Skip to content

Commit 312e556

Browse files
cormacpaynecormacpayne
authored
Merge pull request Azure#3490 from mihymel/dev
Adding new cmdlets for Sql Transparent Data Encryption with Azure Key…
2 parents 883e428 + db02190 commit 312e556

File tree

35 files changed

+9674
-9
lines changed

35 files changed

+9674
-9
lines changed

‎src/ResourceManager/Sql/AzureRM.Sql.psd1

Lines changed: 7 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -154,8 +154,13 @@ CmdletsToExport = 'Get-AzureRmSqlDatabaseTransparentDataEncryption',
154154
'Set-AzureRmSqlElasticPoolAdvisorAutoExecuteStatus',
155155
'Set-AzureRmSqlServerAdvisorAutoExecuteStatus',
156156
'Get-AzureRmSqlDatabaseAdvisor',
157-
'Set-AzureRmSqlDatabaseAdvisorAutoExecuteStatus'
158-
157+
'Set-AzureRmSqlDatabaseAdvisorAutoExecuteStatus',
158+
'Get-AzureRmSqlServerTransparentDataEncryptionProtector',
159+
'Set-AzureRmSqlServerTransparentDataEncryptionProtector',
160+
'Add-AzureRmSqlServerKeyVaultKey',
161+
'Get-AzureRmSqlServerKeyVaultKey',
162+
'Remove-AzureRmSqlServerKeyVaultKey'
163+
159164
# Variables to export from this module
160165
# VariablesToExport = @()
161166

‎src/ResourceManager/Sql/ChangeLog.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,13 @@
1818
- Additional information about change #1
1919
-->
2020
## Current Release
21+
* Adding new cmdlets for support for Azure SQL feature Transparent Data Encryption (TDE) with Bring Your Own Key (BYOK) Support
22+
- TDE with BYOK support is a new feature in Azure SQL, which allows users to encrypt their database with a key from Azure Key Vault. This feature is currently in private preview.
23+
- Get-AzureRmSqlServerKeyVaultKey : This cmdlet returns a list of Azure Key Vault keys added to a Sql Server.
24+
- Add-AzureRmSqlServerKeyVaultKey : This cmdlet adds an Azure Key Vault key to a Sql Server.
25+
- Remove-AzureRmSqlServerKeyVaultKey : This cmdlet removes an Azure Key Vault key from a Sql Server.
26+
- Get-AzureRmSqlServerTransparentDataEncryptionProtector : This cmdlet returns the current encryption protector for a Sql Server.
27+
- Set-AzureRmSqlServerTransparentDataEncryptionProtector : This cmdlet sets the encryption protector for a Sql Server. The encryption protector can be set to a key from Azure Key Vault or a key that is managed by Azure Sql.
2128

2229
## Version 2.5.0
2330
* Added new return parameter "AuditType" to Get-AzureRmSqlDatabaseAuditingPolicy and Get-AzureRmSqlServerAuditingPolicy returned object

