Hands-On Cloud Administration in Azure

Using your own key for Azure SQL Database encryption

To use our own key for Azure SQL Database TDE, we must execute a few commands.

First, we need to sign our Azure Active Directory identity in to our Azure SQL server:

$dbRG = 'PacktPaaSDB';$dbServer = 'packt';$server = Set-AzureRmSqlServer -ResourceGroupName $dbRG -ServerName $dbServer -AssignIdentity

Second, we must grant Key Vault permission to our server:

$dbRG = 'PacktPaaSDB';$dbServer = 'packt';$KeyVaultName = 'PacktKV';Set-AzureRmKeyVaultAccessPolicy -VaultName $KeyVaultName -ObjectId $server.Identity.PrincipalId -PermissionsToKeys get, wrapKey, unwrapKey

Third, we add the Key Vault key to the server and set the TDE protection level:

$dbRG = 'PacktPaaSDB';$dbServer = 'packt';$rgName ...