Skip to content

Commit 38813d8

Browse files
PietervanhovePietervanhove
committed
Improve Always Encrypted Demos
1 parent b00a1c8 commit 38813d8

File tree

3 files changed

+38
-34
lines changed

3 files changed

+38
-34
lines changed

‎samples/features/security/always-encrypted-with-secure-enclaves/azure-sql-database-sgx/setup/azuredeploy.bicep

Lines changed: 31 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ param userName string
1414
@description('The username of the Azure SQL database server administrator for SQL authentication.')
1515
param sqlAdminUserName string
1616

17+
@secure()
1718
@description('The password of the Azure SQL database server administrator for SQL authentication.')
1819
param sqlAdminPassword string
1920

@@ -29,9 +30,9 @@ param location string = resourceGroup().location
2930
////////////////////////////////////////////
3031

3132
// Create the server
32-
var SQLServerName_var = '${projectName}server'
33-
resource Server_Name_resource 'Microsoft.Sql/servers@2022-05-01-preview' = {
34-
name: SQLServerName_var
33+
var SQLServerName = '${projectName}server'
34+
resource Server_Name_resource 'Microsoft.Sql/servers@2023-02-01-preview' = {
35+
name: SQLServerName
3536
location: location
3637
tags: {}
3738
identity: {
@@ -47,41 +48,43 @@ resource Server_Name_resource 'Microsoft.Sql/servers@2022-05-01-preview' = {
4748
}
4849

4950
// Allow Azure services and resources to access this server
50-
resource Server_Name_AllowAllWindowsAzureIps 'Microsoft.Sql/servers/firewallRules@2022-05-01-preview' = {
51-
name: '${Server_Name_resource.name}/AllowAllWindowsAzureIps'
51+
resource Server_Name_AllowAllWindowsAzureIps 'Microsoft.Sql/servers/firewallRules@2023-02-01-preview' = {
52+
parent: Server_Name_resource
53+
name: 'AllowAllWindowsAzureIps'
5254
properties: {
5355
endIpAddress: '0.0.0.0'
5456
startIpAddress: '0.0.0.0'
5557
}
5658
}
5759

5860
// Allow Client IP to access this server
59-
resource Server_Name_AllowClientIP 'Microsoft.Sql/servers/firewallRules@2022-05-01-preview' = {
60-
name: '${Server_Name_resource.name}/AllowClientIP'
61+
resource Server_Name_AllowClientIP 'Microsoft.Sql/servers/firewallRules@2023-02-01-preview' = {
62+
parent: Server_Name_resource
63+
name: 'AllowClientIP'
6164
properties: {
6265
endIpAddress: clientIP
6366
startIpAddress: clientIP
6467
}
6568
}
6669

6770
// Make the user an Azure AD administrator for the server, so that the user can connect with universal authentication
68-
resource Server_Name_activeDirectory 'Microsoft.Sql/servers/administrators@2022-05-01-preview' = {
69-
name: '${Server_Name_resource.name}/activeDirectory'
71+
resource Server_Name_activeDirectory 'Microsoft.Sql/servers/administrators@2023-02-01-preview' = {
72+
parent: Server_Name_resource
73+
name: 'activeDirectory'
7074
properties: {
7175
administratorType: 'ActiveDirectory'
7276
login: userName
73-
//sid: reference(resourceId('Microsoft.Sql/servers', '${projectName}server'), '2019-06-01-preview', 'Full').identity.principalId
7477
sid: userObjectId
75-
//tenantId: AAD_TenantId //optional
76-
}
78+
}
7779
}
7880

7981
//////////////////////////////////////////////////////////////////////////////
8082
// Create the ContosoHR database using the DC-series hardware configuration //
8183
//////////////////////////////////////////////////////////////////////////////
8284

83-
resource Database_Resource 'Microsoft.Sql/servers/databases@2022-05-01-preview' = {
84-
name: '${Server_Name_resource.name}/ContosoHR'
85+
resource Database_Resource 'Microsoft.Sql/servers/databases@2023-02-01-preview' = {
86+
parent: Server_Name_resource
87+
name: 'ContosoHR'
8588
location: location
8689
tags: {}
8790
sku: {
@@ -96,18 +99,18 @@ resource Database_Resource 'Microsoft.Sql/servers/databases@2022-05-01-preview'
9699
///////////////////////////////////////
97100

