Skip to content

Commit e7e5cc9

Browse files
uc-msftuc-msft
authored
Merge pull request microsoft#1216 from Pietervanhove/AlwaysEncryptedDemos
Always encrypted demos
2 parents 4332ce6 + 39c9dbf commit e7e5cc9

File tree

7 files changed

+82
-66
lines changed

7 files changed

+82
-66
lines changed

‎samples/features/security/always-encrypted-with-secure-enclaves/azure-sql-database-sgx/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,7 @@ Perform the below steps before each demo presentation.
118118
- `<project name>vault` - a key vault in Azure Key Vault, containing the column master key for Always Encrypted.
119119
- `ContosoHR` - a database.
120120

121-
1. Right-click on the **ContosoHR** database in the resource group and open its **Overview** blade in the new tab. Click on **Compute + storage** under **Settings**. Click **Change configuration**. Note that the database is already configured to use the DC-series hardware configuration that supports confidential computing using secure enclaves. Setting the DC-series hardware configuration for a database is required to use Always Encrypted with secure enclaves in the database. For more information, see [Enable Intel SGX for your Azure SQL Database](https://docs.microsoft.com/azure/azure-sql/database/always-encrypted-enclaves-enable-sgx).
121+
1. Right-click on the **ContosoHR** database in the resource group and open its **Overview** blade in the new tab. Click on **Compute + storage** under **Settings**. Click **Change configuration**. Note that the database is already configured to use the DC-series hardware configuration that supports confidential computing using secure enclaves. Setting the DC-series hardware configuration for a database is required to use Always Encrypted with secure enclaves in the database. For more information, see [Enable Intel SGX for your Azure SQL Database](https://docs.microsoft.com/azure/azure-sql/database/always-encrypted-enclaves-enable-sgx). In the left ribbon, click on **Data Encryption** and click in the blade on **Always Encrypted**. Confirm that the Secure Enclave is enabled and that the enclave type is **Intel Software Guard Extension (Intel SGX)**
122122

123123
![DC-series hardware configuration](./img/portal-dc-series-configuration.png)
124124

‎samples/features/security/always-encrypted-with-secure-enclaves/azure-sql-database-sgx/setup/azuredeploy.bicep

Lines changed: 31 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ param userName string
1414
@description('The username of the Azure SQL database server administrator for SQL authentication.')
1515
param sqlAdminUserName string
1616

17+
@secure()
1718
@description('The password of the Azure SQL database server administrator for SQL authentication.')
1819
param sqlAdminPassword string
1920

@@ -29,9 +30,9 @@ param location string = resourceGroup().location
2930
////////////////////////////////////////////
3031

3132
// Create the server
32-
var SQLServerName_var = '${projectName}server'
33-
resource Server_Name_resource 'Microsoft.Sql/servers@2022-05-01-preview' = {
34-
name: SQLServerName_var
33+
var SQLServerName = '${projectName}server'
34+
resource Server_Name_resource 'Microsoft.Sql/servers@2023-02-01-preview' = {
35+
name: SQLServerName
3536
location: location
3637
tags: {}
3738
identity: {
@@ -47,41 +48,43 @@ resource Server_Name_resource 'Microsoft.Sql/servers@2022-05-01-preview' = {
4748
}
4849

4950
// Allow Azure services and resources to access this server
50-
resource Server_Name_AllowAllWindowsAzureIps 'Microsoft.Sql/servers/firewallRules@2022-05-01-preview' = {
51-
name: '${Server_Name_resource.name}/AllowAllWindowsAzureIps'
51+
resource Server_Name_AllowAllWindowsAzureIps 'Microsoft.Sql/servers/firewallRules@2023-02-01-preview' = {
52+
parent: Server_Name_resource
53+
name: 'AllowAllWindowsAzureIps'
5254
properties: {
5355
endIpAddress: '0.0.0.0'
5456
startIpAddress: '0.0.0.0'
5557
}
5658
}
5759

