mirror of
https://github.com/Microsoft/sql-server-samples.git
synced 2025-12-08 14:58:54 +00:00
Adding TDE on Standard Notebook
Adding Notebook for TDE on Standard Notebook
This commit is contained in:
Amit Banerjee
@@ -0,0 +1,545 @@
|
||||
{
|
||||
"metadata": {
|
||||
"kernelspec": {
|
||||
"name": "SQL",
|
||||
"display_name": "SQL",
|
||||
"language": "sql"
|
||||
},
|
||||
"language_info": {
|
||||
"name": "sql",
|
||||
"version": ""
|
||||
}
|
||||
},
|
||||
"nbformat_minor": 2,
|
||||
"nbformat": 4,
|
||||
"cells": [
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"# Transparent Database Encryption in SQL Server 2019 Standard Edition\r\n",
|
||||
"SQL Server 2019 will support Transparent Database Encryption to allow customers to encrypt their data-at-rest to stay in compliance with various security regulations while using SQL Server 2019 Standard Edition. More details about this feature can be found [here](https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/transparent-data-encryption?view=sql-server-ver15). Transparent Data Encryption (TDE) encrypts SQL Server, Azure SQL Database, and Azure SQL Data Warehouse data files, known as encrypting data at rest. \r\n",
|
||||
"\r\n",
|
||||
"In this notebook, you will be able to do the following:\r\n",
|
||||
"1. Create a database on SQL Server 2019 Standard Edition\r\n",
|
||||
"2. Enable TDE (Transparent Database Encryption) on the new database\r\n",
|
||||
"3. PAUSE and RESUME encryption scan on the database"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "e65d5868-309c-4711-b41d-bec9b82dd4ff"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"The following code snippet creates a database and enables TDE for the database."
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "f76bfc2b-c433-4c90-b101-cd922f9417dc"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"USE master; \r\n",
|
||||
"GO \r\n",
|
||||
"CREATE MASTER KEY ENCRYPTION BY PASSWORD = '<UseStrongPasswordHere>'; \r\n",
|
||||
"go \r\n",
|
||||
"CREATE CERTIFICATE MyServerCert WITH SUBJECT = 'My DEK Certificate'; \r\n",
|
||||
"go \r\n",
|
||||
"CREATE DATABASE dbTDE\r\n",
|
||||
"GO\r\n",
|
||||
"USE dbTDE; \r\n",
|
||||
"GO \r\n",
|
||||
"CREATE TABLE tblTest (SNO int, val varchar(255));\r\n",
|
||||
"INSERT INTO tblTest VALUES (1, 'TDE Test');\r\n",
|
||||
"GO\r\n",
|
||||
"SELECT name,is_encrypted from sys.databases WHERE name = 'dbTDE';\r\n",
|
||||
"GO\r\n",
|
||||
"CREATE DATABASE ENCRYPTION KEY \r\n",
|
||||
"WITH ALGORITHM = AES_128 \r\n",
|
||||
"ENCRYPTION BY SERVER CERTIFICATE MyServerCert; \r\n",
|
||||
"GO "
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "5cfa7085-36b1-4ba0-931f-5c483bf8934f"
|
||||
},
|
||||
"outputs": [],
|
||||
"execution_count": 0
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"Verify that TDE is enabled on the database.\r\n",
|
||||
"\r\n",
|
||||
"# TDE is NOW available on STANDARD edition"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "2206f6f3-ce98-497c-a54e-5096dbd5a050"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"SELECT SERVERPROPERTY('Edition') as Edition\r\n",
|
||||
" ,name as [Database Name]\r\n",
|
||||
" , CASE is_encrypted WHEN 1 THEN 'YES' ELSE 'NO' END as [Is TDE Enabled]\r\n",
|
||||
"FROM sys.databases;"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "5782646a-4d2b-465c-92f0-1f1e29010575"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "(5 rows affected)"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:00.025"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "execute_result",
|
||||
"metadata": {},
|
||||
"execution_count": 9,
|
||||
"data": {
|
||||
"application/vnd.dataresource+json": {
|
||||
"schema": {
|
||||
"fields": [
|
||||
{
|
||||
"name": "Edition"
|
||||
},
|
||||
{
|
||||
"name": "Database Name"
|
||||
},
|
||||
{
|
||||
"name": "Is TDE Enabled"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data": [
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "master",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "tempdb",
|
||||
"2": "YES"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "model",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "msdb",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "dbTDE",
|
||||
"2": "YES"
|
||||
}
|
||||
]
|
||||
},
|
||||
"text/html": "<table><tr><th>Edition</th><th>Database Name</th><th>Is TDE Enabled</th></tr><tr><td>Standard Edition (64-bit)</td><td>master</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>tempdb</td><td>YES</td></tr><tr><td>Standard Edition (64-bit)</td><td>model</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>msdb</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>dbTDE</td><td>YES</td></tr></table>"
|
||||
}
|
||||
}
|
||||
],
|
||||
"execution_count": 9
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"Now let's disable encryption on the database. As you can see from the output, TDE is disabled on the database."
