{"id":59179,"date":"2026-10-18T15:01:55","date_gmt":"2026-10-18T05:01:55","guid":{"rendered":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/18\/keeping-your-keys-yours-with-external-key-management-in-azure\/"},"modified":"2026-10-18T15:03:03","modified_gmt":"2026-10-18T05:03:03","slug":"keeping-your-keys-yours-with-external-key-management-in-azure","status":"publish","type":"post","link":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/18\/keeping-your-keys-yours-with-external-key-management-in-azure\/","title":{"rendered":"Keeping Your Keys Yours with External Key Management in Azure"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">In this blog post Keeping Your Keys Yours with External Key Management in Azure we will explain how organisations can keep critical encryption keys outside Microsoft\u2019s infrastructure, what that changes for data sovereignty, and where the operational risks sit.<\/p>\n\n\n\n<!--more-->\n\n\n\n<p class=\"wp-block-paragraph\">For many CIOs, the concern is no longer whether cloud data is encrypted. It is whether the organisation genuinely controls the keys, can prove that control to customers and regulators, and can still operate if part of the key-management chain fails.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft\u2019s external key management capability for Azure Key Vault Managed HSM addresses this concern. Managed HSM, or Managed Hardware Security Module, is a dedicated service for protecting important encryption keys. External key management allows the most sensitive key material to remain in hardware operated outside Microsoft\u2019s infrastructure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Our earlier article on why Managed HSM external keys matter for Australian sovereignty covers the strategic case. Here, we will focus on how the technology works and the decisions leaders need to make before using it.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">What external key management actually does<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Think of encrypted data as valuable documents inside a locked safe. Azure can operate the safe, but your organisation controls the master key needed to unlock the key that protects those documents.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Azure services normally encrypt data using a data encryption key. This is a fast, short-purpose key designed to protect the actual files, records or database information.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A second key, called a key encryption key, protects that data encryption key. With external key management, this higher-level key stays in an external hardware security module, or HSM, which is a tamper-resistant device designed specifically to protect encryption keys.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Azure service\n \u2193\nAzure Managed HSM checks identity and permission\n \u2193\nExternal Key Management proxy translates the request\n \u2193\nYour external HSM approves or rejects the key operation<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">The proxy is a controlled connection between Azure Managed HSM and the external HSM. It translates Azure\u2019s request into a format the external device understands, but it is not supposed to store the key itself.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The important point is that the external master key does not move into Azure. Azure receives only the result needed to protect or access the service\u2019s data encryption key.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key sovereignty is not the same as data residency<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Data residency asks where information is physically stored. Key sovereignty asks who controls the encryption keys, where those keys exist and who can authorise their use.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You can store data in an Australian Azure region and still have questions about key custody. Conversely, holding a key in Australia does not automatically resolve every privacy, contractual or cross-border data issue.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">External key management can strengthen four areas of control:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Custody:<\/strong> The key material remains in an HSM operated by your organisation or an approved provider.<\/li>\n<li><strong>Authority:<\/strong> Your organisation controls the systems and processes that allow the external key to be used.<\/li>\n<li><strong>Evidence:<\/strong> Logs can show when key operations were requested, approved or rejected.<\/li>\n<li><strong>Exit control:<\/strong> Access to protected data can be restricted by withdrawing access to the external key, subject to the behaviour of the Azure service using it.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">This can be valuable when a government contract, customer agreement or industry rule requires physical separation between the cloud provider and the organisation holding the key.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">However, external keys do not automatically make a system compliant. The Australian Privacy Principles require covered organisations to take reasonable technical and organisational steps to protect personal information. Key control may support that obligation, but it does not replace access management, monitoring, secure devices, backups or incident response.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The same applies to Essential Eight, the Australian government\u2019s cybersecurity framework for reducing common attack paths. External key management is not an Essential Eight checkbox. It is an additional control for workloads with unusually strict sovereignty requirements.