|
| 1 | +--- |
| 2 | +title: Data encryption - Azure CLI - Azure Database for MySQL |
| 3 | +description: Learn how to set up and manage data encryption for your Azure Database for MySQL by using the Azure CLI. |
| 4 | +author: kummanish |
| 5 | +ms.author: manishku |
| 6 | +ms.service: mysql |
| 7 | +ms.topic: conceptual |
| 8 | +ms.date: 03/30/2020 |
| 9 | +--- |
| 10 | + |
| 11 | +# Data encryption for Azure Database for MySQL by using the Azure CLI |
| 12 | + |
| 13 | +Learn how to use the Azure CLI to set up and manage data encryption for your Azure Database for MySQL. |
| 14 | + |
| 15 | +## Prerequisites for Azure CLI |
| 16 | + |
| 17 | +* You must have an Azure subscription and be an administrator on that subscription. |
| 18 | +* In Azure Key Vault, create a key vault and a key to use for a customer-managed key. Also enable purge protection and soft delete enabled on the key vault. |
| 19 | + |
| 20 | + ```azurecli-interactive |
| 21 | + az keyvault create -g <resource_group> -n <vault_name> --enable-soft-delete true --enable-purge-protection true |
| 22 | + ``` |
| 23 | +
|
| 24 | +* In the created Azure Key Vault, create the key that will be used for the data encryption of the Azure Database for MySQL. |
| 25 | +
|
| 26 | + ```azurecli-interactive |
| 27 | + az keyvault key create --name <key_name> -p software --vault-name <vault_name> |
| 28 | + ``` |
| 29 | +
|
| 30 | +* In order to use an existing key vault, it must have the following properties to use as a customer-managed key: |
| 31 | + * [Soft delete](../key-vault/key-vault-ovw-soft-delete.md) |
| 32 | +
|
| 33 | + ```azurecli-interactive |
| 34 | + az resource update --id $(az keyvault show --name \ <key_vault_name> -o tsv | awk '{print $1}') --set \ properties.enableSoftDelete=true |
| 35 | + ``` |
| 36 | +
|
| 37 | + * [Purge protected](../key-vault/key-vault-ovw-soft-delete.md#purge-protection) |
| 38 | +
|
| 39 | + ```azurecli-interactive |
| 40 | + az keyvault update --name <key_vault_name> --resource-group <resource_group_name> --enable-purge-protection true |
| 41 | + ``` |
| 42 | +
|
| 43 | +* The key must have the following attributes to use as a customer-managed key: |
| 44 | + * No expiration date |
| 45 | + * Not disabled |
| 46 | + * Able to perform get, wrap key, unwrap key operations |
| 47 | +
|
| 48 | +## Set the right permissions for key operations |
| 49 | +
|
| 50 | +1. There are two ways of getting the managed identity for your Azure Database for MySQL. |
| 51 | +
|
| 52 | + ### Create an Azure Database for MySQL server with a managed identity. |
| 53 | +
|
| 54 | + ```azurecli-interactive |
| 55 | + az mysql server create --name -g <resource_group> --location <locations> --storage-size <size> -u <user>-p <pwd> --backup-retention <7> --sku-name <sku name> --geo-redundant-backup <Enabled/Disabled> --assign-identity |
| 56 | + ``` |
| 57 | +
|
| 58 | + ### Update the Azure Database for MySQL server to get a managed identity. |
| 59 | +
|
| 60 | + ```azurecli-interactive |
| 61 | + az mysql server update --name <server name> -g <resource_group> --assign-identity |
| 62 | + ``` |
| 63 | +
|
| 64 | +2. Set the **Key permissions** (**Get**, **Wrap**, **Unwrap**) for the **Principal**, which is the name of the MySQL server. |
| 65 | +
|
| 66 | + ```azurecli-interactive |
| 67 | + az keyvault set-policy --name -g <resource_group> --key-permissions get unwrapKey wrapKey --object-id <principal id of the server> |
| 68 | + ``` |
| 69 | +
|
| 70 | +## Set data encryption for Azure Database for MySQL |
| 71 | +
|
| 72 | +1. Enabling Data encryption for the Azure Database for MySQL using the key created in the Azure Key Vault and the Key created. |
