Skip to content

Commit 82d8672

Browse files
megvanhuygenmegvanhuygen
authored
Merge pull request #107060 from MikeRayMSFT/20200309-auditing
Stage configure auditing.
2 parents 469b281 + 35f401e commit 82d8672

File tree

3 files changed

+155
-9
lines changed

3 files changed

+155
-9
lines changed

‎articles/sql-database/create-auditing-storage-account-vnet-firewall.md

Lines changed: 139 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,139 @@
1+
---
2+
title: Audit to storage account behind VNet and firewall
3+
description: Configure auditing to write database events on a storage account behind virtual network and firewall
4+
services: sql-database
5+
ms.service: sql-database
6+
ms.subservice: security
7+
ms.topic: conceptual
8+
author: DavidTrigano
9+
ms.author: datrigan
10+
ms.reviewer: vanto
11+
ms.date: 03/19/2020
12+
ms.custom: azure-synapse
13+
---
14+
# Write audit to a storage account behind VNet and firewall
15+
16+
Auditing for [Azure SQL Database](sql-database-technical-overview.md) and [Azure Synapse Analytics](../sql-data-warehouse/sql-data-warehouse-overview-what-is.md) supports writing database events to an [Azure Storage account](../storage/common/storage-account-overview.md) behind a virtual network and firewall.
17+
18+
This article explains two ways to configure Azure SQL Server and Azure storage account for this option. The first uses the Azure portal, the second uses REST.
19+
20+
### Background
21+
22+
[Azure Virtual Network (VNet)](../virtual-network/virtual-networks-overview.md) is the fundamental building block for your private network in Azure. VNet enables many types of Azure resources, such as Azure Virtual Machines (VM), to securely communicate with each other, the internet, and on-premises networks. VNet is similar to a traditional network in your own data center, but brings with it additional benefits of Azure infrastructure such as scale, availability, and isolation.
23+
24+
To learn more about the VNet concepts, Best practices and many more, see [What is Azure Virtual Network](../virtual-network/virtual-networks-overview.md).
25+
26+
To learn more about how to create a virtual network, see [Quickstart: Create a virtual network using the Azure portal](../virtual-network/quick-create-portal.md).
27+
28+
## Prerequisites
29+
30+
For audit to write to a storage account behind a VNet or firewall, the following prerequisites are required:
31+
32+
> [!div class="checklist"]
33+
> * A general-purpose v2 storage account. If you have a general-purpose v1 or blob storage account, [upgrade to a general-purpose v2 storage account](../storage/common/storage-account-upgrade.md). For more information, see [Types of storage accounts](../storage/common/storage-account-overview.md#types-of-storage-accounts).
34+
> * The storage account must be on the same subscription and at the same location as the Azure SQL Database server.
35+
> * The Azure Storage account requires `Allow trusted Microsoft services to access this storage account`. Set this on the Storage Account **Firewalls and Virtual networks**.
36+
> * You must have `Microsoft.Authorization/roleAssignments/write` permission on the selected storage account. For more information, see [Azure built-in roles](../role-based-access-control/built-in-roles.md).
37+
38+
## Configure in Azure portal
39+
40+
Connect to [Azure portal](https://portal.azure.com) with your subscription. Navigate to the resource group and Azure SQL database server.
41+
42+
1. Click on **Auditing** under the Security heading. Select **On**.
43+
44+
2. Select **Storage**. Select the storage account where logs will be saved. The storage account must comply with the requirements listed in [Prerequisites](#prerequisites).
45+
46+
3. Open **Storage details**
47+
48+
> [!NOTE]
49+
> If the selected Storage account is behind VNet, you will see the following message:
50+
>
51+
