Skip to content

Commit 54b9ef5

Browse files
markingmynamemarkingmyname
committed
[MySQL] New Set data encryption for Azure Database for MySQL Flexible Server with Azure CLI article
1 parent b5a7bd5 commit 54b9ef5

File tree

2 files changed

+225
-0
lines changed

2 files changed

+225
-0
lines changed

‎articles/mysql/flexible-server/media/tutorial-set-data-encryption-cli-mysql-flexible-server/az-login.png

8.51 KB
Loading

‎articles/mysql/flexible-server/tutorial-set-data-encryption-cli-mysql-flexible-server.md

Lines changed: 225 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,225 @@
1+
---
2+
title: Set data encryption for Azure Database for MySQL flexible server by using the Azure CLI Preview
3+
description: Learn how to set up and manage data encryption for your Azure Database for MySQL flexible server using Azure CLI.
4+
author: vivgk
5+
ms.author: vivgk
6+
ms.reviewer: maghan
7+
ms.date: 09/19/2022
8+
ms.service: mysql
9+
ms.subservice: flexible-server
10+
ms.topic: conceptual
11+
---
12+
13+
# Tutorial: Set data encryption for Azure Database for MySQL Flexible Server with Azure CLI
14+
15+
This tutorial shows you how to set up and manage data encryption for your Azure Database for MySQL flexible server using Azure CLI.
16+
17+
In this tutorial you'll learn how to:
18+
19+
- Create a MySQL flexible server with data encryption
20+
- Update an existing MySQL flexible server with data encryption
21+
- Using an Azure Resource Manager template to enable data encryption
22+
23+
## Prerequisites
24+
25+
- An Azure account with an active subscription.
26+
27+
- If you don't have an Azure subscription, create an[Azure free account](https://azure.microsoft.com/free)before you begin. With an Azure free account, you can now try Azure Database for MySQL - Flexible Server for free for 12 months. For more information, see [Try Flexible Server for free](https://docs.microsoft.com/en-us/azure/mysql/flexible-server/how-to-deploy-on-azure-free-account).
28+
29+
- Install or upgrade Azure CLI to the latest version. See [Install Azure CLI](https://docs.microsoft.com/en-us/cli/azure/install-azure-cli).
30+
31+
- Login to Azure account using [az login](https://docs.microsoft.com/en-us/cli/azure/reference-index#az-login)command. Note the id property, which refers to Subscription ID for your Azure account.
32+
az login
33+
34+
_(For reference: Need to include the copy option and try it button as below:)_
35+
36+
:::image type="content" source="media/tutorial-set-data-encryption-CLI-mysql-flexible-server/az-login.png" alt-text="Screenshot of az login.":::
37+
38+
- If you have multiple subscriptions, choose the appropriate subscription in which you want to create the server using the az account set command.
39+
40+
`az account set --subscription \<subscription id\>`
41+
42+
- In Azure Key Vault, create a key vault and a key. The key vault must have the following properties to use as a customer-managed key:
43+
44+
Soft delete
45+
46+
`az resource update --id $(az keyvault show --name \ \<key\_vault\_name\> -o tsv | awk '{print $1}') --set \ properties.enableSoftDelete=true`
47+
48+
[Purge protected](#purge-protection%22)
49+
50+
`az keyvault update --name \<key\_vault\_name\> --resource-group \<resource\_group\_name\> --enable-purge-protection true`
51+
52+
Retention days set to 90 days
53+
54+
`az keyvault update --name \<key\_vault\_name\> --resource-group \<resource\_group\_name\> --retention-days 90`
55+
56+
The key must have the following attributes to use as a customer-managed key:
57+
58+
- No expiration dates
59+
- Not disabled
60+
- Perform **List** , **Get** , **Wrap** , **Unwrap** operations
61+
- **recoverylevel** attribute set to Recoverable (this requires soft-delete enabled with retention period set to 90 days)
62+
- **Purge protection** enabled
63+
64+
You can verify the above attributes of the key by using the following command:
65+
66+
`az keyvault key show --vault-name \<key\_vault\_name\> -n \<key\_name\>`
67+
68+
**Update an existing MySQL flexible server with data encryption**
69+
70+
Set or change key and identity for data encryption
71+
72+
`az mysql flexible-server update --resource-group testGroup --name testserver \\ --key \<key identifier of newKey\> --identity newIdentity`
73+
74+
Set or change key, identity, backup key and backup identity for data encryption with geo redundant backup
75+
76+
`az mysql flexible-server update --resource-group testGroup --name testserver \\ --key \<key identifier of newKey\> --identity newIdentity \\ --backup-key \<key identifier of newBackupKey\> --backup-identity newBackupIdentity`
77+