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">The strongest control can become the biggest dependency<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Keeping the key outside Azure creates stronger separation, but it also introduces more components that must remain available.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If Azure Managed HSM cannot contact the proxy, or the proxy cannot reach the external HSM, key operations may fail. Depending on how the Azure service uses and caches encryption keys, that could eventually interrupt access to the protected workload.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Microsoft\u2019s service commitment covers Managed HSM itself. It does not cover the complete external chain, including your proxy, network connection and external HSM. Azure could therefore be operating normally while your application remains unavailable because the external key cannot be reached.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">There are also recovery limitations to plan around. Managed HSM geo-replication is not supported for external keys, and Azure backup and restore does not protect the external key material. Your HSM backup, recovery and regional resilience become your responsibility.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If that external key is permanently lost without a usable backup, the data it protects may become permanently inaccessible. This is why external key management should be treated as a business continuity programme, not simply a security configuration.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A practical Australian business scenario<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Consider a 220-person Australian software company bidding for work involving sensitive government and critical-infrastructure data. Its Azure environment is secure, but the customer\u2019s contract requires encryption keys to remain outside the cloud provider\u2019s infrastructure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Moving the whole application back on-premises would increase hosting costs, slow delivery and create a larger support burden. Standard customer-managed keys inside Azure may also fail to satisfy the exact wording of the contract.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">An external key architecture allows the application and data platform to remain in Azure while the key encryption key stays in a separately operated HSM. The company can demonstrate a clearer separation of control without rebuilding its entire platform.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The business outcome is not simply \u201cbetter encryption.\u201d It is the ability to qualify for the contract while retaining the scalability and productivity benefits of Azure.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">But the company must also fund redundant proxy services, HSM recovery, monitoring and round-the-clock ownership. If the contract does not genuinely require external custody, the added complexity may cost more than the risk it solves.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Questions CIOs should ask before approving the design<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Is there a written requirement?<\/strong> Identify the law, contract, customer control or risk decision that requires keys to remain outside Microsoft infrastructure.<\/li>\n<li><strong>Does the Azure service support it?<\/strong> External keys work with supported Azure services that can use Managed HSM customer-managed keys. Compatibility must be checked workload by workload.<\/li>\n<li><strong>Who operates the external HSM?<\/strong> Decide whether it will be managed internally, by an HSM vendor or by another approved provider.<\/li>\n<li><strong>What happens during an outage?<\/strong> Document the impact of losing the proxy, external HSM, network connection, certificates or supporting identity services.<\/li>\n<li><strong>How will keys be recovered?<\/strong> Test backup, restoration and replacement processes before production data depends on them.<\/li>\n<li><strong>Who can disable or delete a key?<\/strong> Separate approval, administration and operational roles so one compromised account cannot cause a major outage.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">This separation of duties matters just as much as the technology. The safeguards described in our article on security and governance in fast-moving engineering environments are particularly important when teams can affect encryption keys.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">A safer way to introduce external keys<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Start with one clearly defined workload rather than applying external key management across the organisation. Confirm the service supports the required key type, identity model and encryption configuration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Next, design redundant proxy and HSM connectivity. The connection uses mutual TLS, meaning Azure and the proxy verify each other with digital certificates before exchanging a request. Azure Private Link can add private network isolation, although its external key management integration remains in preview at the time of writing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Enable audit logs across Managed HSM, the proxy and the external HSM. Your team needs to follow one failed request through all three layers without guessing where the problem occurred.