|
| 1 | +--- |
| 2 | +title: "Configure Azure Attestation for your Azure SQL logical server" |
| 3 | +description: "Configure Azure Attestation for Always Encrypted with secure enclaves in Azure SQL Database." |
| 4 | +keywords: encrypt data, sql encryption, database encryption, sensitive data, Always Encrypted, secure enclaves, SGX, attestation |
| 5 | +services: sql-database |
| 6 | +ms.service: sql-database |
| 7 | +ms.subservice: security |
| 8 | +ms.devlang: |
| 9 | +ms.topic: how-to |
| 10 | +author: jaszymas |
| 11 | +ms.author: jaszymas |
| 12 | +ms.reviwer: vanto |
| 13 | +ms.date: 01/15/2021 |
| 14 | +--- |
| 15 | + |
| 16 | +# Configure Azure Attestation for your Azure SQL logical server |
| 17 | + |
| 18 | +[!INCLUDE[appliesto-sqldb](../includes/appliesto-sqldb.md)] |
| 19 | + |
| 20 | +> [!NOTE] |
| 21 | +> Always Encrypted with secure enclaves for Azure SQL Database is currently in **public preview**. |
| 22 | +
|
| 23 | +[Microsoft Azure Attestation](../../attestation/overview.md) is a solution for attesting Trusted Execution Environments (TEEs), including Intel Software Guard Extensions (Intel SGX) enclaves. |
| 24 | + |
| 25 | +To use Azure Attestation for attesting Intel SGX enclaves used for [Always Encrypted with secure enclaves](/sql/relational-databases/security/encryption/always-encrypted-enclaves) in Azure SQL Database, you need to: |
| 26 | + |
| 27 | +1. Create an [attestation provider](../../attestation/basic-concepts.md#attestation-provider) and configure it with the recommended attestation policy. |
| 28 | + |
| 29 | +2. Grant your Azure SQL logical server access to your attestation provider. |
| 30 | + |
| 31 | +> [!NOTE] |
| 32 | +> Configuring attestation is the responsibility of the attestation administrator. See [Roles and responsibilities when configuring SGX enclaves and attestation](always-encrypted-enclaves-plan.md#roles-and-responsibilities-when-configuring-sgx-enclaves-and-attestation). |
| 33 | +
|
| 34 | +## Requirements |
| 35 | + |
| 36 | +The Azure SQL logical server and the attestation provider must belong to the same Azure Active Directory tenant. Cross-tenant interactions aren't supported. |
| 37 | + |
| 38 | +The Azure SQL logical server must have an Azure AD identity assigned to it. As the attestation administrator you need to obtain the Azure AD identity of the server from the Azure SQL Database administrator for that server. You will use the identity to grant the server access to the attestation provider. |
| 39 | + |
| 40 | +For instructions on how to create a server with an identity or assign an identity to an existing server using PowerShell and Azure CLI, see [Assign an Azure AD identity to your server](transparent-data-encryption-byok-configure.md#assign-an-azure-active-directory-azure-ad-identity-to-your-server). |
| 41 | + |
| 42 | +## Create and configure an attestation provider |
| 43 | + |
| 44 | +An [attestation provider](../../attestation/basic-concepts.md#attestation-provider) is a resource in Azure Attestation that evaluates [attestation requests](../../attestation/basic-concepts.md#attestation-request) against [attestation policies](../../attestation/basic-concepts.md#attestation-request) and issues [attestation tokens](../../attestation/basic-concepts.md#attestation-token). |
| 45 | + |
| 46 | +Attestation policies are specified using the [claim rule grammar](../../attestation/claim-rule-grammar.md). |
| 47 | + |
| 48 | +Microsoft recommends the following policy for attesting Intel SGX enclaves used for Always Encrypted in Azure SQL Database: |
| 49 | + |
| 50 | +```output |
| 51 | +version= 1.0; |
| 52 | +authorizationrules |
| 53 | +{ |
| 54 | + [ type=="x-ms-sgx-is-debuggable", value==false ] |
| 55 | + && [ type=="x-ms-sgx-product-id", value==4639 ] |
| 56 | + && [ type=="x-ms-sgx-svn", value>= 0 ] |
| 57 | + && [ type=="x-ms-sgx-mrsigner", value=="e31c9e505f37a58de09335075fc8591254313eb20bb1a27e5443cc450b6e33e5"] |
| 58 | + => permit(); |
| 59 | +}; |
| 60 | +``` |
| 61 | + |
| 62 | +The above policy verifies: |
| 63 | + |
| 64 | +- The enclave inside Azure SQL Database doesn't support debugging (which would reduce the level of protection the enclave provides). |
| 65 | +- The product ID of the library inside the enclave is the product ID assigned to Always Encrypted with secure enclaves (4639). |
| 66 | +- The version ID (svn) of the library is greater than 0. |
| 67 | +- The library in the enclave has been signed using the Microsoft signing key (the value of the x-ms-sgx-mrsigner claim is the hash of the signing key). |
| 68 | + |
| 69 | +> [!IMPORTANT] |
| 70 | +> An attestation provider gets created with the default policy for Intel SGX enclaves, which does not validate the code running inside the enclave. Microsoft strongly advises you set the above recommended policy, and not use the default policy, for Always Encrypted with secure enclaves. |
| 71 | +
|
| 72 | +For instructions for how to create an attestation provider and configure with an attestation policy using: |
| 73 | + |
| 74 | +- [Quickstart: Set up Azure Attestation with Azure portal](../../attestation/quickstart-portal.md) |
| 75 | + > [!IMPORTANT] |
