Storage account uses customer-managed keys

# Configure a Storage Account to use Customer-Managed Keys (CMK)
resource "azurerm_storage_account" "<example_resource_name>" {
  name                     = "<example_resource_name>"
  resource_group_name      = "<example_resource_name>"
  location                 = "<location>"
  account_tier             = "Standard"
  account_replication_type = "LRS"

  identity {
    type = "SystemAssigned" # CRITICAL: allow storage account to access Key Vault
  }

  customer_managed_key {
    key_vault_key_id = "<example_resource_id>" # CRITICAL: Key Vault key ID enabling CMK (passes the check)
  }
}

// Configure a Storage Account to use Customer-Managed Keys (CMK)
resource sa 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  name: '<example_resource_name>'
  location: '<location>'
  sku: { name: 'Standard_LRS' }
  kind: 'StorageV2'
  identity: {
    type: 'SystemAssigned' // CRITICAL: required so the storage account can access the key vault
  }
  properties: {
    encryption: {
      keySource: 'Microsoft.Keyvault' // CRITICAL: switches encryption to CMK (TigerGate checks for this)
      keyVaultProperties: {
        keyName: '<key_name>' // required key name
        keyVaultUri: 'https://<example_resource_name>.vault.azure.net/' // required Key Vault URI
      }
    }
  }
}