98101
// Create the attestation provider
99-
resource attestationProviderName_resource 'Microsoft.Attestation/attestationProviders@2021-06-01-preview' = {
100-
name: '${projectName}attest'
102+
resource attestationProviderName 'Microsoft.Attestation/attestationProviders@2021-06-01' = {
103+
name: '${projectName}attestation'
101104
location: location
102105
properties: {}
103106
}
104107

105108
///////////////////////////////////
106109
// Configure the web application //
107110
///////////////////////////////////
108-
111+
var sqlServerSuffix = environment().suffixes.sqlServerHostname
109112
// Create an App Service plan
110-
resource WebAppServicePlan_Resource 'Microsoft.Web/serverfarms@2022-03-01' = {
113+
resource WebAppServicePlan_Resource 'Microsoft.Web/serverfarms@2022-09-01' = {
111114
name: '${projectName}plan'
112115
location: location
113116
properties: {}
@@ -117,7 +120,7 @@ resource WebAppServicePlan_Resource 'Microsoft.Web/serverfarms@2022-03-01' = {
117120
}
118121

119122
// Create the App Service
120-
resource WebApp_Resource 'Microsoft.Web/sites@2022-03-01' = {
123+
resource WebApp_Resource 'Microsoft.Web/sites@2022-09-01' = {
121124
name: '${projectName}app'
122125
location: location
123126
identity: {
@@ -132,7 +135,7 @@ resource WebApp_Resource 'Microsoft.Web/sites@2022-03-01' = {
132135
name: 'connectionstrings'
133136
properties: {
134137
ContosoHRDatabase: {
135-
value: 'Server=tcp:${Server_Name_resource.name}.database.windows.net;Database=ContosoHR;Column Encryption Setting=Enabled; Attestation Protocol = AAS; Enclave Attestation Url=${attestationProviderName_resource.properties.attestUri}; Authentication=Active Directory Managed Identity'
138+
value: 'Server=tcp:${Server_Name_resource.name}${sqlServerSuffix};Database=ContosoHR;Column Encryption Setting=Enabled; Attestation Protocol = AAS; Enclave Attestation Url=${attestationProviderName.properties.attestUri}; Authentication=Active Directory Managed Identity'
136139
type: 'SQLAzure'
137140
}
138141
}
@@ -147,8 +150,9 @@ resource WebApp_Resource 'Microsoft.Web/sites@2022-03-01' = {
147150
}
148151

149152
// Deploy the application
150-
resource sourceControl 'Microsoft.Web/sites/sourcecontrols@2022-03-01' = {
151-
name: '${projectName}app/web'
153+
resource sourceControl 'Microsoft.Web/sites/sourcecontrols@2022-09-01' = {
154+
parent: WebApp_Resource
155+
name: 'web'
152156
properties: {
153157
repoUrl: 'https://github.com/microsoft/sql-server-samples.git'
154158
branch: 'master'
@@ -164,7 +168,7 @@ resource sourceControl 'Microsoft.Web/sites/sourcecontrols@2022-03-01' = {
164168
//////////////////////////////////////
165169

166170
// Create a key vault and assign key permissions to the user, so that the user can manage the keys
167-
resource KeyVault_Resource 'Microsoft.KeyVault/vaults@2022-07-01' = {
171+
resource KeyVault_Resource 'Microsoft.KeyVault/vaults@2023-02-01' = {
168172
name: '${projectName}vault'
169173
location: location
170174
tags: {}
@@ -197,7 +201,7 @@ resource KeyVault_Resource 'Microsoft.KeyVault/vaults@2022-07-01' = {
197201
}
198202

199203
// Assign key permissions to the web app
200-
resource KeyVaultWebAppAccessPolicy_Resource 'Microsoft.KeyVault/vaults/accessPolicies@2022-07-01' = {
204+
resource KeyVaultWebAppAccessPolicy_Resource 'Microsoft.KeyVault/vaults/accessPolicies@2023-02-01' = {
201205
name: any('${KeyVault_Resource.name}/add')
202206
properties: {
203207
accessPolicies: [
@@ -218,8 +222,9 @@ resource KeyVaultWebAppAccessPolicy_Resource 'Microsoft.KeyVault/vaults/accessPo
218222
}
219223