‎src/ResourceManager/Sql/Commands.Sql.Test/Commands.Sql.Test.csproj

Lines changed: 20 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,7 @@
7171
</Reference>
7272
<Reference Include="Microsoft.Azure.Management.Sql">
7373
<SpecificVersion>False</SpecificVersion>
74-
<HintPath>..\..\..\packages\Microsoft.Azure.Management.Sql.0.51.0-prerelease\lib\net40\Microsoft.Azure.Management.Sql.dll</HintPath>
74+
<HintPath>..\..\..\packages\Microsoft.Azure.Management.Sql.0.52.0-prerelease\lib\net40\Microsoft.Azure.Management.Sql.dll</HintPath>
7575
</Reference>
7676
<Reference Include="Microsoft.Azure.Management.Storage">
7777
<HintPath>..\..\..\packages\Microsoft.Azure.Management.Storage.2.4.0-preview\lib\net40\Microsoft.Azure.Management.Storage.dll</HintPath>
@@ -274,6 +274,7 @@
274274
<Compile Include="ScenarioTests\SqlEvnSetupHelper.cs" />
275275
<Compile Include="ScenarioTests\SqlTestsBase.cs" />
276276
<Compile Include="ScenarioTests\TransparentDataEncryptionCrudTests.cs" />
277+
<Compile Include="ScenarioTests\ServerKeyVaultKeyTests.cs" />
277278
<Compile Include="ScenarioTests\IndexRecommendationTests.cs" />
278279
<Compile Include="ScenarioTests\ImportExportTests.cs" />
279280
<Compile Include="UnitTests\AzureSqlDatabaseImportExportTests.cs" />
@@ -362,6 +363,9 @@
362363
</None>
363364
<None Include="ScenarioTests\TransparentDataEncryptionCrudTests.ps1">
364365
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
366+
</None>
367+
<None Include="ScenarioTests\ServerKeyVaultKeyTests.ps1">
368+
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
365369
</None>
366370
<None Include="SessionRecords\Microsoft.Azure.Commands.Sql.Test.ScenarioTests.AdvisorTests\TestGetElasticPoolAdvisor.json">
367371
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
@@ -719,6 +723,21 @@
719723
</None>
720724
<None Include="SessionRecords\Microsoft.Azure.Commands.Sql.Test.ScenarioTests.TransparentDataEncryptionCrudTests\TestDatabaseTransparentDataEncryptionUpdate.json">
721725
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
726+
</None>
727+
<None Include="SessionRecords\Microsoft.Azure.Commands.Sql.Test.ScenarioTests.TransparentDataEncryptionCrudTests\TestServerTransparentDataEncryptionProtectorGet.json">
728+
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
729+
</None>
730+
<None Include="SessionRecords\Microsoft.Azure.Commands.Sql.Test.ScenarioTests.TransparentDataEncryptionCrudTests\TestServerTransparentDataEncryptionProtectorSet.json">
731+
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
732+
</None>
733+
<None Include="SessionRecords\Microsoft.Azure.Commands.Sql.Test.ScenarioTests.ServerKeyVaultKeyTests\TestServerKeyVaultKeyAdd.json">
734+
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
735+
</None>
736+
<None Include="SessionRecords\Microsoft.Azure.Commands.Sql.Test.ScenarioTests.ServerKeyVaultKeyTests\TestServerKeyVaultKeyGet.json">
737+
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
738+
</None>
739+
<None Include="SessionRecords\Microsoft.Azure.Commands.Sql.Test.ScenarioTests.ServerKeyVaultKeyTests\TestServerKeyVaultKeyRemove.json">
740+
<CopyToOutputDirectory>Always</CopyToOutputDirectory>
722741
</None>
723742
<None Include="SessionRecords\Microsoft.Azure.Commands.Sql.Test.ScenarioTests.ServerUpgradeTests\TestServerUpgradeAndCancel.json">
724743
<CopyToOutputDirectory>Always</CopyToOutputDirectory>

‎src/ResourceManager/Sql/Commands.Sql.Test/ScenarioTests/Common.ps1

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -217,6 +217,47 @@ function Create-DataMaskingTestEnvironment ($testSuffix)
217217
}
218218
}
219219

