From 446035ebcd6c1b4b1654fc7e6e72401deff8e931 Mon Sep 17 00:00:00 2001 From: Kyle Barron Date: Thu, 25 Jun 2026 10:11:18 -0400 Subject: [PATCH] feat: Support Azure customer provided keys --- obstore/python/obstore/_store/_azure.pyi | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/obstore/python/obstore/_store/_azure.pyi b/obstore/python/obstore/_store/_azure.pyi index 631006a8..d0084172 100644 --- a/obstore/python/obstore/_store/_azure.pyi +++ b/obstore/python/obstore/_store/_azure.pyi @@ -141,6 +141,28 @@ class AzureConfig(TypedDict, total=False): `endpoint` will take precedence over this option. """ + + encryption_key: str + """Base64-encoded customer-provided encryption key. + + Set the customer-provided encryption key (CPK) used to encrypt blob content. + + `key` must be a base64-encoded 256-bit AES key (the decoded value must be exactly 32 + bytes). The same key must be supplied on every subsequent read, write, or copy of + any blob created with it; if the key is lost or omitted the data is unrecoverable. + CPK material is sent to Azure on every request, so the configured endpoint must use + HTTPS. + + Only a subset of Blob storage operations support CPK (see the [Azure + documentation][cpk-ops]). When CPK is enabled, `copy` switches from the asynchronous + `Copy Blob` API to `Put Blob From URL`, which is synchronous and limits the source + blob to 5,000 MiB. + + [cpk-ops]: https://learn.microsoft.com/en-us/azure/storage/blobs/encryption-customer-provided-keys#blob-storage-operations-supporting-customer-provided-keys + + **Environment variable**: `AZURE_ENCRYPTION_KEY`. + """ + endpoint: str """Override the endpoint used to communicate with blob storage.