mirror of
https://github.com/Microsoft/sql-server-samples.git
synced 2025-12-08 14:58:54 +00:00
Merge pull request #4 from microsoft/master
sync with msft samples repo
This commit is contained in:
Alex Protsenko
+2037
File diff suppressed because one or more lines are too long
+80516
-80516
File diff suppressed because one or more lines are too long
@@ -0,0 +1,3 @@
|
||||
# Security Notebooks
|
||||
1. **TDE_on_Standard.ipynb** - This notebook demonstrates the ability to enable TDE on SQL Server 2019 Standard Edition along with Encryption Scan SUSPEND and RESUME.
|
||||
2. **TDE_on_Standard_EKM.ipynb** - This notebook demonstrates the ability to enable TDE on a SQL Server 2019 Standard Edition using EKM and Azure Key Vault.
|
||||
@@ -0,0 +1,545 @@
|
||||
{
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"name": "SQL",
|
||||
"display_name": "SQL",
|
||||
"language": "sql"
|
||||
},
|
||||
"language_info": {
|
||||
"name": "sql",
|
||||
"version": ""
|
||||
}
|
||||
},
|
||||
"nbformat_minor": 2,
|
||||
"nbformat": 4,
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"# Transparent Database Encryption in SQL Server 2019 Standard Edition\r\n",
|
||||
"SQL Server 2019 will support Transparent Database Encryption to allow customers to encrypt their data-at-rest to stay in compliance with various security regulations while using SQL Server 2019 Standard Edition. More details about this feature can be found [here](https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/transparent-data-encryption?view=sql-server-ver15). Transparent Data Encryption (TDE) encrypts SQL Server, Azure SQL Database, and Azure SQL Data Warehouse data files, known as encrypting data at rest. \r\n",
|
||||
"\r\n",
|
||||
"In this notebook, you will be able to do the following:\r\n",
|
||||
"1. Create a database on SQL Server 2019 Standard Edition\r\n",
|
||||
"2. Enable TDE (Transparent Database Encryption) on the new database\r\n",
|
||||
"3. PAUSE and RESUME encryption scan on the database"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "e65d5868-309c-4711-b41d-bec9b82dd4ff"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"The following code snippet creates a database and enables TDE for the database."
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "f76bfc2b-c433-4c90-b101-cd922f9417dc"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"USE master; \r\n",
|
||||
"GO \r\n",
|
||||
"CREATE MASTER KEY ENCRYPTION BY PASSWORD = '<UseStrongPasswordHere>'; \r\n",
|
||||
"go \r\n",
|
||||
"CREATE CERTIFICATE MyServerCert WITH SUBJECT = 'My DEK Certificate'; \r\n",
|
||||
"go \r\n",
|
||||
"CREATE DATABASE dbTDE\r\n",
|
||||
"GO\r\n",
|
||||
"USE dbTDE; \r\n",
|
||||
"GO \r\n",
|
||||
"CREATE TABLE tblTest (SNO int, val varchar(255));\r\n",
|
||||
"INSERT INTO tblTest VALUES (1, 'TDE Test');\r\n",
|
||||
"GO\r\n",
|
||||
"SELECT name,is_encrypted from sys.databases WHERE name = 'dbTDE';\r\n",
|
||||
"GO\r\n",
|
||||
"CREATE DATABASE ENCRYPTION KEY \r\n",
|
||||
"WITH ALGORITHM = AES_128 \r\n",
|
||||
"ENCRYPTION BY SERVER CERTIFICATE MyServerCert; \r\n",
|
||||
"GO "
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "5cfa7085-36b1-4ba0-931f-5c483bf8934f"
|
||||
},
|
||||
"outputs": [],
|
||||
"execution_count": 0
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"Verify that TDE is enabled on the database.\r\n",
|
||||
"\r\n",
|
||||
"# TDE is NOW available on STANDARD edition"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "2206f6f3-ce98-497c-a54e-5096dbd5a050"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"SELECT SERVERPROPERTY('Edition') as Edition\r\n",
|
||||
" ,name as [Database Name]\r\n",
|
||||
" , CASE is_encrypted WHEN 1 THEN 'YES' ELSE 'NO' END as [Is TDE Enabled]\r\n",
|
||||
"FROM sys.databases;"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "5782646a-4d2b-465c-92f0-1f1e29010575"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "(5 rows affected)"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:00.025"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "execute_result",
|
||||
"metadata": {},
|
||||
"execution_count": 9,
|
||||
"data": {
|
||||
"application/vnd.dataresource+json": {
|
||||
"schema": {
|
||||
"fields": [
|
||||
{
|
||||
"name": "Edition"
|
||||
},
|
||||
{
|
||||
"name": "Database Name"
|
||||
},
|
||||
{
|
||||
"name": "Is TDE Enabled"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data": [
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "master",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "tempdb",
|
||||
"2": "YES"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "model",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "msdb",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "dbTDE",
|
||||
"2": "YES"
|
||||
}
|
||||
]
|
||||
},
|
||||
"text/html": "<table><tr><th>Edition</th><th>Database Name</th><th>Is TDE Enabled</th></tr><tr><td>Standard Edition (64-bit)</td><td>master</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>tempdb</td><td>YES</td></tr><tr><td>Standard Edition (64-bit)</td><td>model</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>msdb</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>dbTDE</td><td>YES</td></tr></table>"
|
||||
}
|
||||
}
|
||||
],
|
||||
"execution_count": 9
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"Now let's disable encryption on the database. As you can see from the output, TDE is disabled on the database."
