Skip to content

Commit 3abe499

Browse files
19BMG0019BMG00
authored
Merge pull request #211122 from markingmyname/vivek2
[MySQL] New Data encryption article via CLI (Preview)
2 parents 742c1ef + ffdccc4 commit 3abe499

File tree

2 files changed

+248
-1
lines changed

2 files changed

+248
-1
lines changed

‎articles/mysql/TOC.yml

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -253,7 +253,11 @@
253253
- name: Troubleshoot Connection errors
254254
href: flexible-server/how-to-troubleshoot-common-connection-issues.md
255255
- name: Troubleshoot CLI errors
256-
href: flexible-server/how-to-troubleshoot-cli-errors.md
256+
href: flexible-server/how-to-troubleshoot-cli-errors.md
257+
- name: Security
258+
items:
259+
- name: Set data encryption with Azure CLI
260+
href: flexible-server/tutorial-set-data-encryption-cli-mysql-flexible-server.md
257261
- name: Samples
258262
items:
259263
- name: Azure CLI samples

‎articles/mysql/flexible-server/tutorial-set-data-encryption-cli-mysql-flexible-server.md

Lines changed: 243 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,243 @@
1+
---
2+
title: Set data encryption for Azure Database for MySQL flexible server by using the Azure CLI Preview
3+
description: Learn how to set up and manage data encryption for your Azure Database for MySQL flexible server using Azure CLI.
4+
author: vivgk
5+
ms.author: vivgk
6+
ms.reviewer: maghan
7+
ms.date: 09/14/2022
8+
ms.service: mysql
9+
ms.subservice: flexible-server
10+
ms.topic: conceptual
11+
---
12+
13+
# Tutorial: Set data encryption for Azure Database for MySQL Flexible Server with Azure CLI Preview
14+
15+
This tutorial shows you how to set up and manage data encryption for your Azure Database for MySQL - Flexible Server using Azure CLI preview.
16+
17+
In this tutorial you'll learn how to:
18+
19+
- Create a MySQL flexible server with data encryption
20+
- Update an existing MySQL flexible server with data encryption
21+
- Using an Azure Resource Manager template to enable data encryption
22+
23+
## Prerequisites
24+
25+
- An Azure account with an active subscription.
26+
27+
- If you don't have an Azure subscription, create an [Azure free account](https://azure.microsoft.com/free)before you begin. With an Azure free account, you can now try Azure Database for MySQL - Flexible Server for free for 12 months. For more information, see [Try Flexible Server for free](how-to-deploy-on-azure-free-account.md).
28+
29+
- Install or upgrade Azure CLI to the latest version. See [Install Azure CLI](/cli/azure/install-azure-cli).
30+
31+
- Login to Azure account using [az login](/cli/azure/reference-index#az-login) command. Note the ID property, which refers to Subscription ID for your Azure account:
32+
33+
```azurecli-interactive
34+
az login
35+
```
36+
37+
- If you have multiple subscriptions, choose the appropriate subscription in which you want to create the server using the az account set command:
38+
39+
```azurecli-interactive
40+
az account set --subscription \<subscription id\>
41+
```
42+
43+
- In Azure Key Vault, create a key vault and a key. The key vault must have the following properties to use as a customer-managed key:
44+
45+
[Soft delete](../../key-vault/general/soft-delete-overview.md):
46+
47+
```azurecli-interactive
48+
az resource update --id $(az keyvault show --name \ \<key\_vault\_name\> -o tsv | awk '{print $1}') --set \ properties.enableSoftDelete=true
49+
```
50+
51+
[Purge protected](../../key-vault/general/soft-delete-overview.md#purge-protection):
52+
53+
```azurecli-interactive
54+
az keyvault update --name \<key\_vault\_name\> --resource-group \<resource\_group\_name\> --enable-purge-protection true
55+
```
56+
57+
Retention days set to 90 days:
58+
59+
```azurecli-interactive
60+
az keyvault update --name \<key\_vault\_name\> --resource-group \<resource\_group\_name\> --retention-days 90
61+
```
62+
63+
The key must have the following attributes to use as a customer-managed key:
64+
65+
- No expiration dates
66+
- Not disabled
67+
- Perform **List** , **Get** , **Wrap** , **Unwrap** operations
68+
- **recoverylevel** attribute set to Recoverable (this requires soft-delete enabled with retention period set to 90 days)
69+
- **Purge protection** enabled
70+
71+
You can verify the above attributes of the key by using the following command:
72+
73+
```azurecli-interactive
74+
az keyvault key show --vault-name \<key\_vault\_name\> -n \<key\_name\>
75+
```
76+
77+
## Update an existing MySQL flexible server with data encryption
78+
79+
Set or change key and identity for data encryption:
80+
81+
```azurecli-interactive
82+
az mysql flexible-server update --resource-group testGroup --name testserver \\ --key \<key identifier of newKey\> --identity newIdentity
83+
```
84+
85+
Set or change key, identity, backup key and backup identity for data encryption with geo redundant backup:
86+
87+
```azurecli-interactive
88+