5860
// Allow Client IP to access this server
59-
resource Server_Name_AllowClientIP 'Microsoft.Sql/servers/firewallRules@2022-05-01-preview' = {
60-
name: '${Server_Name_resource.name}/AllowClientIP'
61+
resource Server_Name_AllowClientIP 'Microsoft.Sql/servers/firewallRules@2023-02-01-preview' = {
62+
parent: Server_Name_resource
63+
name: 'AllowClientIP'
6164
properties: {
6265
endIpAddress: clientIP
6366
startIpAddress: clientIP
6467
}
6568
}
6669

6770
// Make the user an Azure AD administrator for the server, so that the user can connect with universal authentication
68-
resource Server_Name_activeDirectory 'Microsoft.Sql/servers/administrators@2022-05-01-preview' = {
69-
name: '${Server_Name_resource.name}/activeDirectory'
71+
resource Server_Name_activeDirectory 'Microsoft.Sql/servers/administrators@2023-02-01-preview' = {
72+
parent: Server_Name_resource
73+
name: 'activeDirectory'
7074
properties: {
7175
administratorType: 'ActiveDirectory'
7276
login: userName
73-
//sid: reference(resourceId('Microsoft.Sql/servers', '${projectName}server'), '2019-06-01-preview', 'Full').identity.principalId
7477
sid: userObjectId
75-
//tenantId: AAD_TenantId //optional
76-
}
78+
}
7779
}
7880

7981
//////////////////////////////////////////////////////////////////////////////
8082
// Create the ContosoHR database using the DC-series hardware configuration //
8183
//////////////////////////////////////////////////////////////////////////////
8284

83-
resource Database_Resource 'Microsoft.Sql/servers/databases@2022-05-01-preview' = {
84-
name: '${Server_Name_resource.name}/ContosoHR'
85+
resource Database_Resource 'Microsoft.Sql/servers/databases@2023-02-01-preview' = {
86+
parent: Server_Name_resource
87+
name: 'ContosoHR'
8588
location: location
8689
tags: {}
8790
sku: {
@@ -96,18 +99,18 @@ resource Database_Resource 'Microsoft.Sql/servers/databases@2022-05-01-preview'
9699
///////////////////////////////////////
97100

98101
// Create the attestation provider
99-
resource attestationProviderName_resource 'Microsoft.Attestation/attestationProviders@2021-06-01-preview' = {
100-
name: '${projectName}attest'
102+
resource attestationProviderName 'Microsoft.Attestation/attestationProviders@2021-06-01' = {
103+
name: '${projectName}attestation'
101104
location: location
102105
properties: {}
103106
}
104107

105108
///////////////////////////////////
106109
// Configure the web application //
107110
///////////////////////////////////
108-
111+
var sqlServerSuffix = environment().suffixes.sqlServerHostname
109112
// Create an App Service plan
110-
resource WebAppServicePlan_Resource 'Microsoft.Web/serverfarms@2022-03-01' = {
113+
resource WebAppServicePlan_Resource 'Microsoft.Web/serverfarms@2022-09-01' = {
111114
name: '${projectName}plan'
112115
location: location
113116
properties: {}
@@ -117,7 +120,7 @@ resource WebAppServicePlan_Resource 'Microsoft.Web/serverfarms@2022-03-01' = {
117120
}
118121