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "02d7afb6-53fb-4191-92d4-011d60288878"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"ALTER DATABASE dbTDE set ENCRYPTION OFF;\r\n",
|
||||
"WAITFOR DELAY '00:00:15'\r\n",
|
||||
"SELECT SERVERPROPERTY('Edition') as Edition\r\n",
|
||||
" ,name as [Database Name]\r\n",
|
||||
" , CASE is_encrypted WHEN 1 THEN 'YES' ELSE 'NO' END as [Is TDE Enabled]\r\n",
|
||||
"FROM sys.databases;"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "61480886-dc55-407e-96bf-d711b9ca9218"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "(5 rows affected)"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:15.073"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "execute_result",
|
||||
"metadata": {},
|
||||
"execution_count": 10,
|
||||
"data": {
|
||||
"application/vnd.dataresource+json": {
|
||||
"schema": {
|
||||
"fields": [
|
||||
{
|
||||
"name": "Edition"
|
||||
},
|
||||
{
|
||||
"name": "Database Name"
|
||||
},
|
||||
{
|
||||
"name": "Is TDE Enabled"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data": [
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "master",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "tempdb",
|
||||
"2": "YES"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "model",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "msdb",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "dbTDE",
|
||||
"2": "NO"
|
||||
}
|
||||
]
|
||||
},
|
||||
"text/html": "<table><tr><th>Edition</th><th>Database Name</th><th>Is TDE Enabled</th></tr><tr><td>Standard Edition (64-bit)</td><td>master</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>tempdb</td><td>YES</td></tr><tr><td>Standard Edition (64-bit)</td><td>model</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>msdb</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>dbTDE</td><td>NO</td></tr></table>"
|
||||
}
|
||||
}
|
||||
],
|
||||
"execution_count": 10
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"Now let's reenable TDE on the database and pause the encryption scan as soon as it starts."
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "74a81fd3-792d-4544-8b05-2633fc979a7e"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"ALTER DATABASE dbTDE set ENCRYPTION ON;\r\n",
|
||||
"ALTER DATABASE dbTDE SET ENCRYPTION SUSPEND;"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "b92f91a5-7d54-44da-b972-3210e25aa24e"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Commands completed successfully."
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:00.051"
|
||||
},
|
||||
"metadata": {}
|
||||
}
|
||||
],
|
||||
"execution_count": 11
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"The status of the encryption scan should say <b>SUSPENDED</b>"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "246599a5-4a2a-4455-8fdf-5c07f8c7317a"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"SELECT db_name(database_id) as [Database Name]\r\n",
|
||||
"\t, encryption_scan_modify_date\r\n",
|
||||
"\t, encryption_scan_state_desc\r\n",
|
||||
"from sys.dm_database_encryption_keys\r\n",
|
||||
""
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "6d9d9703-a744-4b93-8f2c-e0a429a71dbf"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "(2 rows affected)"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:00.005"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "execute_result",
|
||||
"metadata": {},
|
||||
"execution_count": 14,
|
||||
"data": {
|
||||
"application/vnd.dataresource+json": {
|
||||
"schema": {
|
||||
"fields": [
|
||||
{
|
||||
"name": "Database Name"
|
||||
},
|
||||
{
|
||||
"name": "encryption_scan_modify_date"
|
||||
},
|
||||
{
|
||||
"name": "encryption_scan_state_desc"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data": [
|
||||
{
|
||||
"0": "tempdb",
|
||||
"1": "2019-10-11 04:14:58.997",
|
||||
"2": "COMPLETE"
|
||||
},
|
||||
{
|
||||
"0": "dbTDE",
|
||||
"1": "2019-10-29 22:48:20.150",
|
||||
"2": "SUSPENDED"
|
||||
}
|
||||
]
|
||||
},
|
||||
"text/html": "<table><tr><th>Database Name</th><th>encryption_scan_modify_date</th><th>encryption_scan_state_desc</th></tr><tr><td>tempdb</td><td>2019-10-11 04:14:58.997</td><td>COMPLETE</td></tr><tr><td>dbTDE</td><td>2019-10-29 22:48:20.150</td><td>SUSPENDED</td></tr></table>"
|
||||
}
|
||||
}
|
||||
],
|
||||
"execution_count": 14
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"Let's resume the encryption "
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "7ed73073-d0f3-4bf6-9836-8534422fc765"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"ALTER DATABASE dbTDE SET ENCRYPTION RESUME;"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "57af9c9f-9e4c-4f65-ada4-123f46d2b8ae"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Commands completed successfully."
