Skip to content

Commit b53df0f

Browse files
GitHubber17GitHubber17
authored
Merge pull request #106750 from kummanish/armupdate
Editing the data encryption arm template
2 parents e9f70ce + 33d4d98 commit b53df0f

File tree

2 files changed

+252
-0
lines changed

2 files changed

+252
-0
lines changed

‎articles/mysql/howto-data-encryption-portal.md

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,133 @@ After Azure Database for MySQL is encrypted with a customer's managed key stored
8989
9090
![Screenshot of Azure Database for MySQL, showing restored functionality](media/concepts-data-access-and-security-data-encryption/restore-successful.png)
9191
92+
93+
## Using an Azure Resource Manager template to enable data encryption
94+
95+
Apart from the Azure portal, you can also enable data encryption on your Azure Database for MySQL server using Azure Resource Manager templates for new and existing servers.
96+
97+
### For a new server
98+
99+
Use one of the pre-created Azure Resource Manager templates to provision the server with data encryption enabled:
100+
[Example with Data encryption](https://github.com/Azure/azure-mysql/tree/master/arm-templates/ExampleWithDataEncryption)
101+
102+
This Azure Resource Manager template creates a Azure Database for MySQL server and uses the **KeyVault** and **Key** passed as parameters to enable data encryption on the server.
103+
104+
### For an existing server
105+
Additionally, you can use Azure Resource Manager templates to enable data encryption on your existing Azure Database for MySQL servers.
106+
107+
* Pass the URI of the Azure Key Vault key that you copied earlier under the `keyVaultKeyUri` property in the properties object.
108+
109+
* Use *2020-01-01-preview* as the API version.
110+
111+
```json
112+
{
113+
"$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#",
114+
"contentVersion": "1.0.0.0",
115+
"parameters": {
116+
"location": {
117+
"type": "string"
118+
},
119+
"serverName": {
120+
"type": "string"
121+
},
122+
"keyVaultName": {
123+
"type": "string",
124+
"metadata": {
125+
"description": "Key vault name where the key to use is stored"
126+
}
127+
},
128+
"keyVaultResourceGroupName": {
129+
"type": "string",
130+
"metadata": {
131+
"description": "Key vault resource group name where it is stored"
132+
}
133+
},
134+
"keyName": {
135+
"type": "string",
136+
"metadata": {
137+
"description": "Key name in the key vault to use as encryption protector"
138+
}
139+
},
140+
"keyVersion": {
141+
"type": "string",
142+
"metadata": {
143+
"description": "Version of the key in the key vault to use as encryption protector"
144+
}
145+
}
146+
},
147+
"variables": {
148+
"serverKeyName": "[concat(parameters('keyVaultName'), '_', parameters('keyName'), '_', parameters('keyVersion'))]"
149+
},
150+
"resources": [
151+
{
152+
"type": "Microsoft.DBforMySQL/servers",
153+
"apiVersion": "2017-12-01",
154+
"kind": "",
155+
"location": "[parameters('location')]",
156+
"identity": {
157+
"type": "SystemAssigned"
158+
},
159+
"name": "[parameters('serverName')]",
160+
"properties": {
161+
}
162+
},
163+
{
164+
"type": "Microsoft.Resources/deployments",
165+
"apiVersion": "2019-05-01",
166+
"name": "addAccessPolicy",
167+
"resourceGroup": "[parameters('keyVaultResourceGroupName')]",
168+
"dependsOn": [
169+
"[resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))]"
170+
],
171+
"properties": {
172+
"mode": "Incremental",
173+
"template": {
174+
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
175+
"contentVersion": "1.0.0.0",
176+
"resources": [
177+
{
178+
"type": "Microsoft.KeyVault/vaults/accessPolicies",
179+
"name": "[concat(parameters('keyVaultName'), '/add')]",
180+
"apiVersion": "2018-02-14-preview",
181+
"properties": {
182+
"accessPolicies": [
183+
{
184+
"tenantId": "[subscription().tenantId]",
185+
"objectId": "[reference(resourceId('Microsoft.DBforMySQL/servers/', parameters('serverName')), '2017-12-01', 'Full').identity.principalId]",
186+
"permissions": {
187+
"keys": [
188+
"get",
189+
"wrapKey",
190+
"unwrapKey"
191+
]
192+
}
193+
}
194+
]
195+
}
196+
}
197+
]
198+
}
199+
}
200+
},
201+
{
202+
"name": "[concat(parameters('serverName'), '/', variables('serverKeyName'))]",
203+
"type": "Microsoft.DBforMySQL/servers/keys",
204+
"apiVersion": "2020-01-01-preview",
205+
"dependsOn": [
206+
"addAccessPolicy",
207+
"[resourceId('Microsoft.DBforMySQL/servers', parameters('serverName'))]"
208+
],
209+
"properties": {
210+
"serverKeyType": "AzureKeyVault",
211+
"uri": "[concat(reference(resourceId(parameters('keyVaultResourceGroupName'), 'Microsoft.KeyVault/vaults/', parameters('keyVaultName')), '2018-02-14-preview', 'Full').properties.vaultUri, 'keys/', parameters('keyName'), '/', parameters('keyVersion'))]"
212+
}
213+
}
214+
]
215+
}
216+
217+
```
218+
92219
## Next steps
93220

94221
To learn more about data encryption, see [Azure Database for MySQL data encryption with customer-managed key](concepts-data-encryption-mysql.md).