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Certificate expiry, key rotation and emergency recovery should also be rehearsed. Small lifecycle mistakes can create large outages when Azure\u2019s key reference and the actual external key fall out of sync.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Key-related software dependencies must be maintained as well. Our discussion of the Azure Key Vault SDK issue CIOs should assess shows why encryption controls need ongoing review rather than a one-time deployment.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">When standard Managed HSM is the better decision<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">For most organisations, keys stored directly in Azure Managed HSM provide strong customer control with lower latency, simpler recovery and fewer external dependencies. External key management is not automatically the more secure option.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It makes sense when physical external custody is a firm requirement and the business value justifies the operating cost. If the requirement is simply \u201cwe must control our keys,\u201d standard Managed HSM may already provide the appropriate balance.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The right decision comes from comparing sovereignty requirements, outage risk, recovery capability and total operating cost. It should not be driven by fear or by choosing the most complicated architecture available.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Keep control without creating a new blind spot<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">External key management gives Australian organisations a practical way to keep critical key material outside Microsoft infrastructure while continuing to use supported Azure services. That can reduce sovereignty concerns and help satisfy strict customer or contractual requirements.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">It also transfers significant responsibility back to your organisation. The proxy, external HSM, backups, certificates, monitoring and recovery process all become part of the production service.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CloudProInc combines more than 20 years of enterprise IT experience with hands-on work across Azure, Microsoft 365, Microsoft Defender and Wiz. As a Melbourne-based Microsoft Partner and Wiz Security Integrator, we help organisations determine whether stronger key separation will reduce real risk or simply add cost and complexity.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you are unsure whether external key management is necessary for your workloads, we are happy to review the requirement and current Azure design with you \u2014 no strings attached.<\/p>\n\n\n","protected":false},"excerpt":{"rendered":"<p>External key management can strengthen data sovereignty, but it also introduces new costs and risks. Here is what Australian technology leaders should assess before adopting it.<\/p>\n","protected":false},"author":1,"featured_media":59181,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_et_pb_use_builder":"","_et_pb_old_content":"","_et_gb_content_width":"","_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":true,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[46,19,13,130],"tags":[],"class_list":["post-59179","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-azure-key-vault","category-azure-security","category-blog","category-cybersecurity-strategy-governance"],"jetpack-related-posts":[{"id":59176,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/18\/why-managed-hsm-external-keys-matter-for-australian-sovereignty\/","url_meta":{"origin":59179,"position":0},"title":"Why Managed HSM External Keys Matter for Australian Sovereignty","author":"CPI Staff","date":"October 18, 2026","format":false,"excerpt":"Microsoft\u2019s Managed HSM external key management is now generally available. Here is what Australian leaders need to know about key custody, data sovereignty, compliance and operational risk.","rel":"","context":"In &quot;Azure Key Vault&quot;","block_context":{"text":"Azure Key Vault","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-key-vault\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/why-managed-hsm-external-keys-matter-for-australian-sovereignty.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/why-managed-hsm-external-keys-matter-for-australian-sovereignty.png 1x, \/wp-content\/uploads\/2026\/10\/why-managed-hsm-external-keys-matter-for-australian-sovereignty.png 1.5x, \/wp-content\/uploads\/2026\/10\/why-managed-hsm-external-keys-matter-for-australian-sovereignty.png 2x, \/wp-content\/uploads\/2026\/10\/why-managed-hsm-external-keys-matter-for-australian-sovereignty.png 3x, \/wp-content\/uploads\/2026\/10\/why-managed-hsm-external-keys-matter-for-australian-sovereignty.png 4x"},"classes":[]},{"id":59277,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/20\/azure-application-gateway-keyless-tls-without-slowing-delivery\/","url_meta":{"origin":59179,"position":1},"title":"Azure Application Gateway Keyless TLS Without Slowing Delivery","author":"CPI Staff","date":"October 20, 2026","format":false,"excerpt":"Keyless TLS keeps website private keys inside protected hardware while Application Gateway handles secure traffic. Learn where it fits, what it changes and how to adopt it safely.