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:00.012"
|
||||
},
|
||||
"metadata": {}
|
||||
}
|
||||
],
|
||||
"execution_count": 15
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"Check if the encryption is complete"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "563c6218-13c8-4a67-ab29-7a7c5251b501"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"SELECT db_name(database_id) as [Database Name]\r\n",
|
||||
"\t, encryption_scan_modify_date\r\n",
|
||||
"\t, encryption_scan_state_desc\r\n",
|
||||
"FROM sys.dm_database_encryption_keys;\r\n",
|
||||
"\r\n",
|
||||
"SELECT SERVERPROPERTY('Edition') as Edition\r\n",
|
||||
" ,name as [Database Name]\r\n",
|
||||
" , CASE is_encrypted WHEN 1 THEN 'YES' ELSE 'NO' END as [Is TDE Enabled]\r\n",
|
||||
"FROM sys.databases;"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "5b87157b-a1f2-4802-868a-9b76beaa6453"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "(2 rows affected)"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "(5 rows affected)"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:00.036"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "execute_result",
|
||||
"metadata": {},
|
||||
"execution_count": 16,
|
||||
"data": {
|
||||
"application/vnd.dataresource+json": {
|
||||
"schema": {
|
||||
"fields": [
|
||||
{
|
||||
"name": "Database Name"
|
||||
},
|
||||
{
|
||||
"name": "encryption_scan_modify_date"
|
||||
},
|
||||
{
|
||||
"name": "encryption_scan_state_desc"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data": [
|
||||
{
|
||||
"0": "tempdb",
|
||||
"1": "2019-10-11 04:14:58.997",
|
||||
"2": "COMPLETE"
|
||||
},
|
||||
{
|
||||
"0": "dbTDE",
|
||||
"1": "2019-10-29 22:58:34.353",
|
||||
"2": "COMPLETE"
|
||||
}
|
||||
]
|
||||
},
|
||||
"text/html": "<table><tr><th>Database Name</th><th>encryption_scan_modify_date</th><th>encryption_scan_state_desc</th></tr><tr><td>tempdb</td><td>2019-10-11 04:14:58.997</td><td>COMPLETE</td></tr><tr><td>dbTDE</td><td>2019-10-29 22:58:34.353</td><td>COMPLETE</td></tr></table>"
|
||||
}
|
||||
},
|
||||
{
|
||||
"output_type": "execute_result",
|
||||
"metadata": {},
|
||||
"execution_count": 16,
|
||||
"data": {
|
||||
"application/vnd.dataresource+json": {
|
||||
"schema": {
|
||||
"fields": [
|
||||
{
|
||||
"name": "Edition"
|
||||
},
|
||||
{
|
||||
"name": "Database Name"
|
||||
},
|
||||
{
|
||||
"name": "Is TDE Enabled"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data": [
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "master",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "tempdb",
|
||||
"2": "YES"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "model",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "msdb",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "dbTDE",
|
||||
"2": "YES"
|
||||
}
|
||||
]
|
||||
},
|
||||
"text/html": "<table><tr><th>Edition</th><th>Database Name</th><th>Is TDE Enabled</th></tr><tr><td>Standard Edition (64-bit)</td><td>master</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>tempdb</td><td>YES</td></tr><tr><td>Standard Edition (64-bit)</td><td>model</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>msdb</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>dbTDE</td><td>YES</td></tr></table>"
|
||||
}
|
||||
}
|
||||
],
|
||||
"execution_count": 16
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"You should see the following messages in the SQL Server errorlog which shows PAUSE and RESUME for the encryption scan.\r\n",
|
||||
"\r\n",
|
||||
"\r\n",
|
||||
"<i> 2019-10-29 22:32:11.100 spid34s Beginning database encryption scan for database 'dbTDE'. <br>\r\n",
|
||||
"2019-10-29 22:32:11.150 spid34s <font color = \"red\">Database encryption scan for database 'dbTDE' was aborted.</font> Reissue ALTER DB to resume the scan. <br>\r\n",
|
||||
"2019-10-29 22:32:31.730 spid15s <font color =\"red\">Beginning database encryption scan for database 'dbTDE'.</font> <br>\r\n",
|
||||
"2019-10-29 22:32:41.190 spid15s Database encryption scan for database 'dbTDE' is complete. </i> <br>"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "986ce50e-faa9-4f35-8156-8f1cd6fbcb2d"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,462 @@
|
||||
{
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"name": "SQL",
|
||||
"display_name": "SQL",
|
||||
"language": "sql"
|
||||
},
|
||||
"language_info": {
|
||||
"name": "sql",
|
||||
"version": ""
|
||||
}
|
||||
},
|
||||
"nbformat_minor": 2,
|
||||
"nbformat": 4,
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"# SQL Server 2019 Standard Edition, Transparent Database Encryption and Azure Key Vault\r\n",
|
||||
"\r\n",
|
||||
"This notebook demonstrates the use of Azure Key Vault to enable TDE on a SQL Server 2019 Standard Edition database using EKM.\r\n",
|
||||
"\r\n",
|
||||
"**Pre-requisities** \r\n",
|
||||
"1. Install Python\r\n",
|
||||
"2. Install Azure CLI using the following command (You will need to ensure that the Python scripts folder is part of your PATH variable)\r\n",