220+
<#
221+
.SYNOPSIS
222+
Gets the values of the parameters used in the Server Key Vault Key tests
223+
#>
224+
function Get-SqlServerKeyVaultKeyTestEnvironmentParameters ()
225+
{
226+
return @{ rgName = Get-ResourceGroupName;
227+
serverName = Get-ServerName;
228+
databaseName = Get-DatabaseName;
229+
keyId = "https://akvtdekeyvault.vault.azure.net/keys/key1/51c2fab9ff3c4a17aab4cd51b932b106";
230+
serverKeyName = "akvtdekeyvault_key1_51c2fab9ff3c4a17aab4cd51b932b106";
231+
vaultName = "akvtdekeyvault";
232+
keyName = "key1"
233+
location = "Southeast Asia";
234+
}
235+
}
236+
237+
<#
238+
.SYNOPSIS
239+
Creates the test environment needed to perform the Server Key Vault Key tests
240+
#>
241+
function Create-ServerKeyVaultKeyTestEnvironment ($params)
242+
{
243+
# Create Resource Group
244+
$rg = New-AzureRmResourceGroup -Name $params.rgname -Location $params.location -Force
245+
246+
# Create Server
247+
$serverLogin = "testusername"
248+
$serverPassword = "t357ingP@s5w0rd!"
249+
$credentials = new-object System.Management.Automation.PSCredential($serverLogin, ($serverPassword | ConvertTo-SecureString -asPlainText -Force))
250+
$server = New-AzureRmSqlServer -ResourceGroupName $rg.ResourceGroupName -ServerName $params.serverName -Location $params.location -ServerVersion "12.0" -SqlAdministratorCredentials $credentials
251+
Assert-AreEqual $server.ServerName $params.serverName
252+
253+
# Create database
254+
$db = New-AzureRmSqlDatabase -ResourceGroupName $rg.ResourceGroupName -ServerName $server.ServerName -DatabaseName $params.databaseName
255+
Assert-AreEqual $db.DatabaseName $params.databaseName
256+
257+
# Return the created resource group
258+
return $rg
259+
}
260+
220261
<#
221262
.SYNOPSIS
222263
Gets valid resource group name

‎src/ResourceManager/Sql/Commands.Sql.Test/ScenarioTests/ServerKeyVaultKeyTests.cs

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.Azure.Commands.ScenarioTest.SqlTests;
16+
using Microsoft.Azure.ServiceManagemenet.Common.Models;
17+
using Microsoft.WindowsAzure.Commands.ScenarioTest;
18+
using Xunit;
19+
using Xunit.Abstractions;
20+
21+
namespace Microsoft.Azure.Commands.Sql.Test.ScenarioTests
22+
{
23+
public class ServerKeyVaultKeyTests : SqlTestsBase
24+
{
25+
public ServerKeyVaultKeyTests(ITestOutputHelper output)
26+
{
27+
XunitTracingInterceptor.AddToContext(new XunitTracingInterceptor(output));
28+
}
29+
30+
[Fact]
31+
[Trait(Category.AcceptanceType, Category.CheckIn)]
32+
public void TestServerKeyVaultKeyAdd()
33+
{
34+
RunPowerShellTest("Test-AddServerKeyVaultKey");
35+
}
36+
37+
[Fact]
38+
[Trait(Category.AcceptanceType, Category.CheckIn)]
39+
public void TestServerKeyVaultKeyGet()
40+
{
41+
RunPowerShellTest("Test-GetServerKeyVaultKey");
42+
}
43+
44+
[Fact]
45+
[Trait(Category.AcceptanceType, Category.CheckIn)]
46+
public void TestServerKeyVaultKeyRemove()
47+
{
48+
RunPowerShellTest("Test-RemoveServerKeyVaultKey");
49+
}
50+
}
51+
}

‎src/ResourceManager/Sql/Commands.Sql.Test/ScenarioTests/ServerKeyVaultKeyTests.ps1