119122
// Create the App Service
120-
resource WebApp_Resource 'Microsoft.Web/sites@2022-03-01' = {
123+
resource WebApp_Resource 'Microsoft.Web/sites@2022-09-01' = {
121124
name: '${projectName}app'
122125
location: location
123126
identity: {
@@ -132,7 +135,7 @@ resource WebApp_Resource 'Microsoft.Web/sites@2022-03-01' = {
132135
name: 'connectionstrings'
133136
properties: {
134137
ContosoHRDatabase: {
135-
value: 'Server=tcp:${Server_Name_resource.name}.database.windows.net;Database=ContosoHR;Column Encryption Setting=Enabled; Attestation Protocol = AAS; Enclave Attestation Url=${attestationProviderName_resource.properties.attestUri}; Authentication=Active Directory Managed Identity'
138+
value: 'Server=tcp:${Server_Name_resource.name}${sqlServerSuffix};Database=ContosoHR;Column Encryption Setting=Enabled; Attestation Protocol = AAS; Enclave Attestation Url=${attestationProviderName.properties.attestUri}; Authentication=Active Directory Managed Identity'
136139
type: 'SQLAzure'
137140
}
138141
}
@@ -147,8 +150,9 @@ resource WebApp_Resource 'Microsoft.Web/sites@2022-03-01' = {
147150
}
148151

149152
// Deploy the application
150-
resource sourceControl 'Microsoft.Web/sites/sourcecontrols@2022-03-01' = {
151-
name: '${projectName}app/web'
153+
resource sourceControl 'Microsoft.Web/sites/sourcecontrols@2022-09-01' = {
154+
parent: WebApp_Resource
155+
name: 'web'
152156
properties: {
153157
repoUrl: 'https://github.com/microsoft/sql-server-samples.git'
154158
branch: 'master'
@@ -164,7 +168,7 @@ resource sourceControl 'Microsoft.Web/sites/sourcecontrols@2022-03-01' = {
164168
//////////////////////////////////////
165169

166170
// Create a key vault and assign key permissions to the user, so that the user can manage the keys
167-
resource KeyVault_Resource 'Microsoft.KeyVault/vaults@2022-07-01' = {
171+
resource KeyVault_Resource 'Microsoft.KeyVault/vaults@2023-02-01' = {
168172
name: '${projectName}vault'
169173
location: location
170174
tags: {}
@@ -197,7 +201,7 @@ resource KeyVault_Resource 'Microsoft.KeyVault/vaults@2022-07-01' = {
197201
}
198202

199203
// Assign key permissions to the web app
200-
resource KeyVaultWebAppAccessPolicy_Resource 'Microsoft.KeyVault/vaults/accessPolicies@2022-07-01' = {
204+
resource KeyVaultWebAppAccessPolicy_Resource 'Microsoft.KeyVault/vaults/accessPolicies@2023-02-01' = {
201205
name: any('${KeyVault_Resource.name}/add')
202206
properties: {
203207
accessPolicies: [
@@ -218,8 +222,9 @@ resource KeyVaultWebAppAccessPolicy_Resource 'Microsoft.KeyVault/vaults/accessPo
218222
}
219223

220224
// Create a key
221-
resource Key_Resource 'Microsoft.KeyVault/vaults/keys@2022-07-01' = {
222-
name: '${KeyVault_Resource.name}/CMK'
225+
resource Key_Resource 'Microsoft.KeyVault/vaults/keys@2023-02-01' = {
226+
parent: KeyVault_Resource
227+
name: 'CMK'
223228
tags: {}
224229
properties: {
225230
attributes: {

‎samples/features/security/always-encrypted-with-secure-enclaves/azure-sql-database-sgx/setup/setup.ps1

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
Import-Module "Az" -MinimumVersion "9.3"
2-
Import-Module "SqlServer" #-Version "22.0.49-preview"
1+
Import-Module "Az"
2+
Import-Module "SqlServer"
33