220224
// Create a key
221-
resource Key_Resource 'Microsoft.KeyVault/vaults/keys@2022-07-01' = {
222-
name: '${KeyVault_Resource.name}/CMK'
225+
resource Key_Resource 'Microsoft.KeyVault/vaults/keys@2023-02-01' = {
226+
parent: KeyVault_Resource
227+
name: 'CMK'
223228
tags: {}
224229
properties: {
225230
attributes: {

‎samples/features/security/always-encrypted-with-secure-enclaves/azure-sql-database-sgx/setup/setup.ps1

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
1-
Import-Module "Az" -MinimumVersion "9.3"
2-
Import-Module "SqlServer" #-Version "22.0.49-preview"
1+
Import-Module "Az"
2+
Import-Module "SqlServer"
33

44
######################################################################
55
# Prompt the user to enter the values of deployment parameters
@@ -10,9 +10,9 @@ $subscriptionId = Read-Host -Prompt "Enter your subscription id"
1010
$location = Read-Host -Prompt "Enter a region where you want to deploy the demo environment"
1111
$sqlAdminUserName = Read-Host -Prompt "Enter the username of the Azure SQL database server administrator for SQL authentication"
1212
$sqlAdminPasswordSecureString = Read-Host -Prompt "Enter the password of the Azure SQL database server administrator for SQL authentication" -AsSecureString
13-
13+
$Secure_String_Pwd = ConvertTo-SecureString $sqlAdminPasswordSecureString -AsPlainText -Force
1414
$sqlAdminPassword = (New-Object PSCredential "user",$sqlAdminPasswordSecureString).GetNetworkCredential().Password
15-
$clientIP = (Invoke-WebRequest ifconfig.me/ip).Content.Trim()
15+
$clientIP = (Invoke-WebRequest http://ipinfo.io/ip).Content.Trim()
1616
$bicepFile = "azuredeploy.bicep"
1717
$projectName = $projectName.ToLower()
1818

@@ -42,7 +42,7 @@ New-AzResourceGroupDeployment `
4242
-userObjectId $userObjectId `
4343
-userName $userName `
4444
-sqlAdminUserName $sqlAdminUserName `
45-
-sqlAdminPassword $sqlAdminPassword `
45+
-sqlAdminPassword $Secure_String_Pwd `
4646
-clientIP $clientIP
4747

4848
######################################################################
@@ -105,7 +105,7 @@ $keyName = "CMK"
105105
$key = Get-AzKeyVaultKey -VaultName $keyVaultName -Name $keyName
106106

107107
# Connect to the database using the SqlServer PowerShell module
108-
$connStr = "Data Source=tcp:$serverName;Initial Catalog=$databaseName;User ID=$sqlAdminUserName;Password=$sqlAdminPassword"
108+
$connStr = "Data Source=tcp:$serverName;Initial Catalog=$databaseName;User ID=$sqlAdminUserName;Password=$sqlAdminPasswordSecureString"
109109
$database = Get-SqlDatabase -ConnectionString $connStr
110110

111111
# Sign in to Azure with your email address using the SqlServer PowerShell module

‎samples/features/security/always-encrypted-with-secure-enclaves/azure-sql-database-vbs/setup/setup.ps1

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,6 @@ New-AzResourceGroup -Name $resourceGroupName -Location $location
3535
# Deploy the resources for the demo environment
3636
######################################################################
3737

38-
3938
New-AzResourceGroupDeployment `
4039
-ResourceGroupName $resourceGroupName `
4140
-TemplateFile $bicepFile `
@@ -106,7 +105,7 @@ $keyName = "CMK"
106105
$key = Get-AzKeyVaultKey -VaultName $keyVaultName -Name $keyName
107106

108107
# Connect to the database using the SqlServer PowerShell module
109-
$connStr = "Data Source=tcp:$serverName;Initial Catalog=$databaseName;User ID=$sqlAdminUserName;Password=$sqlAdminPassword"
108+
$connStr = "Data Source=tcp:$serverName;Initial Catalog=$databaseName;User ID=$sqlAdminUserName;Password=$sqlAdminPasswordSecureString"
110109
$database = Get-SqlDatabase -ConnectionString $connStr
111110

112111
# Sign in to Azure with your email address using the SqlServer PowerShell module

0 commit comments

Comments
 (0)