‎articles/postgresql/howto-data-encryption-portal.md

Lines changed: 125 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,131 @@ After Azure Database for PostgreSQL Single server is encrypted with a customer's
8989
9090
![Screenshot of Azure Database for PostgreSQL, showing restored functionality](media/concepts-data-access-and-security-data-encryption/restore-successful.png)
9191
92+
## Using an Azure Resource Manager template to enable data encryption
93+
94+
Apart from Azure portal, you can also enable data encryption on your Azure Database for PostgreSQL single server using Azure Resource Manager templates for new and existing server.
95+
96+
### For a new server
97+
98+
Use one of the pre-created Azure Resource Manager templates to provision the server with data encryption enabled:
99+
[Example with Data encryption](https://github.com/Azure/azure-postgresql/tree/master/arm-templates/ExampleWithDataEncryption)
100+
101+
This Azure Resource Manager template creates a Azure Database for PostgreSQL Single server and uses the **KeyVault** and **Key** passed as parameters to enable data encryption on the server.
102+
103+
### For an existing server
104+
Additionally, you can use Azure Resource Manager templates to enable data encryption on your existing Azure Database for PostgreSQL Single servers.
105+
106+
* Pass the URI of the Azure Key Vault key that you copied earlier under the `keyVaultKeyUri` property in the properties object.
107+
108+
* Use *2020-01-01-preview* as the API version.
109+
110+
```json
111+
{
112+
"$schema": "http://schema.management.azure.com/schemas/2014-04-01-preview/deploymentTemplate.json#",
113+
"contentVersion": "1.0.0.0",
114+
"parameters": {
115+
"location": {
116+
"type": "string"
117+
},
118+
"serverName": {
119+
"type": "string"
120+
},
121+
"keyVaultName": {
122+
"type": "string",
123+
"metadata": {
124+
"description": "Key vault name where the key to use is stored"
125+
}
126+
},
127+
"keyVaultResourceGroupName": {
128+
"type": "string",
129+
"metadata": {
130+
"description": "Key vault resource group name where it is stored"
131+
}
132+
},
133+
"keyName": {
134+
"type": "string",
135+
"metadata": {
136+
"description": "Key name in the key vault to use as encryption protector"
137+
}
138+
},
139+
"keyVersion": {
140+
"type": "string",
141+
"metadata": {
142+
"description": "Version of the key in the key vault to use as encryption protector"
143+
}
144+
}
145+
},
146+
"variables": {
147+
"serverKeyName": "[concat(parameters('keyVaultName'), '_', parameters('keyName'), '_', parameters('keyVersion'))]"
148+
},
149+
"resources": [
150+
{
151+
"type": "Microsoft.DBforPostgreSQL/servers",
152+
"apiVersion": "2017-12-01",
153+
"kind": "",
154+
"location": "[parameters('location')]",
155+
"identity": {
156+
"type": "SystemAssigned"
157+
},
158+
"name": "[parameters('serverName')]",
159+
"properties": {
160+
}
161+
},
162+
{
163+
"type": "Microsoft.Resources/deployments",
164+
"apiVersion": "2019-05-01",
165+
"name": "addAccessPolicy",
166+
"resourceGroup": "[parameters('keyVaultResourceGroupName')]",
167+
"dependsOn": [
168+
"[resourceId('Microsoft.DBforPostgreSQL/servers', parameters('serverName'))]"
169+
],
170+
"properties": {
171+
"mode": "Incremental",
172+
"template": {
173+
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
174+
"contentVersion": "1.0.0.0",
175+
"resources": [
176+
{
177+
"type": "Microsoft.KeyVault/vaults/accessPolicies",
178+
"name": "[concat(parameters('keyVaultName'), '/add')]",
179+
"apiVersion": "2018-02-14-preview",
180+
"properties": {
181+
"accessPolicies": [
182+
{
183+
"tenantId": "[subscription().tenantId]",
184+
"objectId": "[reference(resourceId('Microsoft.DBforPostgreSQL/servers/', parameters('serverName')), '2017-12-01', 'Full').identity.principalId]",
185+
"permissions": {
186+
"keys": [
187+
"get",
188+
"wrapKey",
189+
"unwrapKey"
190+
]
191+
}
192+
}
193+
]
194+
}
195+
}
196+
]
197+
}
198+
}
199+
},
200+
{
201+
"name": "[concat(parameters('serverName'), '/', variables('serverKeyName'))]",
202+
"type": "Microsoft.DBforPostgreSQL/servers/keys",
203+
"apiVersion": "2020-01-01-preview",
204+
"dependsOn": [
205+
"addAccessPolicy",
206+
"[resourceId('Microsoft.DBforPostgreSQL/servers', parameters('serverName'))]"
207+
],
208+
"properties": {
209+
"serverKeyType": "AzureKeyVault",
210+
"uri": "[concat(reference(resourceId(parameters('keyVaultResourceGroupName'), 'Microsoft.KeyVault/vaults/', parameters('keyVaultName')), '2018-02-14-preview', 'Full').properties.vaultUri, 'keys/', parameters('keyName'), '/', parameters('keyVersion'))]"
211+
}
212+
}
213+
]
214+
}
215+
```
216+
92217
## Next steps
93218

94219
To learn more about data encryption, see [Azure Database for PostgreSQL Single server data encryption with customer-managed key](concepts-data-encryption-postgresql.md).

0 commit comments

Comments
 (0)