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 1x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 1.5x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 2x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 3x, \/wp-content\/uploads\/2026\/10\/azure-application-gateway-keyless-tls-without-slowing-delivery.png 4x"},"classes":[]},{"id":56780,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/security-best-practices-for-azure-ai-services\/","url_meta":{"origin":59179,"position":2},"title":"Security Best Practices for Azure AI Services","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Practical, step-by-step guidance to secure Azure AI services end to end\u2014identity, networks, data, prompts, and monitoring\u2014so your teams can innovate confidently without exposing your organisation.","rel":"","context":"In &quot;Azure AI Services&quot;","block_context":{"text":"Azure AI Services","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-ai-services\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png 1x, \/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png 1.5x, \/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png 2x, \/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png 3x, \/wp-content\/uploads\/2025\/11\/security-best-practices-for-azure-ai-services-in-practice.png 4x"},"classes":[]},{"id":59129,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/16\/vmware-to-azure-migration-security-choices-cios-face-in-2026\/","url_meta":{"origin":59179,"position":3},"title":"VMware to Azure Migration Security Choices CIOs Face in 2026","author":"CPI Staff","date":"October 16, 2026","format":false,"excerpt":"Moving VMware workloads to Azure involves more than choosing VM sizes. CIOs must decide where Confidential VMs, Secure Boot and the right encryption model reduce risk without inflating cost.","rel":"","context":"In &quot;Azure&quot;","block_context":{"text":"Azure","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/microsoft-azure\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png 1x, \/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png 1.5x, \/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png 2x, \/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png 3x, \/wp-content\/uploads\/2026\/10\/vmware-to-azure-migration-security-choices-cios-face-in-2026.png 4x"},"classes":[]},{"id":53906,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/how-to-secure-api-keys-with-python\/","url_meta":{"origin":59179,"position":4},"title":"How to Secure API Keys with Python","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"Practical patterns to protect API keys in Python. Learn safe storage, retrieval, rotation, and CI\/CD hygiene with code examples and cloud options.","rel":"","context":"In &quot;Blog&quot;","block_context":{"text":"Blog","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/blog\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2025\/09\/how-to-secure-api-keys-with-python-for-apps-and-infrastructure.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2025\/09\/how-to-secure-api-keys-with-python-for-apps-and-infrastructure.png 1x, \/wp-content\/uploads\/2025\/09\/how-to-secure-api-keys-with-python-for-apps-and-infrastructure.png 1.5x, \/wp-content\/uploads\/2025\/09\/how-to-secure-api-keys-with-python-for-apps-and-infrastructure.png 2x, \/wp-content\/uploads\/2025\/09\/how-to-secure-api-keys-with-python-for-apps-and-infrastructure.png 3x, \/wp-content\/uploads\/2025\/09\/how-to-secure-api-keys-with-python-for-apps-and-infrastructure.png 4x"},"classes":[]},{"id":58540,"url":"https:\/\/www.cloudproinc.com.au\/index.php\/2026\/10\/12\/the-azure-key-vault-sdk-fix-cios-should-ask-teams-to-assess-now\/","url_meta":{"origin":59179,"position":5},"title":"The Azure Key Vault SDK Fix CIOs Should Ask Teams to Assess Now","author":"CPI Staff","date":"October 12, 2026","format":false,"excerpt":"A critical Java SDK flaw could weaken local checks on encrypted data. Here is what CIOs should ask engineering teams to find, patch and prove.","rel":"","context":"In &quot;Azure Key Vault&quot;","block_context":{"text":"Azure Key Vault","link":"https:\/\/www.cloudproinc.com.au\/index.php\/category\/azure-key-vault\/"},"img":{"alt_text":"","src":"\/wp-content\/uploads\/2026\/08\/the-azure-key-vault-sdk-fix-cios-should-ask-teams-to-assess-now.png","width":350,"height":200,"srcset":"\/wp-content\/uploads\/2026\/08\/the-azure-key-vault-sdk-fix-cios-should-ask-teams-to-assess-now.png 1x, \/wp-content\/uploads\/2026\/08\/the-azure-key-vault-sdk-fix-cios-should-ask-teams-to-assess-now.png 1.5x, \/wp-content\/uploads\/2026\/08\/the-azure-key-vault-sdk-fix-cios-should-ask-teams-to-assess-now.png 2x, \/wp-content\/uploads\/2026\/08\/the-azure-key-vault-sdk-fix-cios-should-ask-teams-to-assess-now.png 3x, \/wp-content\/uploads\/2026\/08\/the-azure-key-vault-sdk-fix-cios-should-ask-teams-to-assess-now.png 4x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"\/wp-content\/uploads\/2026\/10\/keeping-your-keys-yours-with-external-key-management-in-azure.png","_links":{"self":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59179","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/comments?post=59179"}],"version-history":[{"count":1,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59179\/revisions"}],"predecessor-version":[{"id":59180,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/posts\/59179\/revisions\/59180"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media\/59181"}],"wp:attachment":[{"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/media?parent=59179"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/categories?post=59179"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.cloudproinc.com.au\/index.php\/wp-json\/wp\/v2\/tags?post=59179"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}