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "02d7afb6-53fb-4191-92d4-011d60288878"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"ALTER DATABASE dbTDE set ENCRYPTION OFF;\r\n",
|
||||
"WAITFOR DELAY '00:00:15'\r\n",
|
||||
"SELECT SERVERPROPERTY('Edition') as Edition\r\n",
|
||||
" ,name as [Database Name]\r\n",
|
||||
" , CASE is_encrypted WHEN 1 THEN 'YES' ELSE 'NO' END as [Is TDE Enabled]\r\n",
|
||||
"FROM sys.databases;"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "61480886-dc55-407e-96bf-d711b9ca9218"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "(5 rows affected)"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:15.073"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "execute_result",
|
||||
"metadata": {},
|
||||
"execution_count": 10,
|
||||
"data": {
|
||||
"application/vnd.dataresource+json": {
|
||||
"schema": {
|
||||
"fields": [
|
||||
{
|
||||
"name": "Edition"
|
||||
},
|
||||
{
|
||||
"name": "Database Name"
|
||||
},
|
||||
{
|
||||
"name": "Is TDE Enabled"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data": [
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "master",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "tempdb",
|
||||
"2": "YES"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "model",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "msdb",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "dbTDE",
|
||||
"2": "NO"
|
||||
}
|
||||
]
|
||||
},
|
||||
"text/html": "<table><tr><th>Edition</th><th>Database Name</th><th>Is TDE Enabled</th></tr><tr><td>Standard Edition (64-bit)</td><td>master</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>tempdb</td><td>YES</td></tr><tr><td>Standard Edition (64-bit)</td><td>model</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>msdb</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>dbTDE</td><td>NO</td></tr></table>"
|
||||
}
|
||||
}
|
||||
],
|
||||
"execution_count": 10
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"Now let's reenable TDE on the database and pause the encryption scan as soon as it starts."
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "74a81fd3-792d-4544-8b05-2633fc979a7e"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"ALTER DATABASE dbTDE set ENCRYPTION ON;\r\n",
|
||||
"ALTER DATABASE dbTDE SET ENCRYPTION SUSPEND;"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "b92f91a5-7d54-44da-b972-3210e25aa24e"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Commands completed successfully."
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:00.051"
|
||||
},
|
||||
"metadata": {}
|
||||
}
|
||||
],
|
||||
"execution_count": 11
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"The status of the encryption scan should say <b>SUSPENDED</b>"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "246599a5-4a2a-4455-8fdf-5c07f8c7317a"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"SELECT db_name(database_id) as [Database Name]\r\n",
|
||||
"\t, encryption_scan_modify_date\r\n",
|
||||
"\t, encryption_scan_state_desc\r\n",
|
||||
"from sys.dm_database_encryption_keys\r\n",
|
||||
""
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "6d9d9703-a744-4b93-8f2c-e0a429a71dbf"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "(2 rows affected)"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:00.005"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "execute_result",
|
||||
"metadata": {},
|
||||
"execution_count": 14,
|
||||
"data": {
|
||||
"application/vnd.dataresource+json": {
|
||||
"schema": {
|
||||
"fields": [
|
||||
{
|
||||
"name": "Database Name"
|
||||
},
|
||||
{
|
||||
"name": "encryption_scan_modify_date"
|
||||
},
|
||||
{
|
||||
"name": "encryption_scan_state_desc"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data": [
|
||||
{
|
||||
"0": "tempdb",
|
||||
"1": "2019-10-11 04:14:58.997",
|
||||
"2": "COMPLETE"
|
||||
},
|
||||
{
|
||||
"0": "dbTDE",
|
||||
"1": "2019-10-29 22:48:20.150",
|
||||
"2": "SUSPENDED"
|
||||
}
|
||||
]
|
||||
},
|
||||
"text/html": "<table><tr><th>Database Name</th><th>encryption_scan_modify_date</th><th>encryption_scan_state_desc</th></tr><tr><td>tempdb</td><td>2019-10-11 04:14:58.997</td><td>COMPLETE</td></tr><tr><td>dbTDE</td><td>2019-10-29 22:48:20.150</td><td>SUSPENDED</td></tr></table>"
|
||||
}
|
||||
}
|
||||
],
|
||||
"execution_count": 14
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"Let's resume the encryption "
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "7ed73073-d0f3-4bf6-9836-8534422fc765"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"ALTER DATABASE dbTDE SET ENCRYPTION RESUME;"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "57af9c9f-9e4c-4f65-ada4-123f46d2b8ae"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Commands completed successfully."
