Skip to content

Commit dff835c

Browse files
atikmapariatikmapari
authored
Merge pull request #5 from MicrosoftDocs/master
Sync with master
2 parents 708ed6d + cd70942 commit dff835c

44 files changed

Lines changed: 1786 additions & 213 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎azure-sql/database/always-encrypted-enclaves-configure-attestation.md‎

Lines changed: 149 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,149 @@
1+
---
2+
title: "Configure Azure Attestation for your Azure SQL logical server"
3+
description: "Configure Azure Attestation for Always Encrypted with secure enclaves in Azure SQL Database."
4+
keywords: encrypt data, sql encryption, database encryption, sensitive data, Always Encrypted, secure enclaves, SGX, attestation
5+
services: sql-database
6+
ms.service: sql-database
7+
ms.subservice: security
8+
ms.devlang:
9+
ms.topic: how-to
10+
author: jaszymas
11+
ms.author: jaszymas
12+
ms.reviwer: vanto
13+
ms.date: 01/15/2021
14+
---
15+
16+
# Configure Azure Attestation for your Azure SQL logical server
17+
18+
[!INCLUDE[appliesto-sqldb](../includes/appliesto-sqldb.md)]
19+
20+
> [!NOTE]
21+
> Always Encrypted with secure enclaves for Azure SQL Database is currently in **public preview**.
22+
23+
[Microsoft Azure Attestation](../../attestation/overview.md) is a solution for attesting Trusted Execution Environments (TEEs), including Intel Software Guard Extensions (Intel SGX) enclaves.
24+
25+
To use Azure Attestation for attesting Intel SGX enclaves used for [Always Encrypted with secure enclaves](https://docs.microsoft.com/sql/relational-databases/security/encryption/always-encrypted-enclaves) in Azure SQL Database, you need to:
26+
27+
1. Create an [attestation provider](../../attestation/basic-concepts.md#attestation-provider) and configure it with the recommended attestation policy.
28+
29+
2. Grant your Azure SQL logical server access to your attestation provider.
30+
31+
> [!NOTE]
32+
> Configuring attestation is the responsibility of the attestation administrator. See [Roles and responsibilities when configuring SGX enclaves and attestation](always-encrypted-enclaves-plan.md#roles-and-responsibilities-when-configuring-sgx-enclaves-and-attestation).
33+
34+
## Requirements
35+
36+
The Azure SQL logical server and the attestation provider must belong to the same Azure Active Directory tenant. Cross-tenant interactions aren't supported.
37+
38+
The Azure SQL logical server must have an Azure AD identity assigned to it. As the attestation administrator you need to obtain the Azure AD identity of the server from the Azure SQL Database administrator for that server. You will use the identity to grant the server access to the attestation provider.
39+
40+
For instructions on how to create a server with an identity or assign an identity to an existing server using PowerShell and Azure CLI, see [Assign an Azure AD identity to your server](transparent-data-encryption-byok-configure.md#assign-an-azure-active-directory-azure-ad-identity-to-your-server).
41+
42+
## Create and configure an attestation provider
43+
44+
An [attestation provider](../../attestation/basic-concepts.md#attestation-provider) is a resource in Azure Attestation that evaluates [attestation requests](../../attestation/basic-concepts.md#attestation-request) against [attestation policies](../../attestation/basic-concepts.md#attestation-request) and issues [attestation tokens](../../attestation/basic-concepts.md#attestation-token).
45+
46+
Attestation policies are specified using the [claim rule grammar](../../attestation/claim-rule-grammar.md).
47+
48+
Microsoft recommends the following policy for attesting Intel SGX enclaves used for Always Encrypted in Azure SQL Database:
49+
50+
```output
51+
version= 1.0;
52+
authorizationrules
53+
{
54+
[ type=="x-ms-sgx-is-debuggable", value==false ]
55+
&& [ type=="x-ms-sgx-product-id", value==4639 ]
56+
&& [ type=="x-ms-sgx-svn", value>= 0 ]
57+
&& [ type=="x-ms-sgx-mrsigner", value=="e31c9e505f37a58de09335075fc8591254313eb20bb1a27e5443cc450b6e33e5"]
58+
=> permit();
59+
};
60+
```
61+
62+
The above policy verifies:
63+
64+
- The enclave inside Azure SQL Database doesn't support debugging (which would reduce the level of protection the enclave provides).
65+
- The product ID of the library inside the enclave is the product ID assigned to Always Encrypted with secure enclaves (4639).
66+
- The version ID (svn) of the library is greater than 0.
67+
- The library in the enclave has been signed using the Microsoft signing key (the value of the x-ms-sgx-mrsigner claim is the hash of the signing key).
68+
69+
> [!IMPORTANT]
70+
> An attestation provider gets created with the default policy for Intel SGX enclaves, which does not validate the code running inside the enclave. Microsoft strongly advises you set the above recommended policy, and not use the default policy, for Always Encrypted with secure enclaves.
71+
72+
For instructions for how to create an attestation provider and configure with an attestation policy using:
73+
74+
- [Quickstart: Set up Azure Attestation with Azure portal](../../attestation/quickstart-portal.md)
75+
> [!IMPORTANT]
76+
> When you configure your attestation policy with Azure portal, set Attestation Type to `SGX-IntelSDK`.
77+
- [Quickstart: Set up Azure Attestation with Azure PowerShell](../../attestation/quickstart-powershell.md)
78+
> [!IMPORTANT]
79+
> When you configure your attestation policy with Azure PowerShell, set the `Tee` parameter to `SgxEnclave`.
80+
- [Quickstart: Set up Azure Attestation with Azure CLI](../../attestation/quickstart-azure-cli.md)
81+
> [!IMPORTANT]
82+
> When you configure your attestation policy with Azure CLI, set the `attestation-type` parameter to `SGX-IntelSDK`.
83+
84+
## Determine the attestation URL for your attestation policy
85+
86+
After you've configured an attestation policy, you need to share the attestation URL, referencing the policy, administrators of applications that use Always Encrypted with secure enclaves in Azure SQL Database. Application administrators or/and application users will need to configure their apps with the attestation URL, so that they can run statements that use secure enclaves.
87+
88+
### Use PowerShell to determine the attestation URL
89+
90+
Use the following script to determine your attestation URL:
91+
92+
```powershell
93+
$attestationProvider = Get-AzAttestation -Name $attestationProviderName -ResourceGroupName $attestationResourceGroupName
94+
$attestationUrl = $attestationProvider.AttestUri + “/attest/SgxEnclave”
95+
Write-Host "Your attestation URL is: " $attestationUrl
96+
```
97+
98+
### Use Azure portal to determine the attestation URL
99+
100+
1. In the Overview pane for your attestation provider, copy the value of the Attest URI property to clipboard. An Attest URI should look like this: `https://MyAttestationProvider.us.attest.azure.net`.
101+
102+
2. Append the following to the Attest URI: `/attest/SgxEnclave`.
103+
104+
The resulting attestation URL should look like this: `https://MyAttestationProvider.us.attest.azure.net/attest/SgxEnclave`
105+
106+
## Grant your Azure SQL logical server access to your attestation provider
107+
108+
During the attestation workflow, the Azure SQL logical server containing your database calls the attestation provider to submit an attestation request. For the Azure SQL logical server to be able to submit attestation requests, the server must have a permission for the `Microsoft.Attestation/attestationProviders/attestation/read` action on the attestation provider. The recommended way to grant the permission is for the administrator of the attestation provider to assign the Azure AD identity of the server to the Attestation Reader role for the attestation provider, or its containing resource group.
109+
110+
### Use Azure portal to assign permission
111+
112+
To assign the identity of an Azure SQL server to the Attestation Reader role for an attestation provider, follow the general instructions in [Add or remove Azure role assignments using the Azure portal](https://docs.microsoft.com/azure/role-based-access-control/role-assignments-portal). When you are in the **Add role assignment** pane:
113+
114+
1. In the **Role** drop-down, select the **Attestation Reader** role.
115+
1. In the **Select** field, enter the name of your Azure SQL server to search for it.
116+
117+
See the below screenshot for an example.
118+
119+
![attestation reader role assignment](./media/always-encrypted-enclaves/attestation-provider-role-assigment.png)
120+
121+
> [!NOTE]
122+
> For a server to show up in the **Add role assignment** pane, the server must have an Azure AD identity assigned - see [Requirements](#requirements).
123+
124+
### Use PowerShell to assign permission
125+
126+
1. Find your Azure SQL logical server.
127+
128+
```powershell
129+
$serverResourceGroupName = "<server resource group name>"
130+
$serverName = "<server name>"
131+
$server = Get-AzSqlServer -ServerName $serverName -ResourceGroupName
132+
```
133+
134+
2. Assign the server to the Attestation Reader role for the resource group containing your attestation provider.
135+
136+
```powershell
137+
$attestationResourceGroupName = "<attestation provider resource group name>"
138+
New-AzRoleAssignment -ObjectId $server.Identity.PrincipalId -RoleDefinitionName "Attestation Reader" -ResourceGroupName $attestationResourceGroupName
139+
```
140+
141+
For more information, see [Add or remove Azure role assignments using Azure PowerShell](https://docs.microsoft.com/azure/role-based-access-control/role-assignments-powershell#add-a-role-assignment).
142+
143+
## Next Steps
144+
145+
- [Manage keys for Always Encrypted with secure enclaves](https://docs.microsoft.com/sql/relational-databases/security/encryption/always-encrypted-enclaves-manage-keys)
146+
147+
## See also
148+
149+
- [Tutorial: Getting started with Always Encrypted with secure enclaves in Azure SQL Database](always-encrypted-enclaves-getting-started.md)