>`You have selected a storage account that is behind a firewall or in a virtual network. Using this storage: requires an Active Directory admin on the server; enables 'Allow trusted Microsoft services to access this storage account' on the storage account; and creates a server managed identity with 'storage blob data contributor' RBAC.`
52+
>
53+
>If you do not see this message, then storage account is not behind a VNet.
54+
55+
4. Select the number of days for the retention period. Then click **OK**. Logs older than the retention period are deleted.
56+
57+
5. Select **Save** on your auditing settings.
58+
59+
You have successfully configured audit to write to a storage account behind a VNet or firewall.
60+
61+
## Configure with REST commands
62+
63+
As an alternative to using the Azure portal, you can use REST commands to configure audit to write database events on a storage account behind a VNet and Firewall.
64+
65+
The sample scripts in this section require you to update the script before you run them. Replace the following values in the scripts:
66+
67+
|Sample value|Sample description|
68+
|:-----|:-----|
69+
|`<subscriptionId>`| Azure subscription ID|
70+
|`<resource group>`| Resource group|
71+
|`<sql database server>`| Azure SQL database server name|
72+
|`<administrator login>`| SQL database administrator account |
73+
|`<complex password>`| Complex password for the administrator account|
74+
75+
To configure SQL Audit to write events to a storage account behind a VNet or Firewall:
76+
77+
1. Register your Azure SQL Database server with Azure Active Directory (Azure AD). Use either PowerShell or REST API.
78+
79+
**PowerShell**
80+
81+
```powershell
82+
Connect-AzAccount
83+
Select-AzSubscription -SubscriptionId <subscriptionId>
84+
Set-AzSqlServer -ResourceGroupName <your resource group> -ServerName <sql database server> -AssignIdentity
85+
```
86+
87+
[**REST API**](https://docs.microsoft.com/rest/api/sql/servers/createorupdate):
88+
89+
Sample request
90+
91+
```html
92+
PUT https://management.azure.com/subscriptions/<subscription ID>/resourceGroups/<resource group>/providers/Microsoft.Sql/servers/<sql database server>?api-version=2015-05-01-preview
93+
```
94+
95+
Request body
96+
97+
```json
98+
{
99+
"identity": {
100+
"type": "SystemAssigned",
101+
},
102+
"properties": {
103+
"fullyQualifiedDomainName": "<sql database server>.database.windows.net",
104+
"administratorLogin": "<administrator login>",
105+
"administratorLoginPassword": "<complex password>",
106+
"version": "12.0",
107+
"state": "Ready"
108+
}
109+
```
110+
111+
2. Open [Azure portal](https://portal.azure.com). Navigate to your storage account. Locate **Access Control (IAM)**, and click **Add role assignment**. Assign **Storage Blob Data Contributor** RBAC role to your Azure SQL Server hosting your Azure SQL database that you registered with Azure Active Directory (Azure AD) as in the previous step.
112+
113+
> [!NOTE]
114+
> Only members with Owner privilege can perform this step. For various built-in roles for Azure resources, refer to [Azure built-in roles](../role-based-access-control/built-in-roles.md).
115+
116+
3. Configure [Azure SQL server's blob auditing policy](/rest/api/sql/server%20auditing%20settings/createorupdate), without specifying a *storageAccountAccessKey*:
117+
118+
Sample request
119+
120+
```html
121+
PUT https://management.azure.com/subscriptions/<subscription ID>/resourceGroups/<resource group>/providers/Microsoft.Sql/servers/<azure sql database server>?api-version=2017-03-01-preview
122+
```
123+
124+
Request body
125+
126+
```json
127+
{
128+
"properties": {
129+
"state": "Enabled",
130+
"storageEndpoint": "https://<storage account>.blob.core.windows.net"
131+
}
132+
}
133+
```
134+
135+
## Next steps
136+
137+
- [Use PowerShell to create a virtual network service endpoint, and then a virtual network rule for Azure SQL Database.](sql-database-vnet-service-endpoint-rule-powershell.md)
138+
- [Virtual Network Rules: Operations with REST APIs](/rest/api/sql/virtualnetworkrules)
139+
- [Use virtual network service endpoints and rules for database servers](sql-database-vnet-service-endpoint-rule-overview.md)