44
######################################################################
55
# Prompt the user to enter the values of deployment parameters
@@ -10,9 +10,9 @@ $subscriptionId = Read-Host -Prompt "Enter your subscription id"
1010
$location = Read-Host -Prompt "Enter a region where you want to deploy the demo environment"
1111
$sqlAdminUserName = Read-Host -Prompt "Enter the username of the Azure SQL database server administrator for SQL authentication"
1212
$sqlAdminPasswordSecureString = Read-Host -Prompt "Enter the password of the Azure SQL database server administrator for SQL authentication" -AsSecureString
13-
13+
$Secure_String_Pwd = ConvertTo-SecureString $sqlAdminPasswordSecureString -AsPlainText -Force
1414
$sqlAdminPassword = (New-Object PSCredential "user",$sqlAdminPasswordSecureString).GetNetworkCredential().Password
15-
$clientIP = (Invoke-WebRequest ifconfig.me/ip).Content.Trim()
15+
$clientIP = (Invoke-WebRequest http://ipinfo.io/ip).Content.Trim()
1616
$bicepFile = "azuredeploy.bicep"
1717
$projectName = $projectName.ToLower()
1818

@@ -42,7 +42,7 @@ New-AzResourceGroupDeployment `
4242
-userObjectId $userObjectId `
4343
-userName $userName `
4444
-sqlAdminUserName $sqlAdminUserName `
45-
-sqlAdminPassword $sqlAdminPassword `
45+
-sqlAdminPassword $Secure_String_Pwd `
4646
-clientIP $clientIP
4747

4848
######################################################################
@@ -105,7 +105,7 @@ $keyName = "CMK"
105105
$key = Get-AzKeyVaultKey -VaultName $keyVaultName -Name $keyName
106106

107107
# Connect to the database using the SqlServer PowerShell module
108-
$connStr = "Data Source=tcp:$serverName;Initial Catalog=$databaseName;User ID=$sqlAdminUserName;Password=$sqlAdminPassword"
108+
$connStr = "Data Source=tcp:$serverName;Initial Catalog=$databaseName;User ID=$sqlAdminUserName;Password=$sqlAdminPasswordSecureString"
109109
$database = Get-SqlDatabase -ConnectionString $connStr
110110

111111
# Sign in to Azure with your email address using the SqlServer PowerShell module
@@ -134,7 +134,7 @@ Set-SqlColumnEncryption -ColumnEncryptionSettings $encryptedColumnSettings -Inpu
134134
######################################################################
135135

136136
$resourceGroupName = "${projectName}"
137-
$attestationProviderName = "${projectName}attest"
137+
$attestationProviderName = "${projectName}attestation"
138138
$policyFile = "AttestationPolicy.txt"
139139
$teeType = "SgxEnclave"
140140
$policyFormat = "Text"

‎samples/features/security/always-encrypted-with-secure-enclaves/azure-sql-database-vbs/README.md

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -128,6 +128,11 @@ Perform the below steps before each demo presentation.
128128

129129
2. Click on **Access Policies**. You should see two access policy entries: one for your identity and one for the web app's identity. These policies grant you permissions necessary to perform key management operations and they grant the web app permissions required to decrypt column encryption keys, protecting the data.
130130

131+
1. Close the browser tab for the key vault. Right-click on the logical server in your resource group and open its **Overview** blade in a new tab.
132+
1. Click on **SQL Databases** and select **ContosoHR** database.
133+
2. In the left ribbon, click on **Data Encryption** and click in the blade on **Always Encrypted**.
134+
3. Confirm that the Secure Enclave is enabled and that the enclave type is **Virtualization based security (VBS)**
135+
131136
1. Switch to SSMS.
132137
1. In Object Explorer, navigate to the **ContosoHR** database. Then go to **Security** > **Always Encrypted Keys**.
133138
1. Open the **Column Master Keys** and **Column Encryption Keys** folders. You should see the metadata object, named **CMK1**, for the column master key and the metadata object, named **CEK1**, for the column encryption key.

