From 4c8ca3233b0c42a070bcfa658964bb1e661d0119 Mon Sep 17 00:00:00 2001 From: jaszymas Date: Thu, 22 Apr 2021 17:41:49 -0700 Subject: [PATCH] sample changes --- .../Deploy.ps1 | 36 - .../AttestationPolicy.txt} | 16 +- .../CreateXESession.sql} | 86 +-- .../Setup/PopulateDatabase.sql | 290 ++++++++ .../azuredeploy.bicep} | 681 ++++++++---------- .../Setup/setup.ps1 | 157 ++++ .../TSQL/DecryptColumns.sql | 17 + .../TSQL/EncryptColumns.sql | 14 + .../TSQL/ListAllEmployees.sql | Bin 0 -> 242 bytes .../{ => TSQL}/QueryColumns.sql | 37 +- .../TSQL/QueryXevents.sql | 56 ++ .../contosohr.bacpac | Bin 11368 -> 0 bytes 12 files changed, 902 insertions(+), 488 deletions(-) delete mode 100644 samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Deploy.ps1 rename samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/{policy.txt => Setup/AttestationPolicy.txt} (97%) rename samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/{Post Deployment.sql => Setup/CreateXESession.sql} (62%) create mode 100644 samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/PopulateDatabase.sql rename samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/{Deploy AE Demo.bicep => Setup/azuredeploy.bicep} (54%) create mode 100644 samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/setup.ps1 create mode 100644 samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/DecryptColumns.sql create mode 100644 samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/EncryptColumns.sql create mode 100644 samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/ListAllEmployees.sql rename samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/{ => TSQL}/QueryColumns.sql (62%) create mode 100644 samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/QueryXevents.sql delete mode 100644 samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/contosohr.bacpac diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Deploy.ps1 b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Deploy.ps1 deleted file mode 100644 index 76277b13..00000000 --- a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Deploy.ps1 +++ /dev/null @@ -1,36 +0,0 @@ -###################################################################### -# Request parameters to the user that are needed for the deployment -###################################################################### -# - -$subscriptionName = Read-Host -Prompt "Enter your subscription name" -$projectName = Read-Host -Prompt "Enter a project name that is used to generate resource names" -$location = Read-Host -Prompt "Enter a region where you want to deploy the demo environment" -$upn = Read-Host -Prompt "Enter your email address used to sign in to Azure" -$adminUsername = Read-Host -Prompt "Enter the SQL Admin Username" -$adminPassword = Read-Host -Prompt "Enter the SQL Admin Password" - -$adUserId = (az ad user show --id $upn --query objectId) -$clientIP = (Invoke-WebRequest ifconfig.me/ip).Content.Trim() -$bicepFile = "Deploy AE Demo.bicep" -$projectName = $projectName.ToLower() - -###################################################################### -# Sign in to Azure -###################################################################### - -Connect-AzAccount -$context = Set-AzContext -Subscription $subscriptionName - -###################################################################### -# Create a resource group -###################################################################### -$resourceGroupName = "${projectName}" -New-AzResourceGroup -Name $resourceGroupName -Location $location - -###################################################################### -# Deploy the resources for the demo environment -###################################################################### -az deployment group create --name DeployAEWithEnclavesDemo --template-file $bicepFile --resource-group $resourceGroupName --parameters objectId=$adUserId projectname=$projectName adminUsername=$adminUsername adminPassword=$adminPassword AADSQLAdmin=$upn clientIP=$clientIP - - diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/policy.txt b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/AttestationPolicy.txt