|
||||
" <br> <code>pip install --user azure-cli</code>\r\n",
|
||||
"3. Log into Azure and create and Azure AD Service Principal\r\n",
|
||||
" <code><br> az login\r\n",
|
||||
" <br> az account set --subscription <-subscription id->\r\n",
|
||||
" <br> az ad sp create-for-rbac -n sqlaadtde --skip-assignment\r\n",
|
||||
" </code>\r\n",
|
||||
" <br> note the <b>appID</b> value which would be required later\r\n",
|
||||
" <code>\r\n",
|
||||
" <br>{\"appId\": \"<-guid->\",\r\n",
|
||||
" <br>\"displayName\": \"sqlaadtde\",\r\n",
|
||||
" <br>\"name\": \"http://sqlaadtde\",\r\n",
|
||||
" <br>\"password\": \"<-guid->\",\r\n",
|
||||
" <br>\"tenant\": \"<-guid->\"}\r\n",
|
||||
" </code>\r\n",
|
||||
"4. Create a new resource group and assign a newly created Azure Key Vault to the same resource group\r\n",
|
||||
" <code>\r\n",
|
||||
" <br> # Create a new resource group\r\n",
|
||||
" <br> az group create -n \"SQLTDEResourceGroup\" -l \"West US\"\r\n",
|
||||
" <br> # Register the Key Vault resource provider\r\n",
|
||||
" <br> az provider register -n Microsoft.KeyVault\r\n",
|
||||
" <br> az keyvault create --name \"SQLStandardKeyVault\" --resource-group \"SQLTDEResourceGroup\" --location \"West US\"\r\n",
|
||||
" </code>\r\n",
|
||||
"5. Register the Azure AD principl with AKV\r\n",
|
||||
" <code>\r\n",
|
||||
" <br> # Register the AAD principal\r\n",
|
||||
" <br> az keyvault set-policy --name \"SQLStandardKeyVault\" --spn <appID GUID from az ad create-for-rbac output> --key-permissions get list wrapKey unwrapKey --verbose\r\n",
|
||||
" </code>\r\n",
|
||||
"\r\n",
|
||||
"Details about the scenario is available [here](https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/setup-steps-for-extensible-key-management-using-the-azure-key-vault?view=sql-server-ver15#next-step)."
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "f28683d2-1f27-42b3-8418-f6747ed878ec"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"### Configure SQL Server to use EKM\r\n",
|
||||
"Download and install the [SQL Server Connector](https://go.microsoft.com/fwlink/p/?LinkId=521700). (This should be done by the administrator of the SQL Server computer.) By default, the connector installs at <b>C:\\Program Files\\SQL Server Connector for Microsoft Azure Key Vault</b>. This location can be changed during setup. (If changed, adjust the scripts below.)\r\n",
|
||||
"<br>There is no interface for the Connector, but if it is installed successfully, the <b>Microsoft.AzureKeyVaultService.EKM.dll</b> is installed on the machine. This is the cryptographic EKM provider DLL that needs to be registered with SQL Server by using the CREATE CRYPTOGRAPHIC PROVIDER statement."
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "c82cb49a-7e5c-419e-b109-da7d2f9defa0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"USE master; \r\n",
|
||||
"GO \r\n",
|
||||
"\r\n",
|
||||
"sp_configure 'show advanced options', 1; \r\n",
|
||||
"GO \r\n",
|
||||
"RECONFIGURE WITH OVERRIDE; \r\n",
|
||||
"GO \r\n",
|
||||
"\r\n",
|
||||
"-- Enable EKM provider \r\n",
|
||||
"sp_configure 'EKM provider enabled', 1; \r\n",
|
||||
"GO \r\n",
|
||||
"RECONFIGURE WITH OVERRIDE; \r\n",
|
||||
"GO"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "4e7af918-31d1-40c2-a193-309672e1c0ef"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Commands completed successfully."
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Configuration option 'show advanced options' changed from 1 to 1. Run the RECONFIGURE statement to install."
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Commands completed successfully."
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Configuration option 'EKM provider enabled' changed from 1 to 1. Run the RECONFIGURE statement to install."
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Commands completed successfully."
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:00.059"
|
||||
},
|
||||
"metadata": {}
|
||||
}
|
||||
],
|
||||
"execution_count": 15
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"### Register (create) the SQL Server Connector as an EKM provider with SQL Server"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "27394b2a-b1da-497b-8c56-8a2fbd1af037"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"-- Create a cryptographic provider, using the SQL Server Connector\r\n",
|
||||
"-- which is an EKM provider for the Azure Key Vault. This example uses \r\n",
|
||||
"-- the name AzureKeyVault_EKM_Prov.\r\n",
|
||||
"\r\n",
|
||||
"CREATE CRYPTOGRAPHIC PROVIDER AzureKeyVault_EKM_Prov \r\n",
|
||||
"FROM FILE = 'C:\\Program Files\\SQL Server Connector for Microsoft Azure Key Vault\\Microsoft.AzureKeyVaultService.EKM.dll';\r\n",
|
||||
"GO \r\n",
|
||||
""
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "3f53701d-b27a-49a8-931e-e3319c1b6386"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Commands completed successfully."
