Skip to content

[SQL] Support versionless key in server key, server encryption protector and database create/update #28666

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
+22 −13
Open

[SQL] Support versionless key in server key, server encryption protector and database create/update #28666

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 15 additions & 6 deletions src/Sql/Sql/Common/TdeKeyHelper.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,9 @@ class TdeKeyHelper
/// <summary>
/// Creates the SQL Server Key Name from an Azure Key Vault KeyId
/// Throws an exception if the provided KeyId is malformed.
/// An example of a well formed Azure Key Vault KeyId is: https://YourVaultName.vault.azure.net/keys/YourKeyName/01234567890123456789012345678901
/// Examples of well formed Azure Key Vault KeyIds are:
/// https://YourVaultName.vault.azure.net/keys/YourKeyName/01234567890123456789012345678901 (versioned)
/// https://YourVaultName.vault.azure.net/keys/YourKeyName (versionless)
/// </summary>
/// <param name="keyId">The full Azure Key Vault KeyId</param>
/// <returns>The Server Key Name for the provided KeyId</returns>
Expand All @@ -41,8 +43,8 @@ public static string CreateServerKeyNameFromKeyId(string keyId)
return ServerKeyType.ServiceManaged.ToString();
}

// Validate that the url is a keyvault url and has a key and version
Regex r = new Regex(@"https://(.)+\.(managedhsm.azure.net|managedhsm-preview.azure.net|vault.azure.net|vault-int.azure-int.net|vault.azure.cn|managedhsm.azure.cn|vault.usgovcloudapi.net|managedhsm.usgovcloudapi.net|vault.microsoftazure.de|managedhsm.microsoftazure.de|vault.cloudapi.eaglex.ic.gov|vault.cloudapi.microsoft.scloud)(:443)?\/keys/[^\/]+\/[0-9a-zA-Z]+$", RegexOptions.IgnoreCase);
// Validate that the url is a keyvault url and has a key with an optional version
Regex r = new Regex(@"^https://(.)+\.(managedhsm\.azure\.net|managedhsm-preview\.azure\.net|vault\.azure\.net|vault-int\.azure-int\.net|vault\.azure\.cn|managedhsm\.azure\.cn|vault\.usgovcloudapi\.net|managedhsm\.usgovcloudapi\.net|vault\.microsoftazure\.de|managedhsm\.microsoftazure\.de|vault\.cloudapi\.eaglex\.ic\.gov|vault\.cloudapi\.microsoft\.scloud|mdep\.azure\.net)(:443)?/keys/[^/]+(/([0-9a-zA-Z]+))?/?$", RegexOptions.IgnoreCase);
if (!r.IsMatch(keyId))
{
// Throw an error here, since we don't want to use a non keyvault url
Expand All @@ -53,10 +55,17 @@ public static string CreateServerKeyNameFromKeyId(string keyId)
var uri = new Uri(keyId);

string vault = uri.Host.Split('.').First();
string key = uri.Segments[2].TrimEnd('/');
string version = uri.Segments.Last();
string[] pathSegments = uri.AbsolutePath.Trim('/').Split(new[] { '/' }, StringSplitOptions.RemoveEmptyEntries);
Copy link

Copilot AI Oct 10, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Potential IndexOutOfRangeException if pathSegments has fewer than 2 elements. The code assumes pathSegments[1] exists without validation, but if the URI path structure is unexpected, this will throw an exception.

Suggested change
string[] pathSegments = uri.AbsolutePath.Trim('/').Split(new[] { '/' }, StringSplitOptions.RemoveEmptyEntries);
string[] pathSegments = uri.AbsolutePath.Trim('/').Split(new[] { '/' }, StringSplitOptions.RemoveEmptyEntries);
if (pathSegments.Length < 2)
{
throw new ArgumentException(message:String.Format(Properties.Resources.InvalidKeyId, keyId), paramName:"KeyId");
}

Copilot uses AI. Check for mistakes.

