity to securely access your resources within Azure Enclave

Before you begin

• This article assumes a basic understanding of networking and Azure Enclave concepts. For more information, see Best practices of Azure Enclave.

• You need an Azure account with an active subscription. If you don't have one, create an account for free.

• You need a community, enclave, workload, and at least one workload resource group and permissions to create resources inside the workload resource group.

• Enable General (minimum) or Advanced maintenance mode for your enclave so you can add the Private Link resources to your enclave managed resource group.

Prerequisites

The enclaves have guardrail requirements to use customer-managed key (CMK) encryption for some resources. Create a key and an identity with access to the key for secured key access. Use this Common Dependencies service catalog template to create the CMK, with an optional Key Vault, and a managed identity.

1. Subnet for private endpoints: You can create subnets during enclave creation, or you can create new subnets after enclave creation.
2. Quickly create these Private DNS Zones based on what you create next:
   • Key Vault required when creating a Key Vault from this template or the more customizable Key Vault template.
   • Storage File, Storage Queue, Storage Blob, and Storage Table are required when making a Storage Account from this template or the more customizable Storage Account template.

Deploy the template

1. Navigate to the workload for the intended deployment.

2. Select the +Add an Azure Service button.

3. Select the Common Dependencies service template from the service catalog list dropdown, confirm the version you need (default: latest), and select Next.

   

4. Enter the required parameters on each tab.

5. Adjust any of the prepopulated parameters as needed.

6. Select Review + Create then Create.

Wait for the deployment to complete before you take any actions within your deployed resources.

Validate the deployment

Go to the specified resource group to confirm the intended resources were created.

Delete the deployment

If you don't plan on keeping these resources, clean up unnecessary resources to avoid Azure charges. If no other deployments exist in the resource group, the whole resource group can be deleted.

Recommendations

• Add tags to service catalog deployments to track important information for that resource such as:
  • Owner: <main POC>
  • Deployer: <yourName>
  • Purpose: <enclave shared resources>
  • Service Catalog Name: <Common Dependencies>
  • Service Catalog Version: <version you deployed>
• Consider adding an Azure Policy to enforce and inherit tags.

Troubleshooting

Expiration date doesn't match

If you deploy the Common Dependencies template and see an error stating the expiration date doesn't match for the CMK (Customer Managed Key) resource, you likely already have a CMK (a Key Vault key) with the same name. This error can occur if you deploy the template with the same inputs twice, since the expiration date can't be updated through a redeployment. This error means your CMK already exists and you can use it as-is. If you need to update the CMK, sign in to your Admin VM, and then access the key vault through the portal to make changes. You can also redeploy the Common Dependencies template and change the name of the CMK to create a new CMK.