az mysql flexible-server update --resource-group testGroup --name testserver \\ --key \<key identifier of newKey\> --identity newIdentity \\ --backup-key \<key identifier of newBackupKey\> --backup-identity newBackupIdentity
89+
```
90+
91+
Disable data encryption for flexible server:
92+
93+
```azurecli-interactive
94+
az mysql flexible-server update --resource-group testGroup --name testserver --disable-data-encryption
95+
```
96+
97+
## Use an Azure Resource Manager template to enable data encryption
98+
99+
The params **identityUri** and **primaryKeyUri** are the resource ID of the user managed identity and the user managed key, respectively.
100+
101+
```json
102+
"$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#",
103+
"contentVersion": "1.0.0.0",
104+
"parameters": {
105+
"administratorLogin": {
106+
"type": "string"
107+
},
108+
"administratorLoginPassword": {
109+
"type": "securestring"
110+
},
111+
"location": {
112+
"type": "string"
113+
},
114+
"serverName": {
115+
"type": "string"
116+
},
117+
"serverEdition": {
118+
"type": "string"
119+
},
120+
"vCores": {
121+
"type": "int",
122+
"defaultValue": 4
123+
},
124+
"storageSizeGB": {
125+
"type": "int"
126+
},
127+
"haEnabled": {
128+
"type": "string",
129+
"defaultValue": "Disabled"
130+
},
131+
"availabilityZone": {
132+
"type": "string"
133+
},
134+
"standbyAvailabilityZone": {
135+
"type": "string"
136+
},
137+
"version": {
138+
"type": "string"
139+
},
140+
"tags": {
141+
"type": "object",
142+
"defaultValue": {}
143+
},
144+
"backupRetentionDays": {
145+
"type": "int"
146+
},
147+
"geoRedundantBackup": {
148+
"type": "string"
149+
},
150+
"vmName": {
151+
"type": "string",
152+
"defaultValue": "Standard_B1ms"
153+
},
154+
"storageIops": {
155+
"type": "int"
156+
},
157+
"storageAutogrow": {
158+
"type": "string",
159+
"defaultValue": "Enabled"
160+
},
161+
"autoIoScaling": {
162+
"type": "string",
163+
"defaultValue": "Disabled"
164+
},
165+
"vnetData": {
166+
"type": "object",
167+
"metadata": {
168+
"description": "Vnet data is an object which contains all parameters pertaining to vnet and subnet"
169+
},
170+
"defaultValue": {
171+
"virtualNetworkName": "testVnet",
172+
"subnetName": "testSubnet",
173+
"virtualNetworkAddressPrefix": "10.0.0.0/16",
174+
"virtualNetworkResourceGroupName": "[resourceGroup().name]",
175+
"location": "eastus2",
176+
"subscriptionId": "[subscription().subscriptionId]",
177+
"subnetProperties": {},
178+
"isNewVnet": false,
179+
"subnetNeedsUpdate": false,
180+
"Network": {}
181+
}
182+
},
183+
"identityUri": {
184+
"type": "string",
185+
"metadata": {
186+
"description": "The resource ID of the identity used for data encryption"
187+
}
188+
},
189+
"primaryKeyUri": {
190+
"type": "string",
191+
"metadata": {
192+
"description": "The resource ID of the key used for data encryption"
193+
}
194+
}
195+
},
196+
"variables": {
197+
"api": "2021-05-01",
198+
"identityData": "[if(empty(parameters('identityUri')), json('null'), createObject('type', 'UserAssigned', 'UserAssignedIdentities', createObject(parameters('identityUri'), createObject())))]",
199+
"dataEncryptionData": "[if(or(empty(parameters('identityUri')), empty(parameters('primaryKeyUri'))), json('null'), createObject('type', 'AzureKeyVault', 'primaryUserAssignedIdentityId', parameters('identityUri'), 'primaryKeyUri', parameters('primaryKeyUri')))]"
200+
},
201+
"resources": [
202+
{
203+
"apiVersion": "[variables('api')]",
204+
"location": "[parameters('location')]",
205+
"name": "[parameters('serverName')]",
206+
"identity": "[variables('identityData')]",
207+
"properties": {
208+
"version": "[parameters('version')]",
209+
"administratorLogin": "[parameters('administratorLogin')]",
210+
"administratorLoginPassword": "[parameters('administratorLoginPassword')]",
211+
"Network": "[if(empty(parameters('vnetData').Network), json('null'), parameters('vnetData').Network)]",
212+
"Storage": {
213+
"StorageSizeGB": "[parameters('storageSizeGB')]",
214+
"Iops": "[parameters('storageIops')]",
215+
"Autogrow": "[parameters('storageAutogrow')]",
216+
"AutoIoScaling": "[parameters('autoIoScaling')]"
217+
},
218+
"Backup": {
219+
"backupRetentionDays": "[parameters('backupRetentionDays')]",
220+
"geoRedundantBackup": "[parameters('geoRedundantBackup')]"
221+
},
222+
"availabilityZone": "[parameters('availabilityZone')]",
223+
"highAvailability": {
224+
"mode": "[parameters('haEnabled')]",
225+
"standbyAvailabilityZone": "[parameters('standbyAvailabilityZone')]"
226+
},
227+
"dataEncryption": "[variables('dataEncryptionData')]"
228+
},
229+
"sku": {
230+
"name": "[parameters('vmName')]",
231+
"tier": "[parameters('serverEdition')]",
232+
"capacity": "[parameters('vCores')]"
233+
},
234+
"tags": "[parameters('tags')]",
235+
"type": "Microsoft.DBforMySQL/flexibleServers"
236+
}
237+
]
238+
}
239+
```
240+
241+
## Next steps
242+
243+
- [Data encryption with customer managed keys – Azure Database for MySQL – Flexible Server Preview](concepts-customer-managed-key-mysql-flexible-server.md)

0 commit comments

Comments
 (0)