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:00.022"
|
||||
},
|
||||
"metadata": {}
|
||||
}
|
||||
],
|
||||
"execution_count": 16
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"### Create a credential from your AAD Client ID and Secret that you can use to grant a SQL Server account access to your Azure key vault\r\n",
|
||||
"The IDENTITY here is the name of your Azure key vault.\r\n",
|
||||
"<br>The SECRET here is your AAD Client ID (with the hyphens removed) and your AAD Client Secret concatenanted together\r\n",
|
||||
"<br>You will need to create a \"New Client Secret\" for your Azure AD app registration i.e. *sqlaadtde*, which was created above. See steps [here](https://docs.microsoft.com/en-us/azure/healthcare-apis/register-confidential-azure-ad-client-app#application-secret)."
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "e71869f8-0904-4167-8818-c7cb345915c0"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"CREATE CREDENTIAL Azure_EKM_TDE_cred\r\n",
|
||||
" WITH IDENTITY = 'SQLStandardKeyVault', -- for global Azure\r\n",
|
||||
" -- WITH IDENTITY = 'ContosoDevKeyVault.vault.usgovcloudapi.net', -- for Azure Government\r\n",
|
||||
" -- WITH IDENTITY = 'ContosoDevKeyVault.vault.azure.cn', -- for Azure China 21Vianet\r\n",
|
||||
" -- WITH IDENTITY = 'ContosoDevKeyVault.vault.microsoftazure.de', -- for Azure Germany \r\n",
|
||||
"\tSECRET = '<combination of AAD Client ID without hyphens and AAD Client Secret>'\r\n",
|
||||
" FOR CRYPTOGRAPHIC PROVIDER AzureKeyVault_EKM_Prov \r\n",
|
||||
"\r\n",
|
||||
""
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "600cf82f-0488-46da-a253-99146f20065b"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Commands completed successfully."
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:00.012"
|
||||
},
|
||||
"metadata": {}
|
||||
}
|
||||
],
|
||||
"execution_count": 25
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"### Create an Asymmetric Key using the AKV Key\r\n",
|
||||
"You will need to first create a Key in Azure Key Vault which can be used to create the Asymmetric Key in SQL Server\r\n",
|
||||
"<code>\r\n",
|
||||
"<br> # Create a software-protected key \r\n",
|
||||
"<br> az keyvault key create --vault-name \"SQLStandardKeyVault\" --name \"SQLTDEKey\" --protection software\r\n",
|
||||
"</code>"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "ef0ab374-182e-434b-b7d8-050b3a1c481b"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"CREATE ASYMMETRIC KEY dbAKV_Key \r\n",
|
||||
"FROM PROVIDER [AzureKeyVault_EKM_Prov] \r\n",
|
||||
"WITH PROVIDER_KEY_NAME = 'SQLTDEKey', -- This is the KEY that was created in the Azure Key Vault\r\n",
|
||||
"CREATION_DISPOSITION = OPEN_EXISTING;"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "923e5bc8-2751-4286-a0fe-fa37e1af59b0"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Commands completed successfully."
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:00.145"
|
||||
},
|
||||
"metadata": {}
|
||||
}
|
||||
],
|
||||
"execution_count": 27
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"### Now create a database and enable TDE on the database"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "c87fa2c2-1d3f-4dda-a2f9-d320af41486a"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"USE master; \r\n",
|
||||
"-- Create a SQL Server login associated with the asymmetric key \r\n",
|
||||
"-- for the Database engine to use when it loads a database \r\n",
|
||||
"-- encrypted by TDE. \r\n",
|
||||
"CREATE LOGIN TDE_Login \r\n",
|
||||
"FROM ASYMMETRIC KEY dbAKV_Key; \r\n",
|
||||
"GO \r\n",
|
||||
"\r\n",
|
||||
"-- Alter the TDE Login to add the credential for use by the \r\n",
|
||||
"-- Database Engine to access the key vault \r\n",
|
||||
"ALTER LOGIN TDE_Login \r\n",
|
||||
"ADD CREDENTIAL Azure_EKM_TDE_cred ; \r\n",
|
||||
"GO\r\n",
|
||||
"\r\n",
|
||||
"CREATE DATABASE dbAKVTDE;\r\n",
|
||||
"GO \r\n",
|
||||
"USE dbAKVTDE;\r\n",
|
||||
"GO\r\n",
|
||||
"\r\n",
|
||||
"CREATE DATABASE ENCRYPTION KEY \r\n",
|
||||
"WITH ALGORITHM = AES_256 \r\n",
|
||||
"ENCRYPTION BY SERVER ASYMMETRIC KEY dbAKV_Key; -- Use the key created above\r\n",
|
||||
"GO \r\n",
|
||||
"\r\n",
|
||||
"-- Alter the database to enable transparent data encryption. \r\n",
|
||||
"ALTER DATABASE dbAKVTDE \r\n",
|
||||
"SET ENCRYPTION ON; \r\n",
|
||||
"GO "
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "ee35f210-c356-4018-8994-057d16273b3a"
|
||||
},
|
||||
"outputs": [],
|
||||
"execution_count": 30
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"## Check if the database has been encrypted"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "6b8f4ad6-4998-4c0f-8fe5-f1a23d95055f"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"USE MASTER \r\n",
