Set up asymmetric keys

1. Create an RSA key

Open KMS > Customer managed keys > Create key and choose your region. Use these settings:

• Key type: Asymmetric
• Key usage: Encrypt and decrypt
• Key spec: RSA_3072

Finish creating the key with your own key administrators. Keep it enabled and copy its full ARN, ending in key/<CUSTOMER_KMS_KEY_ID>. Don’t use an alias ARN.

2. Create a public-key read policy

Open IAM > Policies > Create policy > JSON. Replace <CUSTOMER_KMS_KEY_ARN> and save this policy as OpenAI-PublicKeyRead.

12345678910{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["kms:DescribeKey", "kms:GetPublicKey"],
      "Resource": "<CUSTOMER_KMS_KEY_ARN>"
    }
  ]
}

The key supports decryption, but OpenAI only needs these read permissions. Don’t grant OpenAI key-user or key-administrator access.

3. Create the trusted IAM role

Open IAM > Roles > Create role > Custom trust policy. Replace <OPENAI_ORG_ID> with your OpenAI organization ID. Keep the OpenAI principal unchanged.

1234567891011121314151617{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::790389265272:role/EnterpriseKeyManagement"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<OPENAI_ORG_ID>"
        }
      }
    }
  ]
}

Attach OpenAI-PublicKeyRead and create the role. Copy its ARN. Use the same organization ID as external_id when registering the key.

4. Check the KMS key policy

Confirm that the key policy authorizes the role. If it doesn’t delegate authorization to IAM, add this statement. Replace <CUSTOMER_ROLE_ARN> and preserve existing administrator access.

In this KMS key policy, "Resource": "*" applies only to the key the policy is attached to. The IAM policy uses the exact key ARN.

123456789{
  "Sid": "AllowPublicKeyRead",
  "Effect": "Allow",
  "Principal": {
    "AWS": "<CUSTOMER_ROLE_ARN>"
  },
  "Action": ["kms:DescribeKey", "kms:GetPublicKey"],
  "Resource": "*"
}

Keep the role ARN and key ARN for registration.

1. Add the OpenAI enterprise application

Ask a tenant administrator to add EKM - OpenAI Azure to your tenant. Its application ID is 20a14814-5ab7-4612-a671-1382b412bf93.

Install Azure CLI, then sign in and check for the application:

123az login --tenant '<CUSTOMER_TENANT_ID>'
az ad sp show --id '20a14814-5ab7-4612-a671-1382b412bf93' \
  --query '{name:displayName,objectId:id}' -o table

If the application is missing, add it:

az ad sp create --id '20a14814-5ab7-4612-a671-1382b412bf93' \
  --query '{name:displayName,objectId:id}' -o table

Save the tenant-local object ID for the role assignment.

2. Create the key

Open Key vaults > Create. Select your subscription, resource group, vault name, and region. Under Access configuration, choose Azure role-based access control.

Your administrator needs a role that permits key creation, such as Key Vault Crypto Officer on this vault. Don’t grant that role to OpenAI.

In the vault, open Objects > Keys > Generate/Import and use:

• Name: <OPENAI_ORG_ID>--asymmetric-key, using your OpenAI organization ID
• Key type: RSA
• RSA key size: 3072
• Enabled: Yes

If you set activation or expiration dates, make sure the key is currently valid. Include Decrypt in the key’s permitted operations. OpenAI receives key-read access only.

RSA-HSM keys in a Key Vault are also supported. Standalone Managed HSM endpoints aren’t supported.

3. Grant key-read access

Create a custom role with the key-read DataAction. Save this as public-key-reader.json and replace the subscription and resource-group values.

123456789101112{
  "Name": "OpenAI Public Key Reader",
  "IsCustom": true,
  "Description": "Read key metadata and public keys.",
  "Actions": [],
  "NotActions": [],
  "DataActions": ["Microsoft.KeyVault/vaults/keys/read"],
  "NotDataActions": [],
  "AssignableScopes": [
    "/subscriptions/<CUSTOMER_SUBSCRIPTION_ID>/resourceGroups/<CUSTOMER_RESOURCE_GROUP>"
  ]
}

Set VAULT_RESOURCE_ID to the vault’s Azure resource ID from Properties, not its HTTPS URI. Set OPENAI_SP_ID to the application’s tenant-local object ID, then assign the role on the key:

123456789101112az role definition create --role-definition @public-key-reader.json

OPENAI_SP_ID='<CUSTOMER_OPENAI_SP_OBJECT_ID>'
VAULT_RESOURCE_ID='<CUSTOMER_VAULT_RESOURCE_ID>'
KEY_NAME='<OPENAI_ORG_ID>--asymmetric-key'
KEY_SCOPE="$VAULT_RESOURCE_ID/keys/$KEY_NAME"

az role assignment create \
  --assignee-object-id "$OPENAI_SP_ID" \
  --assignee-principal-type ServicePrincipal \
  --role 'OpenAI Public Key Reader' \
  --scope "$KEY_SCOPE"

For a vault using legacy access policies, grant key Get instead. Keep its existing permission model.

4. Record the exact version

Record your tenant ID, vault URI, and key name. Open the enabled key version and copy the 32-character hexadecimal version from the end of its Key Identifier.

1. Prepare the project and key

Enable Cloud KMS in the key project and IAM and Security Token Service in the federation project. If these projects differ, enable Cloud KMS in both.

Record your federation project’s 12-digit project number. The KMS project may be different.

Open Security > Key Management. Create a key ring, then create a key with:

• Protection level: Software
• Purpose: Asymmetric decrypt
• Algorithm: 3072 bit RSA - OAEP Padding - SHA256 Digest

Copy the KMS project ID, location, key ring, key name, and enabled version. Use a specific version such as "1", not "latest" or "0". Asymmetric keys don’t have a primary version.

2. Configure workload identity federation

Open IAM & Admin > Workload Identity Federation. Create a global pool, such as openai-keys, and an OIDC provider, such as openai-google, with these settings:

Use your OpenAI organization ID as the audience. Keep the issuer and OpenAI subject unchanged.

3. Create and assign the key-reader role

In IAM & Admin > Roles, create a custom role in the KMS project with:

cloudkms.cryptoKeyVersions.get
cloudkms.cryptoKeyVersions.viewPublicKey

Both permissions are required; public-key-viewer alone is insufficient. No decrypt, sign, or service-account impersonation grant is needed.

On the key’s Permissions tab, choose Grant access. Assign the role to this principal, replacing <CUSTOMER_GCP_PROJECT_NUMBER> and <CUSTOMER_GCP_POOL_ID>:

principal://iam.googleapis.com/projects/<CUSTOMER_GCP_PROJECT_NUMBER>/locations/global/workloadIdentityPools/<CUSTOMER_GCP_POOL_ID>/subject/105900137572174660365

Use your pool’s project number and scope the grant to this key. Key-level IAM covers its versions. Save the pool and provider IDs, organization audience, and KMS identifiers for registration.