This question already has an answer here:
Need to store some content in Azure Blob Storage, and want to encrypt prior to storing it on Azure Blob (we don't want to rely on Azure storage encryption on-rest). The issue is we do not want to store our encryption keys on Azure (e.g. Key vault), and store it outside of Azure.
Any suggestion on strategies for achieving this? One of the possible option is to keep encryption logic inside HSMs outside Azure, but that would be quite expensive. Keeping keys in database wouldn't fly well either from security perspective. Appreciate if there are any other recommendations?