|
||||
"SELECT name,provider_type, algorithm_desc FROM sys.asymmetric_keys \r\n",
|
||||
"\r\n",
|
||||
"-- Check which databases are encrypted using TDE \r\n",
|
||||
"SELECT SERVERPROPERTY('Edition') as [Edition],d.name, dek.encryption_scan_state_desc, dek.encryptor_type \r\n",
|
||||
"FROM sys.dm_database_encryption_keys AS dek \r\n",
|
||||
"JOIN sys.databases AS d \r\n",
|
||||
" ON dek.database_id = d.database_id;"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "557fb1b5-7058-4888-986e-1ef2c03a1ab9"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "(1 row affected)"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "(3 rows affected)"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:00.048"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "execute_result",
|
||||
"metadata": {},
|
||||
"execution_count": 36,
|
||||
"data": {
|
||||
"application/vnd.dataresource+json": {
|
||||
"schema": {
|
||||
"fields": [
|
||||
{
|
||||
"name": "name"
|
||||
},
|
||||
{
|
||||
"name": "provider_type"
|
||||
},
|
||||
{
|
||||
"name": "algorithm_desc"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data": [
|
||||
{
|
||||
"0": "dbAKV_Key",
|
||||
"1": "CRYPTOGRAPHIC PROVIDER",
|
||||
"2": "RSA_2048"
|
||||
}
|
||||
]
|
||||
},
|
||||
"text/html": "<table><tr><th>name</th><th>provider_type</th><th>algorithm_desc</th></tr><tr><td>dbAKV_Key</td><td>CRYPTOGRAPHIC PROVIDER</td><td>RSA_2048</td></tr></table>"
|
||||
}
|
||||
},
|
||||
{
|
||||
"output_type": "execute_result",
|
||||
"metadata": {},
|
||||
"execution_count": 36,
|
||||
"data": {
|
||||
"application/vnd.dataresource+json": {
|
||||
"schema": {
|
||||
"fields": [
|
||||
{
|
||||
"name": "Edition"
|
||||
},
|
||||
{
|
||||
"name": "name"
|
||||
},
|
||||
{
|
||||
"name": "encryption_scan_state_desc"
|
||||
},
|
||||
{
|
||||
"name": "encryptor_type"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data": [
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "tempdb",
|
||||
"2": "COMPLETE",
|
||||
"3": "ASYMMETRIC KEY"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "dbTDE",
|
||||
"2": "COMPLETE",
|
||||
"3": "CERTIFICATE"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "dbAKVTDE",
|
||||
"2": "COMPLETE",
|
||||
"3": "ASYMMETRIC KEY"
|
||||
}
|
||||
]
|
||||
},
|
||||
"text/html": "<table><tr><th>Edition</th><th>name</th><th>encryption_scan_state_desc</th><th>encryptor_type</th></tr><tr><td>Standard Edition (64-bit)</td><td>tempdb</td><td>COMPLETE</td><td>ASYMMETRIC KEY</td></tr><tr><td>Standard Edition (64-bit)</td><td>dbTDE</td><td>COMPLETE</td><td>CERTIFICATE</td></tr><tr><td>Standard Edition (64-bit)</td><td>dbAKVTDE</td><td>COMPLETE</td><td>ASYMMETRIC KEY</td></tr></table>"
|
||||
}
|
||||
}
|
||||
],
|
||||
"execution_count": 36
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"# Best Practices\r\n",
|
||||
"To ensure quick key recovery and be able to access your data outside of Azure, we recommend the following best practices:\r\n",
|
||||
"<br> a. Create your encryption key locally on a local HSM device. (Make sure this is an asymmetric, RSA 2048 key so it's is supported by SQL Server.)\r\n",
|
||||
"<br> b. Import the encryption key to Azure Key Vault. See the steps in this [article](https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/setup-steps-for-extensible-key-management-using-the-azure-key-vault?view=sql-server-ver15#part-ii-create-a-key-vault-and-key) on how to do that.\r\n",
|
||||
"<br> c. Before using the key in Azure Key Vault for the first time, take an Azure Key Vault key backup. Learn more about the <b>Backup-AzureKeyVaultKey</b> command.\r\n",
|
||||
"Whenever any changes are made to the key (for example add ACLs, add tags, add key attributes), be sure to take another Azure Key Vault key backup.\r\n",
|
||||
"\r\n",
|
||||
"## Types of keys\r\n",
|
||||
"There are two types of keys you can generate in Azure Key Vault that will work with SQL Server. Both are asymmetric 2048-bit RSA keys.\r\n",
|
||||
"<br><b>Software-protected</b>: Processed in software and encrypted at rest. Operations on software-protected keys occur on Azure Virtual Machines. Recommended for keys not used in a production deployment.\r\n",
|
||||
"<br><b>HSM-protected</b>: Created and protected by a hardware security module (HSM) for additional security.\r\n",
|
||||
"\r\n",
|
||||
"For common troubleshooting and maintenance of the SQL Server Connector, please refer to [this article](https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/sql-server-connector-maintenance-troubleshooting?view=sql-server-ver15)."