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:00.012"
|
||||
},
|
||||
"metadata": {}
|
||||
}
|
||||
],
|
||||
"execution_count": 15
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"Check if the encryption is complete"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "563c6218-13c8-4a67-ab29-7a7c5251b501"
|
||||
}
|
||||
},
|
||||
{
|
||||
"cell_type": "code",
|
||||
"source": [
|
||||
"SELECT db_name(database_id) as [Database Name]\r\n",
|
||||
"\t, encryption_scan_modify_date\r\n",
|
||||
"\t, encryption_scan_state_desc\r\n",
|
||||
"FROM sys.dm_database_encryption_keys;\r\n",
|
||||
"\r\n",
|
||||
"SELECT SERVERPROPERTY('Edition') as Edition\r\n",
|
||||
" ,name as [Database Name]\r\n",
|
||||
" , CASE is_encrypted WHEN 1 THEN 'YES' ELSE 'NO' END as [Is TDE Enabled]\r\n",
|
||||
"FROM sys.databases;"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "5b87157b-a1f2-4802-868a-9b76beaa6453"
|
||||
},
|
||||
"outputs": [
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "(2 rows affected)"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "(5 rows affected)"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "display_data",
|
||||
"data": {
|
||||
"text/html": "Total execution time: 00:00:00.036"
|
||||
},
|
||||
"metadata": {}
|
||||
},
|
||||
{
|
||||
"output_type": "execute_result",
|
||||
"metadata": {},
|
||||
"execution_count": 16,
|
||||
"data": {
|
||||
"application/vnd.dataresource+json": {
|
||||
"schema": {
|
||||
"fields": [
|
||||
{
|
||||
"name": "Database Name"
|
||||
},
|
||||
{
|
||||
"name": "encryption_scan_modify_date"
|
||||
},
|
||||
{
|
||||
"name": "encryption_scan_state_desc"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data": [
|
||||
{
|
||||
"0": "tempdb",
|
||||
"1": "2019-10-11 04:14:58.997",
|
||||
"2": "COMPLETE"
|
||||
},
|
||||
{
|
||||
"0": "dbTDE",
|
||||
"1": "2019-10-29 22:58:34.353",
|
||||
"2": "COMPLETE"
|
||||
}
|
||||
]
|
||||
},
|
||||
"text/html": "<table><tr><th>Database Name</th><th>encryption_scan_modify_date</th><th>encryption_scan_state_desc</th></tr><tr><td>tempdb</td><td>2019-10-11 04:14:58.997</td><td>COMPLETE</td></tr><tr><td>dbTDE</td><td>2019-10-29 22:58:34.353</td><td>COMPLETE</td></tr></table>"
|
||||
}
|
||||
},
|
||||
{
|
||||
"output_type": "execute_result",
|
||||
"metadata": {},
|
||||
"execution_count": 16,
|
||||
"data": {
|
||||
"application/vnd.dataresource+json": {
|
||||
"schema": {
|
||||
"fields": [
|
||||
{
|
||||
"name": "Edition"
|
||||
},
|
||||
{
|
||||
"name": "Database Name"
|
||||
},
|
||||
{
|
||||
"name": "Is TDE Enabled"
|
||||
}
|
||||
]
|
||||
},
|
||||
"data": [
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "master",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "tempdb",
|
||||
"2": "YES"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "model",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "msdb",
|
||||
"2": "NO"
|
||||
},
|
||||
{
|
||||
"0": "Standard Edition (64-bit)",
|
||||
"1": "dbTDE",
|
||||
"2": "YES"
|
||||
}
|
||||
]
|
||||
},
|
||||
"text/html": "<table><tr><th>Edition</th><th>Database Name</th><th>Is TDE Enabled</th></tr><tr><td>Standard Edition (64-bit)</td><td>master</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>tempdb</td><td>YES</td></tr><tr><td>Standard Edition (64-bit)</td><td>model</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>msdb</td><td>NO</td></tr><tr><td>Standard Edition (64-bit)</td><td>dbTDE</td><td>YES</td></tr></table>"
|
||||
}
|
||||
}
|
||||
],
|
||||
"execution_count": 16
|
||||
},
|
||||
{
|
||||
"cell_type": "markdown",
|
||||
"source": [
|
||||
"You should see the following messages in the SQL Server errorlog which shows PAUSE and RESUME for the encryption scan.\r\n",
|
||||
"\r\n",
|
||||
"\r\n",
|
||||
"<i> 2019-10-29 22:32:11.100 spid34s Beginning database encryption scan for database 'dbTDE'. <br>\r\n",
|
||||
"2019-10-29 22:32:11.150 spid34s <font color = \"red\">Database encryption scan for database 'dbTDE' was aborted.</font> Reissue ALTER DB to resume the scan. <br>\r\n",
|
||||
"2019-10-29 22:32:31.730 spid15s <font color =\"red\">Beginning database encryption scan for database 'dbTDE'.</font> <br>\r\n",
|
||||
"2019-10-29 22:32:41.190 spid15s Database encryption scan for database 'dbTDE' is complete. </i> <br>"
|
||||
],
|
||||
"metadata": {
|
||||
"azdata_cell_guid": "986ce50e-faa9-4f35-8156-8f1cd6fbcb2d"
|
||||
}
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user