| 76 | + > When you configure your attestation policy with Azure portal, set Attestation Type to `SGX-IntelSDK`. |
| 77 | +- [Quickstart: Set up Azure Attestation with Azure PowerShell](../../attestation/quickstart-powershell.md) |
| 78 | + > [!IMPORTANT] |
| 79 | + > When you configure your attestation policy with Azure PowerShell, set the `Tee` parameter to `SgxEnclave`. |
| 80 | +- [Quickstart: Set up Azure Attestation with Azure CLI](../../attestation/quickstart-azure-cli.md) |
| 81 | + > [!IMPORTANT] |
| 82 | + > When you configure your attestation policy with Azure CLI, set the `attestation-type` parameter to `SGX-IntelSDK`. |
| 83 | +
|
| 84 | +## Determine the attestation URL for your attestation policy |
| 85 | + |
| 86 | +After you've configured an attestation policy, you need to share the attestation URL, referencing the policy, administrators of applications that use Always Encrypted with secure enclaves in Azure SQL Database. Application administrators or/and application users will need to configure their apps with the attestation URL, so that they can run statements that use secure enclaves. |
| 87 | + |
| 88 | +### Use PowerShell to determine the attestation URL |
| 89 | + |
| 90 | +Use the following script to determine your attestation URL: |
| 91 | + |
| 92 | +```powershell |
| 93 | +$attestationProvider = Get-AzAttestation -Name $attestationProviderName -ResourceGroupName $attestationResourceGroupName |
| 94 | +$attestationUrl = $attestationProvider.AttestUri + “/attest/SgxEnclave” |
| 95 | +Write-Host "Your attestation URL is: " $attestationUrl |
| 96 | +``` |
| 97 | + |
| 98 | +### Use Azure portal to determine the attestation URL |
| 99 | + |
| 100 | +1. In the Overview pane for your attestation provider, copy the value of the Attest URI property to clipboard. An Attest URI should look like this: `https://MyAttestationProvider.us.attest.azure.net`. |
| 101 | + |
| 102 | +2. Append the following to the Attest URI: `/attest/SgxEnclave`. |
| 103 | + |
| 104 | +The resulting attestation URL should look like this: `https://MyAttestationProvider.us.attest.azure.net/attest/SgxEnclave` |
| 105 | + |
| 106 | +## Grant your Azure SQL logical server access to your attestation provider |
| 107 | + |
| 108 | +During the attestation workflow, the Azure SQL logical server containing your database calls the attestation provider to submit an attestation request. For the Azure SQL logical server to be able to submit attestation requests, the server must have a permission for the `Microsoft.Attestation/attestationProviders/attestation/read` action on the attestation provider. The recommended way to grant the permission is for the administrator of the attestation provider to assign the Azure AD identity of the server to the Attestation Reader role for the attestation provider, or its containing resource group. |
| 109 | + |
| 110 | +### Use Azure portal to assign permission |
| 111 | + |
| 112 | +To assign the identity of an Azure SQL server to the Attestation Reader role for an attestation provider, follow the general instructions in [Add or remove Azure role assignments using the Azure portal](../../role-based-access-control/role-assignments-portal.md). When you are in the **Add role assignment** pane: |
| 113 | + |
| 114 | +1. In the **Role** drop-down, select the **Attestation Reader** role. |
| 115 | +1. In the **Select** field, enter the name of your Azure SQL server to search for it. |
| 116 | + |
| 117 | +See the below screenshot for an example. |
| 118 | + |
| 119 | + |
| 120 | + |
| 121 | +> [!NOTE] |
| 122 | +> For a server to show up in the **Add role assignment** pane, the server must have an Azure AD identity assigned - see [Requirements](#requirements). |
| 123 | +
|
| 124 | +### Use PowerShell to assign permission |
| 125 | + |
| 126 | +1. Find your Azure SQL logical server. |
| 127 | + |
| 128 | +```powershell |
| 129 | +$serverResourceGroupName = "<server resource group name>" |
| 130 | +$serverName = "<server name>" |
| 131 | +$server = Get-AzSqlServer -ServerName $serverName -ResourceGroupName |
| 132 | +``` |
| 133 | + |
| 134 | +2. Assign the server to the Attestation Reader role for the resource group containing your attestation provider. |
| 135 | + |
| 136 | +```powershell |
| 137 | +$attestationResourceGroupName = "<attestation provider resource group name>" |
| 138 | +New-AzRoleAssignment -ObjectId $server.Identity.PrincipalId -RoleDefinitionName "Attestation Reader" -ResourceGroupName $attestationResourceGroupName |
| 139 | +``` |
| 140 | + |
| 141 | +For more information, see [Add or remove Azure role assignments using Azure PowerShell](../../role-based-access-control/role-assignments-powershell.md#add-role-assignment-examples). |
| 142 | + |
| 143 | +## Next Steps |
| 144 | + |
| 145 | +- [Manage keys for Always Encrypted with secure enclaves](/sql/relational-databases/security/encryption/always-encrypted-enclaves-manage-keys) |
| 146 | + |
| 147 | +## See also |
| 148 | + |
| 149 | +- [Tutorial: Getting started with Always Encrypted with secure enclaves in Azure SQL Database](always-encrypted-enclaves-getting-started.md) |
0 commit comments