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "b74a3595-b2e9-4952-8e2a-c5876f740b70"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -24,5 +24,8 @@ In this example, we will deploy Kubernetes over multiple Linux machines (physica
|
||||
1. Execute [setup-k8s-master.sh](setup-k8s-master.sh/) script on the machine designated as Kubernetes master (_not_ under sudo su as otherwise you'll setup K8S .kube/config permissions for root)
|
||||
1. After successful initialization of the Kubernetes master, follow the kubeadm join commands output by the setup script on each agent machine
|
||||
1. Execute [setup-volumes-agent.sh](setup-volumes-agent.sh/) script on each agent machine to create volumes for local storage
|
||||
1. Execute ***kubectl apply -f local-storage-provisioner.yaml*** against the Kubernetes cluster to create the local storage provisioner.
|
||||
1. Now, you can deploy the SQL Server 2019 big data cluster following instructions [here](https://docs.microsoft.com/en-us/sql/big-data-cluster/deployment-guidance?view=sqlallproducts-allversions)
|
||||
1. Execute ***kubectl apply -f local-storage-provisioner.yaml*** against the Kubernetes cluster to create the local storage provisioner. This will create a Storage Class named "local-storage".
|
||||
1. Now, you can deploy the SQL Server 2019 big data cluster following instructions [here](https://docs.microsoft.com/en-us/sql/big-data-cluster/deployment-guidance?view=sqlallproducts-allversions).
|
||||
Simply type in "local-storage" twice (once for data, once for logs) when facing the following prompt by azdata :
|
||||
|
||||
`Kubernetes Storage Class - Config Path: spec.storage.data.className - Description: This indicates the name of the Kubernetes Storage Class to use. You must pre-provision the storage class and the persistent volumes or you can use a built in storage class if the platform you are deploying provides this capability. - Please provide a value:`
|
||||
|
||||
@@ -7,5 +7,7 @@ for i in $(seq 1 $PV_COUNT); do
|
||||
vol="vol$i"
|
||||
|
||||
mkdir -p /mnt/local-storage/$vol
|
||||
# If wondering why the next code line is needed, see https://github.com/kubernetes-sigs/sig-storage-local-static-provisioner/blob/master/docs/faqs.md#why-i-need-to-bind-mount-normal-directories-to-create-pvs-for-them
|
||||
# Experience showed that the mount need to exist at cluster provision time. The fact they're not put in fstab and will disappear after reboot doesn't seem to be an issue once the K8S PV are created.
|
||||
mount --bind /mnt/local-storage/$vol /mnt/local-storage/$vol
|
||||
done
|
||||
|
||||
@@ -4,5 +4,22 @@ In this folder, you will find various notebooks that you can use in [Azure Data
|
||||
The [What's New](https://docs.microsoft.com/en-us/sql/sql-server/what-s-new-in-sql-server-ver15?view=sql-server-ver15) article covers all the *NEW* features in SQL Server 2019.
|
||||
|
||||
## Notebook List
|
||||
1. Intelligent Query Processing
|
||||
* Scalar UDF Inlining
|
||||
### Intelligent Query Processing
|
||||
* **[Scalar_UDF_Inlining.ipynb](https://github.com/microsoft/sql-server-samples/blob/master/samples/features/intelligent-query-processing/notebooks/Scalar_UDF_Inlining.ipynb)** - This notebook demonstrates the benefits of Scalar UDF Inlining along with how to find out which UDFs in your database can be inlined.
|
||||
* **[IQP_tablevariabledeferred.ipynb](https://github.com/microsoft/sqlworkshops/blob/master/sql2019lab/01_IntelligentPerformance/iqp/iqp_tablevariabledeferred.ipynb)** - In this example, you will learn about the new cardinality estimation for table variables called deferred compilation.
|
||||
* **[Batch_Mode_on_Rowstore.ipynb](https://github.com/microsoft/sql-server-samples/blob/master/samples/features/intelligent-query-processing/notebooks/Batch_Mode_on_Rowstore.ipynb)** - In this notebook, you will learn about how Batch Mode for Rowstore can help execute queries faster on SQL Server 2019.
|
||||
|
||||
### Security
|
||||
* **[TDE_on_Standard.ipynb](https://github.com/microsoft/sql-server-samples/blob/master/samples/features/security/tde-sql2019-standard/TDE_on_Standard.ipynb)** - This notebook demonstrates the ability to enable TDE on SQL Server 2019 Standard Edition along with Encryption Scan SUSPEND and RESUME.
|
||||
* **[TDE_on_Standard_EKM.ipynb](https://github.com/microsoft/sql-server-samples/blob/master/samples/features/security/tde-sql2019-standard/TDE_on_Standard_EKM.ipynb)** - This notebook demonstrates the ability to enable TDE on a SQL Server 2019 Standard Edition using EKM and Azure Key Vault.