| 73 | +
|
| 74 | + ```azurecli-interactive |
| 75 | + az mysql server key create –name <server name> -g <resource_group> --kid <key url> |
| 76 | + ``` |
| 77 | +
|
| 78 | + Key url : https://YourVaultName.vault.azure.net/keys/YourKeyName/01234567890123456789012345678901> |
| 79 | +
|
| 80 | +## Restore or create a replica of the server |
| 81 | +
|
| 82 | +After Azure Database for MySQL is encrypted with a customer's managed key stored in Key Vault, any newly created copy of the server is also encrypted. You can make this new copy either through a local or geo-restore operation, or through a replica (local/cross-region) operation. So for an encrypted MySQL server, you can use the following steps to create an encrypted restored server. |
| 83 | +
|
| 84 | +### Creating a restored/replica server |
| 85 | +
|
| 86 | + * [Create a restore server](howto-restore-server-cli.md) |
| 87 | + * [Create a replica server](howto-read-replica-cli.md) |
| 88 | +
|
| 89 | +### Once the server is restored re-validate data encryption the restored server |
| 90 | +
|
| 91 | + ```azurecli-interactive |
| 92 | + az mysql server key create –name <server name> -g <resource_group> --kid <key url> |
| 93 | + ``` |
| 94 | +
|
| 95 | +## Additional capability for the key being used for the Azure Database for MySQL |
| 96 | +
|
| 97 | +### Get the Key used |
| 98 | +
|
| 99 | + ```azurecli-interactive |
| 100 | + az mysql server key show --name <server name> -g <resource_group> --kid <key url> |
| 101 | + ``` |
| 102 | +
|
| 103 | + Key url : https://YourVaultName.vault.azure.net/keys/YourKeyName/01234567890123456789012345678901> |
| 104 | +
|
| 105 | +### List the Key used |
| 106 | +
|
| 107 | + ```azurecli-interactive |
| 108 | + az mysql server key list --name <server name> -g <resource_group> |
| 109 | + ``` |
| 110 | +
|
| 111 | +### Drop the key being used |
| 112 | +
|
| 113 | + ```azurecli-interactive |
| 114 | + az mysql server key delete -g <resource_group> --kid <key url> |
| 115 | + ``` |
| 116 | +
|
| 117 | +## Using an Azure Resource Manager template to enable data encryption |
| 118 | +
|
| 119 | +Apart from the Azure portal, you can also enable data encryption on your Azure Database for MySQL server using Azure Resource Manager templates for new and existing servers. |
| 120 | +
|
| 121 | +### For a new server |
| 122 | +
|
| 123 | +Use one of the pre-created Azure Resource Manager templates to provision the server with data encryption enabled: |
| 124 | +[Example with Data encryption](https://github.com/Azure/azure-mysql/tree/master/arm-templates/ExampleWithDataEncryption) |
| 125 | +
|
| 126 | +This Azure Resource Manager template creates a Azure Database for MySQL server and uses the **KeyVault** and **Key** passed as parameters to enable data encryption on the server. |
| 127 | +
|
| 128 | +### For an existing server |
| 129 | +Additionally, you can use Azure Resource Manager templates to enable data encryption on your existing Azure Database for MySQL servers. |
| 130 | +
|
| 131 | +* Pass the URI of the Azure Key Vault key that you copied earlier under the `keyVaultKeyUri` property in the properties object. |
| 132 | +
|
| 133 | +* Use *2020-01-01-preview* as the API version. |
| 134 | +
|
| 135 | +```json |
| 136 | +{ |
| 137 | + "$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#", |
| 138 | + "contentVersion": "1.0.0.0", |
| 139 | + "parameters": { |
| 140 | + "location": { |
| 141 | + "type": "string" |
| 142 | + }, |
| 143 | + "serverName": { |
| 144 | + "type": "string" |
| 145 | + }, |
| 146 | + "keyVaultName": { |