‎azure-sql/database/always-encrypted-enclaves-enable-sgx.md‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
---
2+
title: "Enable Intel SGX for your Azure SQL Database"
3+
description: "Learn how to enable Intel SGX for Always Encrypted with secure enclaves in Azure SQL Database by selecting an SGX-enabled hardware generation."
4+
keywords: encrypt data, sql encryption, database encryption, sensitive data, Always Encrypted, secure enclaves, SGX, attestation
5+
services: sql-database
6+
ms.service: sql-database
7+
ms.subservice: security
8+
ms.devlang:
9+
ms.topic: conceptual
10+
author: jaszymas
11+
ms.author: jaszymas
12+
ms.reviwer: vanto
13+
ms.date: 01/15/2021
14+
---
15+
# Enable Intel SGX for your Azure SQL Database
16+
17+
[!INCLUDE[appliesto-sqldb](../includes/appliesto-sqldb.md)]
18+
19+
> [!NOTE]
20+
> Always Encrypted with secure enclaves for Azure SQL Database is currently in **public preview**.
21+
22+
[Always Encrypted with secure enclaves](https://docs.microsoft.com/sql/relational-databases/security/encryption/always-encrypted-enclaves) in Azure SQL Database uses [Intel Software Guard Extensions (Intel SGX)](https://itpeernetwork.intel.com/microsoft-azure-confidential-computing/) enclaves. For Intel SGX to be available, the database must use the [vCore model](service-tiers-vcore.md) and the [DC-series](service-tiers-vcore.md#dc-series) hardware generation.
23+
24+
Configuring the DC-series hardware generation to enable Intel SGX enclaves is the responsibility of the Azure SQL Database administrator. See [Roles and responsibilities when configuring SGX enclaves and attestation](always-encrypted-enclaves-plan.md#roles-and-responsibilities-when-configuring-sgx-enclaves-and-attestation).
25+
26+
> [!NOTE]
27+
> Intel SGX is not available in hardware generations other than DC-series. For example, Intel SGX is not available for Gen5 hardware, and it is not available for databases using the [DTU model](service-tiers-dtu.md).
28+
29+
> [!IMPORTANT]
30+
> Before you configure the DC-series hardware generation for your database, check the regional availability of DC-series and make sure you understand its performance limitations. For more information, see [DC-series](service-tiers-vcore.md#dc-series).
31+
32+
For detailed instructions for how to configure a new or existing database to use a specific hardware generation, see [Selecting a hardware generation](service-tiers-vcore.md#selecting-a-hardware-generation).
33+
34+
## Next steps
35+
36+
- [Configure Azure Attestation for your Azure SQL database server](always-encrypted-enclaves-configure-attestation.md)
37+
38+
## See also
39+
40+
- [Tutorial: Getting started with Always Encrypted with secure enclaves in Azure SQL Database](always-encrypted-enclaves-getting-started.md)

0 commit comments

Comments
 (0)