‎samples/features/security/always-encrypted-with-secure-enclaves/azure-sql-database-vbs/setup/azuredeploy.bicep

Lines changed: 30 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ param userName string
1515
param sqlAdminUserName string
1616

1717
@description('The password of the Azure SQL database server administrator for SQL authentication.')
18+
@secure()
1819
param sqlAdminPassword string
1920

2021
@description('The IP address the user will connect from to the logical server in Azure SQL Database.')
@@ -29,9 +30,9 @@ param location string = resourceGroup().location
2930
////////////////////////////////////////////
3031

3132
// Create the server
32-
var SQLServerName_var = '${projectName}server'
33-
resource Server_Name_resource 'Microsoft.Sql/servers@2022-05-01-preview' = {
34-
name: SQLServerName_var
33+
var SQLServerName = '${projectName}server'
34+
resource Server_Name_resource 'Microsoft.Sql/servers@2023-02-01-preview' = {
35+
name: SQLServerName
3536
location: location
3637
tags: {}
3738
identity: {
@@ -47,58 +48,60 @@ resource Server_Name_resource 'Microsoft.Sql/servers@2022-05-01-preview' = {
4748
}
4849

4950
// Allow Azure services and resources to access this server
50-
resource Server_Name_AllowAllWindowsAzureIps 'Microsoft.Sql/servers/firewallRules@2022-05-01-preview' = {
51-
name: '${Server_Name_resource.name}/AllowAllWindowsAzureIps'
51+
resource Server_Name_AllowAllWindowsAzureIps 'Microsoft.Sql/servers/firewallRules@2023-02-01-preview' = {
52+
parent: Server_Name_resource
53+
name: 'AllowAllWindowsAzureIps'
5254
properties: {
5355
endIpAddress: '0.0.0.0'
5456
startIpAddress: '0.0.0.0'
5557
}
5658
}
5759

5860
// Allow Client IP to access this server
59-
resource Server_Name_AllowClientIP 'Microsoft.Sql/servers/firewallRules@2022-05-01-preview' = {
60-
name: '${Server_Name_resource.name}/AllowClientIP'
61+
resource Server_Name_AllowClientIP 'Microsoft.Sql/servers/firewallRules@2023-02-01-preview' = {
62+
parent: Server_Name_resource
63+
name: 'AllowClientIP'
6164
properties: {
6265
endIpAddress: clientIP
6366
startIpAddress: clientIP
6467
}
6568
}
6669

6770
// Make the user an Azure AD administrator for the server, so that the user can connect with universal authentication
68-
resource Server_Name_activeDirectory 'Microsoft.Sql/servers/administrators@2022-05-01-preview' = {
69-
name: '${Server_Name_resource.name}/activeDirectory'
71+
resource Server_Name_activeDirectory 'Microsoft.Sql/servers/administrators@2023-02-01-preview' = {
72+
parent: Server_Name_resource
73+
name: 'activeDirectory'
7074
properties: {
7175
administratorType: 'ActiveDirectory'
7276
login: userName
73-
//sid: reference(resourceId('Microsoft.Sql/servers', '${projectName}server'), '2019-06-01-preview', 'Full').identity.principalId
7477
sid: userObjectId
75-
//tenantId: AAD_TenantId //optional
76-
}
78+
}
7779
}
7880

7981
//////////////////////////////////////////////////////////////////////////////
8082
// Create the ContosoHR database using the DC-series hardware configuration //
8183
//////////////////////////////////////////////////////////////////////////////
8284

83-
resource Database_Resource 'Microsoft.Sql/servers/databases@2022-05-01-preview' = {
84-
name: '${Server_Name_resource.name}/ContosoHR'
85+
resource Database_Resource 'Microsoft.Sql/servers/databases@2023-02-01-preview' = {
86+
parent: Server_Name_resource
87+
name: 'ContosoHR'
8588
location: location
8689
tags: {}
8790
sku: {
8891
name: 'GP_Gen5_2'
8992
tier: 'GeneralPurpose'
9093
}
9194
properties: {
92-
//preferredEnclaveType: 'VBS'
95+
preferredEnclaveType: 'VBS'
9396
}
9497
}
9598

