Skip to content

Commit 89be5aa

Browse files
authored
Update transparent-data-encryption-byok-key-rotation.md
1 parent 8a7cef3 commit 89be5aa

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

articles/azure-sql/database/transparent-data-encryption-byok-key-rotation.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ This article describes key rotation for a [server](logical-servers.md) using a T
2121
## Important considerations when rotating the TDE Protector
2222
- When the TDE protector is changed/rotated, old backups of the database, including backed-up log files, are not updated to use the latest TDE protector. To restore a backup encrypted with a TDE protector from Key Vault, make sure that the key material is available to the target server. Therefore, we recommend that you keep all the old versions of the TDE protector in Azure Key Vault (AKV), so database backups can be restored.
2323
- Even when switching from customer managed key (CMK) to service-managed key, keep all previously used keys in AKV. This ensures database backups, including backed-up log files, can be restored with the TDE protectors stored in AKV.
24-
- After performing key rotation, use the [sys.dm_db_log_info](https://docs.microsoft.com/en-us/sql/relational-databases/system-dynamic-management-views/sys-dm-db-log-info-transact-sql?view=sql-server-ver15) dynamic management view (DMV) to determine if there are any remaining logs that still require the older key. This DMV returns information on the virtual log file (VLF) of the transantion log along with its encryption key thumbprint of the VLF.
24+
- Apart from old backups, transaction log files might also require access to the older TDE Protector. To determine if there are any remaining logs that still require the older key, after performing key rotation, use the [sys.dm_db_log_info](https://docs.microsoft.com/sql/relational-databases/system-dynamic-management-views/sys-dm-db-log-info-transact-sql) dynamic management view (DMV). This DMV returns information on the virtual log file (VLF) of the transantion log along with its encryption key thumbprint of the VLF.
2525
- Older keys need to be kept in AKV and available to the server based on the backup retention period configured as back of backup retention policies on the database. This helps ensure any Long Term Retention (LTR) backups on the server can still be restored using the older keys.
2626

2727

0 commit comments

Comments
 (0)