|
||||
|
||||
### In-Memory Database
|
||||
* **[MemoryOptimizedTempDBMetadata-TSQL.ipynb](https://github.com/microsoft/sql-server-samples/blob/master/samples/features/in-memory-database/memory-optimized-tempdb-metadata/MemoryOptimizedTempDBMetadata-TSQL.ipynb)** - This is a T-SQL notebook which shows the benefits of Memory Optimized Tempdb metadata.
|
||||
* **[MemoryOptmizedTempDBMetadata-Python.ipynb](https://github.com/microsoft/sql-server-samples/blob/master/samples/features/in-memory-database/memory-optimized-tempdb-metadata/MemoryOptmizedTempDBMetadata-Python.ipynb)** - This is a Python notebook which shows the benefits of Memory Optimized Tempdb metadata.
|
||||
|
||||
### Availability
|
||||
* **[Basic_ADR.ipynb](https://github.com/microsoft/sqlworkshops/blob/master/sql2019workshop/sql2019wks/04_Availability/adr/basic_adr.ipynb)** - In this notebook, you will see how fast rollback can now be with Accelerated Database Recovery. You will also see that a long active transaction does not affect the ability to truncate the transaction log.
|
||||
* **[Recovery_ADR.ipynb](https://github.com/microsoft/sqlworkshops/blob/master/sql2019workshop/sql2019wks/04_Availability/adr/recovery_adr.ipynb)** - In this example, you will see how Accelerated Database Recovery will speed up recovery.
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -1,4 +0,0 @@
|
||||
# Intelligent Query Processing Demos
|
||||
|
||||
## Notebook List
|
||||
- Scalar UDF Inlining
|
||||
+24
-3
@@ -1,12 +1,12 @@
|
||||
declare @db_name sysname = 'master'
|
||||
USE <database_name, , > --> put the database name here like WideWorldImporters
|
||||
|
||||
begin
|
||||
declare @result NVARCHAR(MAX);
|
||||
set @result = (select compatibility_level, recovery_model_desc, snapshot_isolation_state_desc, is_read_committed_snapshot_on,
|
||||
set @result = (select database_name = name, compatibility_level, recovery_model_desc, snapshot_isolation_state_desc, is_read_committed_snapshot_on,
|
||||
is_auto_update_stats_on, is_auto_update_stats_async_on, delayed_durability_desc,
|
||||
is_encrypted, is_auto_create_stats_incremental_on, is_arithabort_on, is_ansi_warnings_on, is_parameterization_forced
|
||||
from sys.databases
|
||||
where name = @db_name
|
||||
where name = db_name()
|
||||
for xml raw('db'), elements);
|
||||
set @result += (select compatibility_level, snapshot_isolation_state_desc, is_read_committed_snapshot_on,
|
||||
is_auto_update_stats_on, is_auto_update_stats_async_on, delayed_durability_desc,
|
||||
@@ -53,6 +53,8 @@ where name in ('cost threshold for parallelism','cursor threshold','fill factor
|
||||
for xml raw, elements
|
||||
);
|
||||
set @result += (select name = 'version', value = @@VERSION for xml raw, elements)
|
||||
set @result += (select name = 'script version', value = '1.0' for xml raw, elements)
|
||||
set @result += (select name = 'date', value = GETUTCDATE() for xml raw, elements)
|
||||
|
||||
set @result += isnull
|
||||
((SELECT scheduler_count, scheduler_total_count FROM sys.dm_os_sys_info
|
||||
@@ -67,6 +69,25 @@ isnull((SELECT name = REPLACE([type], 'MEMORYCLERK_', 'MEMORY:')
|
||||
HAVING sum(pages_kb) /1024. /1024 > 1
|
||||
for xml raw, elements),'');
|
||||
|
||||
set @result +=
|
||||
isnull((
|
||||
select name = 'INDEX:'+schema_name(schema_id)+'.'+object_name(t.object_id)+'.'+ix.name,
|
||||
value = concat(ix.type_desc COLLATE SQL_Latin1_General_CP1_CI_AS,
|
||||
'/disabled:',is_disabled,'/row_locks:',allow_row_locks,'/page_locks:',allow_page_locks,'/filter:',filter_definition,'/compression_delay:',compression_delay)
|
||||
from sys.indexes ix
|
||||
join sys.tables t on t.object_id = ix.object_id
|
||||
where ix.type <> 0
|
||||
for xml raw, elements),'');
|
||||
|
||||
set @result +=
|
||||
isnull((
|
||||
select name = 'JOB::'+j.name + '/' + s.step_name,
|
||||
value = subsystem
|
||||
from msdb.dbo.sysjobs j
|
||||
join msdb.dbo.sysjobsteps s on j.job_id = s.job_id
|
||||
for xml raw, elements),'');
|
||||
|
||||
|
||||
select cast(@result as xml);
|
||||
|
||||
end;
|
||||
|
||||
Reference in New Issue
Block a user