string key = pathSegments[1];
bool hasVersion = pathSegments.Length >= 3 && !string.IsNullOrEmpty(pathSegments[2]);

return String.Format("{0}_{1}_{2}", vault, key, version);
if (hasVersion)
{
string version = pathSegments[2];
return String.Format("{0}_{1}_{2}", vault, key, version);
}

return String.Format("{0}_{1}", vault, key);
}
}
}
2 changes: 1 addition & 1 deletion src/Sql/Sql/Properties/Resources.Designer.cs
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions src/Sql/Sql/Properties/Resources.resx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -454,7 +454,7 @@
<value>KeyId parameter is required for encryption protector type AzureKeyVault</value>
</data>
<data name="InvalidKeyId" xml:space="preserve">
<value>Invalid parameter format for keyId: '{0}'. It should be a well formed Azure Key Vault KeyId like: https://YourVaultName.vault.azure.net/keys/YourKeyName/01234567890123456789012345678901</value>
<value>Invalid parameter format for keyId: '{0}'. It should be a well formed Azure Key Vault KeyId such as https://YourVaultName.vault.azure.net/keys/YourKeyName/01234567890123456789012345678901 (versioned) or https://YourVaultName.vault.azure.net/keys/YourKeyName (versionless).</value>
</data>
<data name="SetAzureSqlInstanceDescription" xml:space="preserve">
<value>Setting Azure Sql Database Managed Instance '{0}'.</value>
Expand Down Expand Up @@ -778,4 +778,4 @@
<data name="InvalidSoftDeleteRetentionDaysRange" xml:space="preserve">
<value>SoftDeleteRetentionDays must be between 1 and 35 when EnableSoftDelete is true.</value>
</data>
</root>
</root>
2 changes: 1 addition & 1 deletion src/Sql/Sql/help/Add-AzSqlServerKeyVaultKey.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,7 +38,7 @@ Thumbprint : 1122334455667788990011223344556677889900
CreationDate : 1/1/2017 12:00:00 AM
```

This command adds the Key Vault key with Id 'https://contoso.vault.azure.net/keys/contosokey/01234567890123456789012345678901' to the SQL server named 'ContosoServer' in the resource group 'ContosoResourceGroup'.
This command adds the Key Vault key with Id 'https://contoso.vault.azure.net/keys/contosokey/01234567890123456789012345678901' to the SQL server named 'ContosoServer' in the resource group 'ContosoResourceGroup'. Versionless key IDs, for example 'https://contoso.vault.azure.net/keys/contosokey', are also supported.

## PARAMETERS

Expand Down
2 changes: 1 addition & 1 deletion src/Sql/Sql/help/Get-AzSqlServerKeyVaultKey.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ $MyServerKeyVaultKey = Get-AzSqlServerKeyVaultKey -KeyId 'https://contoso.vault.
```

This command gets the Key Vault key with Id 'https://contoso.vault.azure.net/keys/contosokey/01234567890123456789012345678901', and then stores it in the $MyServerKeyVaultKey variable.
You can inspect the properties of $MyServerKeyVaultKey to get details about the key vault.
You can inspect the properties of $MyServerKeyVaultKey to get details about the key vault. Versionless key IDs, for example 'https://contoso.vault.azure.net/keys/contosokey', are also supported.

## PARAMETERS

Expand Down
4 changes: 2 additions & 2 deletions src/Sql/Sql/help/Set-AzSqlServerTransparentDataEncryptionProtector.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -48,7 +48,7 @@ ResourceGroupName ServerName Type ServerKeyVaultKeyName
ContosoResourceGroup ContosoServer AzureKeyVault contoso_contosokey_01234567890123456789012345678901
```

This command updates a server to use the Server Key Vault Key with Id 'https://contoso.vault.azure.net/keys/contosokey/01234567890123456789012345678901' as the TDE protector.
This command updates a server to use the Server Key Vault Key with Id 'https://contoso.vault.azure.net/keys/contosokey/01234567890123456789012345678901' as the TDE protector. You can also specify a versionless key, for example 'https://contoso.vault.azure.net/keys/contosokey'.

### Example 3

Expand Down Expand Up @@ -123,7 +123,7 @@ Accept wildcard characters: False
```

### -KeyId
The Azure Key Vault KeyId.
The Azure Key Vault KeyId. Supports versioned and versionless key IDs.

```yaml
Type: System.String
Expand Down