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# ----------------------------------------------------------------------------------
2+
#
3+
# Copyright Microsoft Corporation
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
# ----------------------------------------------------------------------------------
14+
15+
<#
16+
.SYNOPSIS
17+
Tests creating a server key vault key
18+
#>
19+
function Test-AddServerKeyVaultKey
20+
{
21+
$params = Get-SqlServerKeyVaultKeyTestEnvironmentParameters
22+
$rg = Create-ServerKeyVaultKeyTestEnvironment $params
23+
24+
try
25+
{
26+
$keyResult = Add-AzureRmSqlServerKeyVaultKey -ServerName $params.serverName -ResourceGroupName $params.rgName -KeyId $params.keyId
27+
Assert-AreEqual $params.keyId $keyResult.Uri
28+
Assert-AreEqual $params.serverKeyName $keyResult.ServerKeyName
29+
}
30+
finally
31+
{
32+
Remove-ResourceGroupForTest $rg
33+
}
34+
}
35+
36+
<#
37+
.SYNOPSIS
38+
Tests getting a server key vault key
39+
#>
40+
function Test-GetServerKeyVaultKey
41+
{
42+
$params = Get-SqlServerKeyVaultKeyTestEnvironmentParameters
43+
$rg = Create-ServerKeyVaultKeyTestEnvironment $params
44+
45+
try
46+
{
47+
$keyResult = Add-AzureRmSqlServerKeyVaultKey -ServerName $params.serverName -ResourceGroupName $params.rgName -KeyId $params.keyId
48+
Assert-AreEqual $params.keyId $keyResult.Uri
49+
Assert-AreEqual $params.serverKeyName $keyResult.ServerKeyName
50+
51+
$keyGet = Get-AzureRmSqlServerKeyVaultKey -ServerName $params.serverName -ResourceGroupName $params.rgName -KeyId $params.keyId
52+
Assert-AreEqual $params.keyId $keyGet.Uri
53+
Assert-AreEqual $params.serverKeyName $keyGet.ServerKeyName
54+
}
55+
finally
56+
{
57+
Remove-ResourceGroupForTest $rg
58+
}
59+
}
60+
61+
<#
62+
.SYNOPSIS
63+
Tests removing a server key vault key
64+
#>
65+
function Test-RemoveServerKeyVaultKey
66+
{
67+
$params = Get-SqlServerKeyVaultKeyTestEnvironmentParameters
68+
$rg = Create-ServerKeyVaultKeyTestEnvironment $params
69+
70+
try
71+
{
72+
$keyResult = Add-AzureRmSqlServerKeyVaultKey -ServerName $params.serverName -ResourceGroupName $params.rgName -KeyId $params.keyId
73+
Assert-AreEqual $params.keyId $keyResult.Uri
74+
Assert-AreEqual $params.serverKeyName $keyResult.ServerKeyName
75+
76+
$keyGet = Get-AzureRmSqlServerKeyVaultKey -ServerName $params.serverName -ResourceGroupName $params.rgName -KeyId $params.keyId
77+
Assert-AreEqual $params.keyId $keyGet.Uri
78+
Assert-AreEqual $params.serverKeyName $keyGet.ServerKeyName
79+
80+
$keyRemove = Remove-AzureRmSqlServerKeyVaultKey -ServerName $params.serverName -ResourceGroupName $params.rgName -KeyId $params.keyId
81+
Assert-AreEqual $params.keyId $keyRemove.Uri
82+
Assert-AreEqual $params.serverKeyName $keyRemove.ServerKeyName
83+
}
84+
finally
85+
{
86+
Remove-ResourceGroupForTest $rg
87+
}
88+
}

‎src/ResourceManager/Sql/Commands.Sql.Test/ScenarioTests/TransparentDataEncryptionCrudTests.cs

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,5 +40,19 @@ public void TestDatabaseTransparentDataEncryptionGet()
4040
{
4141
RunPowerShellTest("Test-GetTransparentDataEncryption");
4242
}
43+
44+
[Fact]
45+
[Trait(Category.AcceptanceType, Category.CheckIn)]
46+
public void TestServerTransparentDataEncryptionProtectorGet()
47+
{
48+
RunPowerShellTest("Test-GetTransparentDataEncryptionProtector");
49+
}
50+
51+
[Fact]
52+
[Trait(Category.AcceptanceType, Category.CheckIn)]
53+
public void TestServerTransparentDataEncryptionProtectorSet()
54+
{
55+
RunPowerShellTest("Test-SetTransparentDataEncryptionProtector");
56+
}
4357
}
4458
}