‎articles/sql-database/sql-database-auditing.md

Lines changed: 12 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -8,22 +8,23 @@ ms.topic: conceptual
88
author: DavidTrigano
99
ms.author: datrigan
1010
ms.reviewer: vanto
11-
ms.date: 02/11/2020
11+
ms.date: 03/19/2020
1212
ms.custom: azure-synapse
1313
---
14-
# Get started with SQL database auditing
14+
# Azure SQL Auditing
1515

16-
Auditing for Azure [SQL Database](sql-database-technical-overview.md) and [Azure Synapse Analytics](../sql-data-warehouse/sql-data-warehouse-overview-what-is.md) tracks database events and writes them to an audit log in your Azure storage account, Log Analytics workspace or Event Hubs. Auditing also:
16+
Auditing for Azure [SQL Database](sql-database-technical-overview.md) and [Azure Synapse Analytics](../sql-data-warehouse/sql-data-warehouse-overview-what-is.md) tracks database events and writes them to an audit log in your Azure storage account, Log Analytics workspace or Event Hubs.
17+
18+
Auditing also:
1719

1820
- Helps you maintain regulatory compliance, understand database activity, and gain insight into discrepancies and anomalies that could indicate business concerns or suspected security violations.
1921

2022
- Enables and facilitates adherence to compliance standards, although it doesn't guarantee compliance. For more information about Azure programs that support standards compliance, see the [Azure Trust Center](https://gallery.technet.microsoft.com/Overview-of-Azure-c1be3942) where you can find the most current list of SQL Database compliance certifications.
2123

22-
2324
> [!NOTE]
24-
> This topic applies to Azure SQL server, and to both SQL Database and Azure Synapse Analytics databases that are created on the Azure SQL server. For simplicity, SQL Database is used when referring to both SQL Database and Azure Synapse.
25+
> This topic applies to both Azure SQL Database, and Azure Synapse Analytics databases. For simplicity, SQL Database is used when referring to both Azure SQL Database and Azure Synapse Analytics.
2526
26-
## <a id="subheading-1"></a>Azure SQL database auditing overview
27+
## <a id="subheading-1"></a>Overview
2728

2829
You can use SQL database auditing to:
2930

@@ -95,10 +96,14 @@ To configure writing audit logs to a storage account, select **Storage** and ope
9596
9697
![storage account](./media/sql-database-auditing-get-started/auditing_select_storage.png)
9798

98-
To configure a storage account under a virtual network or firewall you will need an [Active Directory admin](https://docs.microsoft.com/azure/sql-database/sql-database-aad-authentication-configure?tabs=azure-powershell#provision-an-azure-active-directory-administrator-for-your-managed-instance) on the server, enable **Allow trusted Microsoft services to access this storage account** on the storage account. In addition, you need to have the 'Microsoft.Authorization/roleAssignments/write' permission on the selected storage account.
99+
To configure a storage account behind a virtual network or firewall you will need an [Active Directory admin](https://docs.microsoft.com/azure/sql-database/sql-database-aad-authentication-configure?tabs=azure-powershell#provision-an-azure-active-directory-administrator-for-your-managed-instance) on the server, enable **Allow trusted Microsoft services to access this storage account** on the storage account. In addition, you need to have the 'Microsoft.Authorization/roleAssignments/write' permission on the selected storage account.
99100

100101
We recommend you to be [User Access Administrator](../role-based-access-control/built-in-roles.md#user-access-administrator) in order to grant to the managed identity the role 'storage blob data contributor'. To learn more about permissions and role-based access control, see [What is role-based access control (RBAC) for Azure resources?](../role-based-access-control/overview.md) and [Add or remove role assignments using Azure RBAC and the Azure portal](../role-based-access-control/role-assignments-portal.md)
101102

103+
#### Log audits to storage account behind VNet or firewall
104+
105+
You can write audit logs to a an Azure Storage account behind a VNet or firewall. For specific instructions see, [Write audit to a storage account behind VNet and firewall](create-auditing-storage-account-vnet-firewall.md).
106+
102107
### <a id="audit-log-analytics-destination">Audit to Log Analytics destination</a>
103108

104109
To configure writing audit logs to a Log Analytics workspace, select **Log Analytics (Preview)** and open **Log Analytics details**. Select or create the Log Analytics workspace where logs will be written and then click **OK**.

‎articles/sql-database/toc.yml

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -117,9 +117,11 @@
117117

118118
- name: Auditing
119119
items:
120-
- name: Get started with SQL Database auditing
120+
- name: Azure SQL Auditing
121121
href: sql-database-auditing.md
122-
- name: Audit Log Format
122+
- name: To storage behind VNet or firewall
123+
href: create-auditing-storage-account-vnet-firewall.md
124+
- name: Audit log format
123125
href: sql-database-audit-log-format.md
124126

125127
- name: Security management

0 commit comments

Comments
 (0)