Unable to create an index synonym map in Azure Cognitive Search with Customer managed encryption key option

Question

1

I am trying to create an index/synonym map with encryption using "Customer" managed key option however I am not able to do so.

I am constantly getting the following error back from the service:

Failed to verify account key (HTTP Status Code: 403).

Here's what my request body for synonym map looks like:

{
    "name":"test",
    "format":"solr",
    "synonyms":"",
    "encryptionKey":
    {
        "keyVaultKeyName":"AzSearchKey2",
        "keyVaultKeyVersion":"02cc721e41654f079c173744313f24b0",
        "keyVaultUri":"https://azure.microsoft.com/en-us/products/key-vault"
    }
}

Answer 1

Following up with Gaurav confidentially, we determined that it was due to the key retention duration being too short (7 days retention instead of 90 days). We recently changed the product code to accommodate lower retention periods (down to 7 days), and the fix will be sent out globally in the coming weeks. Meanwhile, if you have the same problem, please change your key retention policy to 90 days. This incorrect condition can be identified if you receive the following notice from Azure Search when constructing an encrypted index or synonym map:

DataPlaneApiException: Could not wrap/unwrap the encryption key using the key vault key (YOUR KEY URL). The degree of key vault key deletion-recovery is inadequate. Soft-Delete and Purge Protection on Key vault must be activated, as described here: https://aka.ms/key-vault-soft-delete.