9699
///////////////////////////////////
97100
// Configure the web application //
98101
///////////////////////////////////
99-
102+
var sqlServerSuffix = environment().suffixes.sqlServerHostname
100103
// Create an App Service plan
101-
resource WebAppServicePlan_Resource 'Microsoft.Web/serverfarms@2022-03-01' = {
104+
resource WebAppServicePlan_Resource 'Microsoft.Web/serverfarms@2022-09-01' = {
102105
name: '${projectName}plan'
103106
location: location
104107
properties: {}
@@ -108,7 +111,7 @@ resource WebAppServicePlan_Resource 'Microsoft.Web/serverfarms@2022-03-01' = {
108111
}
109112

110113
// Create the App Service
111-
resource WebApp_Resource 'Microsoft.Web/sites@2022-03-01' = {
114+
resource WebApp_Resource 'Microsoft.Web/sites@2022-09-01' = {
112115
name: '${projectName}app'
113116
location: location
114117
identity: {
@@ -123,7 +126,7 @@ resource WebApp_Resource 'Microsoft.Web/sites@2022-03-01' = {
123126
name: 'connectionstrings'
124127
properties: {
125128
ContosoHRDatabase: {
126-
value: 'Server=tcp:${Server_Name_resource.name}.database.windows.net;Database=ContosoHR;Column Encryption Setting=Enabled; Attestation Protocol = None; Authentication=Active Directory Managed Identity'
129+
value: 'Server=tcp:${Server_Name_resource.name}${sqlServerSuffix};Database=ContosoHR;Column Encryption Setting=Enabled; Attestation Protocol = None; Authentication=Active Directory Managed Identity'
127130
type: 'SQLAzure'
128131
}
129132
}
@@ -138,8 +141,9 @@ resource WebApp_Resource 'Microsoft.Web/sites@2022-03-01' = {
138141
}
139142

140143
// Deploy the application
141-
resource sourceControl 'Microsoft.Web/sites/sourcecontrols@2022-03-01' = {
142-
name: '${projectName}app/web'
144+
resource sourceControl 'Microsoft.Web/sites/sourcecontrols@2022-09-01' = {
145+
parent: WebApp_Resource
146+
name: 'web'
143147
properties: {
144148
repoUrl: 'https://github.com/microsoft/sql-server-samples.git'
145149
branch: 'master'
@@ -155,7 +159,7 @@ resource sourceControl 'Microsoft.Web/sites/sourcecontrols@2022-03-01' = {
155159
//////////////////////////////////////
156160

157161
// Create a key vault and assign key permissions to the user, so that the user can manage the keys
158-
resource KeyVault_Resource 'Microsoft.KeyVault/vaults@2022-07-01' = {
162+
resource KeyVault_Resource 'Microsoft.KeyVault/vaults@2023-02-01' = {
159163
name: '${projectName}vault'
160164
location: location
161165
tags: {}
@@ -188,7 +192,7 @@ resource KeyVault_Resource 'Microsoft.KeyVault/vaults@2022-07-01' = {
188192
}
189193

190194
// Assign key permissions to the web app
191-
resource KeyVaultWebAppAccessPolicy_Resource 'Microsoft.KeyVault/vaults/accessPolicies@2022-07-01' = {
195+
resource KeyVaultWebAppAccessPolicy_Resource 'Microsoft.KeyVault/vaults/accessPolicies@2023-02-01' = {
192196
name: any('${KeyVault_Resource.name}/add')
193197
properties: {
194198
accessPolicies: [
@@ -209,8 +213,9 @@ resource KeyVaultWebAppAccessPolicy_Resource 'Microsoft.KeyVault/vaults/accessPo
209213
}
210214

211215
// Create a key
212-
resource Key_Resource 'Microsoft.KeyVault/vaults/keys@2022-07-01' = {
213-
name: '${KeyVault_Resource.name}/CMK'
216+
resource Key_Resource 'Microsoft.KeyVault/vaults/keys@2023-02-01' = {
217+
parent: KeyVault_Resource
218+
name: 'CMK'
214219
tags: {}
215220
properties: {
216221
attributes: {

0 commit comments

Comments
 (0)