| 147 | + "type": "string", |
| 148 | + "metadata": { |
| 149 | + "description": "Key vault name where the key to use is stored" |
| 150 | + } |
| 151 | + }, |
| 152 | + "keyVaultResourceGroupName": { |
| 153 | + "type": "string", |
| 154 | + "metadata": { |
| 155 | + "description": "Key vault resource group name where it is stored" |
| 156 | + } |
| 157 | + }, |
| 158 | + "keyName": { |
| 159 | + "type": "string", |
| 160 | + "metadata": { |
| 161 | + "description": "Key name in the key vault to use as encryption protector" |
| 162 | + } |
| 163 | + }, |
| 164 | + "keyVersion": { |
| 165 | + "type": "string", |
| 166 | + "metadata": { |
| 167 | + "description": "Version of the key in the key vault to use as encryption protector" |
| 168 | + } |
| 169 | + } |
| 170 | + }, |
| 171 | + "variables": { |
| 172 | + "serverKeyName": "[concat(parameters('keyVaultName'), '_', parameters('keyName'), '_', parameters('keyVersion'))]" |
| 173 | + }, |
| 174 | + "resources": [ |
| 175 | + { |
| 176 | + "type": "Microsoft.DBforMySQL/servers", |
| 177 | + "apiVersion": "2017-12-01", |
| 178 | + "kind": "", |
| 179 | + "location": "[parameters('location')]", |
| 180 | + "identity": { |
| 181 | + "type": "SystemAssigned" |
| 182 | + }, |
| 183 | + "name": "[parameters('serverName')]", |
| 184 | + "properties": { |
| 185 | + } |
| 186 | + }, |
| 187 | + { |
| 188 | + "type": "Microsoft.Resources/deployments", |
| 189 | + "apiVersion": "2019-05-01", |
| 190 | + "name": "addAccessPolicy", |
| 191 | + "resourceGroup": "[parameters('keyVaultResourceGroupName')]", |
| 192 | + "dependsOn": [ |
| 193 | + "[resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))]" |
| 194 | + ], |
| 195 | + "properties": { |
| 196 | + "mode": "Incremental", |
| 197 | + "template": { |
| 198 | + "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#", |
| 199 | + "contentVersion": "1.0.0.0", |
| 200 | + "resources": [ |
| 201 | + { |
| 202 | + "type": "Microsoft.KeyVault/vaults/accessPolicies", |
| 203 | + "name": "[concat(parameters('keyVaultName'), '/add')]", |
| 204 | + "apiVersion": "2018-02-14-preview", |
| 205 | + "properties": { |
| 206 | + "accessPolicies": [ |
| 207 | + { |
| 208 | + "tenantId": "[subscription().tenantId]", |
| 209 | + "objectId": "[reference(resourceId('Microsoft.DBforMySQL/servers/', parameters('serverName')), '2017-12-01', 'Full').identity.principalId]", |
| 210 | + "permissions": { |
| 211 | + "keys": [ |
| 212 | + "get", |
| 213 | + "wrapKey", |
| 214 | + "unwrapKey" |
| 215 | + ] |
| 216 | + } |
| 217 | + } |
| 218 | + ] |
| 219 | + } |
| 220 | + } |
| 221 | + ] |
| 222 | + } |
| 223 | + } |
| 224 | + }, |
| 225 | + { |
| 226 | + "name": "[concat(parameters('serverName'), '/', variables('serverKeyName'))]", |
| 227 | + "type": "Microsoft.DBforMySQL/servers/keys", |
| 228 | + "apiVersion": "2020-01-01-preview", |
| 229 | + "dependsOn": [ |
| 230 | + "addAccessPolicy", |
| 231 | + "[resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))]" |
| 232 | + ], |
| 233 | + "properties": { |
| 234 | + "serverKeyType": "AzureKeyVault", |
| 235 | + "uri": "[concat(reference(resourceId(parameters('keyVaultResourceGroupName'), 'Microsoft.KeyVault/vaults/', parameters('keyVaultName')), '2018-02-14-preview', 'Full').properties.vaultUri, 'keys/', parameters('keyName'), '/', parameters('keyVersion'))]" |
| 236 | + } |
| 237 | + } |
| 238 | + ] |
| 239 | +} |
| 240 | +
|
| 241 | +``` |
| 242 | + |
| 243 | +## Next steps |
| 244 | + |
| 245 | + To learn more about data encryption, see [Azure Database for MySQL data encryption with customer-managed key](concepts-data-encryption-mysql.md). |
0 commit comments