78+
Disable data encryption for flexible server
79+
80+
`az mysql flexible-server update --resource-group testGroup --name testserver --disable-data-encryption`
81+
82+
## Use an Azure Resource Manager template to enable data encryption
83+
84+
- The params **identityUri** and **primaryKeyUri** are the resource ID of the user managed identity and the user managed key, respectively.
85+
- Use _2021-05-01_ as the API version.
86+
87+
```json
88+
"$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#",
89+
"contentVersion": "1.0.0.0",
90+
"parameters": {
91+
"administratorLogin": {
92+
"type": "string"
93+
},
94+
"administratorLoginPassword": {
95+
"type": "securestring"
96+
},
97+
"location": {
98+
"type": "string"
99+
},
100+
"serverName": {
101+
"type": "string"
102+
},
103+
"serverEdition": {
104+
"type": "string"
105+
},
106+
"vCores": {
107+
"type": "int",
108+
"defaultValue": 4
109+
},
110+
"storageSizeGB": {
111+
"type": "int"
112+
},
113+
"haEnabled": {
114+
"type": "string",
115+
"defaultValue": "Disabled"
116+
},
117+
"availabilityZone": {
118+
"type": "string"
119+
},
120+
"standbyAvailabilityZone": {
121+
"type": "string"
122+
},
123+
"version": {
124+
"type": "string"
125+
},
126+
"tags": {
127+
"type": "object",
128+
"defaultValue": {}
129+
},
130+
"backupRetentionDays": {
131+
"type": "int"
132+
},
133+
"geoRedundantBackup": {
134+
"type": "string"
135+
},
136+
"vmName": {
137+
"type": "string",
138+
"defaultValue": "Standard_B1ms"
139+
},
140+
"storageIops": {
141+
"type": "int"
142+
},
143+
"storageAutogrow": {
144+
"type": "string",
145+
"defaultValue": "Enabled"
146+
},
147+
"autoIoScaling": {
148+
"type": "string",
149+
"defaultValue": "Disabled"
150+
},
151+
"vnetData": {
152+
"type": "object",
153+
"metadata": {
154+
"description": "Vnet data is an object which contains all parameters pertaining to vnet and subnet"
155+
},
156+
"defaultValue": {
157+
"virtualNetworkName": "testVnet",
158+
"subnetName": "testSubnet",
159+
"virtualNetworkAddressPrefix": "10.0.0.0/16",
160+
"virtualNetworkResourceGroupName": "[resourceGroup().name]",
161+
"location": "eastus2",
162+
"subscriptionId": "[subscription().subscriptionId]",
163+
"subnetProperties": {},
164+
"isNewVnet": false,
165+
"subnetNeedsUpdate": false,
166+
"Network": {}
167+
}
168+
},
169+
"identityUri": {
170+
"type": "string",
171+
"metadata": {
172+
"description": "The resource ID of the identity used for data encryption"
173+
}
174+
},
175+
"primaryKeyUri": {
176+
"type": "string",
177+
"metadata": {
178+
"description": "The resource ID of the key used for data encryption"
179+
}
180+
}
181+
},
182+
"variables": {
183+
"api": "2021-05-01",
184+
"identityData": "[if(empty(parameters('identityUri')), json('null'), createObject('type', 'UserAssigned', 'UserAssignedIdentities', createObject(parameters('identityUri'), createObject())))]",
185+
"dataEncryptionData": "[if(or(empty(parameters('identityUri')), empty(parameters('primaryKeyUri'))), json('null'), createObject('type', 'AzureKeyVault', 'primaryUserAssignedIdentityId', parameters('identityUri'), 'primaryKeyUri', parameters('primaryKeyUri')))]"
186+
},
187+
"resources": [
188+
{
189+
"apiVersion": "[variables('api')]",
190+
"location": "[parameters('location')]",
191+
"name": "[parameters('serverName')]",
192+
"identity": "[variables('identityData')]",
193+
"properties": {
194+
"version": "[parameters('version')]",
195+
"administratorLogin": "[parameters('administratorLogin')]",
196+
"administratorLoginPassword": "[parameters('administratorLoginPassword')]",
197+
"Network": "[if(empty(parameters('vnetData').Network), json('null'), parameters('vnetData').Network)]",
198+
"Storage": {
199+
"StorageSizeGB": "[parameters('storageSizeGB')]",
200+
"Iops": "[parameters('storageIops')]",
201+
"Autogrow": "[parameters('storageAutogrow')]",
202+
"AutoIoScaling": "[parameters('autoIoScaling')]"
203+
},
204+
"Backup": {
205+
"backupRetentionDays": "[parameters('backupRetentionDays')]",
206+
"geoRedundantBackup": "[parameters('geoRedundantBackup')]"
207+
},
208+
"availabilityZone": "[parameters('availabilityZone')]",
209+
"highAvailability": {
210+
"mode": "[parameters('haEnabled')]",
211+
"standbyAvailabilityZone": "[parameters('standbyAvailabilityZone')]"
212+
},
213+
"dataEncryption": "[variables('dataEncryptionData')]"
214+
},
215+
"sku": {
216+
"name": "[parameters('vmName')]",
217+
"tier": "[parameters('serverEdition')]",
218+
"capacity": "[parameters('vCores')]"
219+
},
220+
"tags": "[parameters('tags')]",
221+
"type": "Microsoft.DBforMySQL/flexibleServers"
222+
}
223+
]
224+
}
225+
```

0 commit comments

Comments
 (0)