‎src/ResourceManager/Sql/Commands.Sql.Test/ScenarioTests/TransparentDataEncryptionCrudTests.ps1

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,3 +82,70 @@ function Test-GetTransparentDataEncryption
8282
Remove-ResourceGroupForTest $rg
8383
}
8484
}
85+
86+
<#
87+
.SYNOPSIS
88+
Tests Getting a server transparent data encryption protector
89+
#>
90+
function Test-GetTransparentDataEncryptionProtector
91+
{
92+
# Setup
93+
$location = "Southeast Asia"
94+
$rgName = Get-ResourceGroupName
95+
$rg = New-AzureRmResourceGroup -Name $rgName -Location $location -Force
96+
$serverName = Get-ServerName
97+
$serverLogin = "testusername"
98+
$serverPassword = "t357ingP@s5w0rd!"
99+
$credentials = new-object System.Management.Automation.PSCredential($serverLogin, ($serverPassword | ConvertTo-SecureString -asPlainText -Force))
100+
101+
$server = New-AzureRmSqlServer -ResourceGroupName $rg.ResourceGroupName -ServerName $serverName -Location $location -ServerVersion "12.0" -SqlAdministratorCredentials $credentials
102+
103+
try
104+
{
105+
# Encryption Protector should be set to Service Managed initially
106+
$encProtector1 = Get-AzureRmSqlServerTransparentDataEncryptionProtector -ResourceGroupName $server.ResourceGroupName -ServerName $server.ServerName
107+
Assert-AreEqual ServiceManaged $encProtector1.Type
108+
Assert-AreEqual ServiceManaged $encProtector1.ServerKeyVaultKeyName
109+
}
110+
finally
111+
{
112+
Remove-ResourceGroupForTest $rg
113+
}
114+
}
115+
116+
<#
117+
.SYNOPSIS
118+
Tests Setting a server transparent data encryption protector
119+
#>
120+
function Test-SetTransparentDataEncryptionProtector
121+
{
122+
# Setup
123+
$params = Get-SqlServerKeyVaultKeyTestEnvironmentParameters
124+
$rg = Create-ServerKeyVaultKeyTestEnvironment $params
125+
126+
try
127+
{
128+
# Encryption Protector should be set to Service Managed initially
129+
$encProtector1 = Get-AzureRmSqlServerTransparentDataEncryptionProtector -ResourceGroupName $params.rgName -ServerName $params.serverName
130+
Assert-AreEqual ServiceManaged $encProtector1.Type
131+
Assert-AreEqual ServiceManaged $encProtector1.ServerKeyVaultKeyName
132+
133+
# Add server key
134+
$keyResult = Add-AzureRmSqlServerKeyVaultKey -ServerName $params.serverName -ResourceGroupName $params.rgName -KeyId $params.keyId
135+
Assert-AreEqual $params.keyId $keyResult.Uri
136+
137+
# Rotate to AKV
138+
$encProtector2 = Set-AzureRmSqlServerTransparentDataEncryptionProtector -ResourceGroupName $params.rgName -ServerName $params.serverName -Type AzureKeyVault -KeyId $params.keyId
139+
Assert-AreEqual AzureKeyVault $encProtector2.Type
140+
Assert-AreEqual $params.serverKeyName $encProtector2.ServerKeyVaultKeyName
141+
142+
# Rotate back to Service Managed
143+
$encProtector3 = Set-AzureRmSqlServerTransparentDataEncryptionProtector -ResourceGroupName $params.rgName -ServerName $params.serverName -Type ServiceManaged
144+
Assert-AreEqual ServiceManaged $encProtector3.Type
145+
Assert-AreEqual ServiceManaged $encProtector3.ServerKeyVaultKeyName
146+
}
147+
finally
148+
{
149+
Remove-ResourceGroupForTest $rg
150+
}
151+
}

0 commit comments

Comments
 (0)