similarity index 97% rename from samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/policy.txt rename to samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/AttestationPolicy.txt index 047110f4..2429ed9a 100644 --- a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/policy.txt +++ b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/AttestationPolicy.txt @@ -1,9 +1,9 @@ -version= 1.0; -authorizationrules -{ - [ type=="x-ms-sgx-is-debuggable", value==false ] - && [ type=="x-ms-sgx-product-id", value==4639 ] - && [ type=="x-ms-sgx-svn", value>= 0 ] - && [ type=="x-ms-sgx-mrsigner", value=="e31c9e505f37a58de09335075fc8591254313eb20bb1a27e5443cc450b6e33e5"] - => permit(); +version= 1.0; +authorizationrules +{ + [ type=="x-ms-sgx-is-debuggable", value==false ] + && [ type=="x-ms-sgx-product-id", value==4639 ] + && [ type=="x-ms-sgx-svn", value>= 0 ] + && [ type=="x-ms-sgx-mrsigner", value=="e31c9e505f37a58de09335075fc8591254313eb20bb1a27e5443cc450b6e33e5"] + => permit(); }; \ No newline at end of file diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Post Deployment.sql b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/CreateXESession.sql similarity index 62% rename from samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Post Deployment.sql rename to samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/CreateXESession.sql index 34408190..9403bd53 100644 --- a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Post Deployment.sql +++ b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/CreateXESession.sql @@ -1,56 +1,30 @@ ---Create app user -CREATE USER aeenclavedemoapp FROM EXTERNAL PROVIDER; -GO -EXEC sp_addrolemember 'db_datareader', 'aeenclavedemoapp'; -GO - ---Create XEvent Session -IF EXISTS (SELECT * - FROM sys.database_event_sessions - WHERE name = 'Demo') -BEGIN - DROP EVENT SESSION Demo - ON Database; -END -go - -CREATE EVENT SESSION [Demo] ON DATABASE -ADD EVENT sqlserver.rpc_completed(SET collect_data_stream=(1),collect_statement=(1) - ACTION(sqlserver.sql_text) - WHERE ([sqlserver].[like_i_sql_unicode_string]([sqlserver].[sql_text],N'%SSN%')AND [package0].[not_equal_unicode_string]([statement],N'exec sp_reset_connection')) - ) -ADD TARGET package0.ring_buffer -WITH (MAX_MEMORY=4096 KB,EVENT_RETENTION_MODE=ALLOW_SINGLE_EVENT_LOSS,MAX_DISPATCH_LATENCY=30 SECONDS,MAX_EVENT_SIZE=0 KB,MEMORY_PARTITION_MODE=NONE,TRACK_CAUSALITY=OFF,STARTUP_STATE=OFF) -GO - ---CREATE EVENT SESSION [Demo] ON DATABASE ---ADD EVENT sqlserver.rpc_completed(SET collect_data_stream=(1),collect_statement=(1) --- WHERE ([sqlserver].[equal_i_sql_unicode_string]([sqlserver].[database_name],N'ContosoHR') AND [package0].[not_equal_unicode_string]([statement],N'exec sp_reset_connection'))) ---ADD TARGET package0.ring_buffer(SET max_memory=(4096)) ---WITH (MAX_MEMORY=4096 KB,EVENT_RETENTION_MODE=ALLOW_SINGLE_EVENT_LOSS,MAX_DISPATCH_LATENCY=2 SECONDS,MAX_EVENT_SIZE=0 KB,MEMORY_PARTITION_MODE=NONE,TRACK_CAUSALITY=OFF,STARTUP_STATE=ON) ---GO - - -ALTER EVENT SESSION [Demo] - ON DATABASE - STATE = START; -- STOP; - - - ---Upload Policy File ---Setup CMK and CEK - --- Data Owner's script - the user needs access to the keys - -ALTER TABLE [dbo].[Employees] -ALTER COLUMN [SSN] [char](11) COLLATE Latin1_General_BIN2 -ENCRYPTED WITH (COLUMN_ENCRYPTION_KEY = [CEK], ENCRYPTION_TYPE = Randomized, ALGORITHM = 'AEAD_AES_256_CBC_HMAC_SHA_256') NOT NULL; -GO - -ALTER TABLE [dbo].[Employees] -ALTER COLUMN [Salary] [Money] -ENCRYPTED WITH (COLUMN_ENCRYPTION_KEY = [CEK], ENCRYPTION_TYPE = Randomized, ALGORITHM = 'AEAD_AES_256_CBC_HMAC_SHA_256') NOT NULL; -GO - -ALTER DATABASE SCOPED CONFIGURATION CLEAR PROCEDURE_CACHE; -GO +IF EXISTS (SELECT * + FROM sys.database_event_sessions + WHERE name = 'Demo') +BEGIN + DROP EVENT SESSION Demo + ON Database; +END +go + +CREATE EVENT SESSION [Demo] ON DATABASE +ADD EVENT sqlserver.rpc_completed(SET collect_data_stream=(1),collect_statement=(1) + ACTION(sqlserver.sql_text) + WHERE ([sqlserver].[like_i_sql_unicode_string]([sqlserver].[sql_text],N'%SSN%')AND [package0].[not_equal_unicode_string]([statement],N'exec sp_reset_connection')) + ) +ADD TARGET package0.ring_buffer +WITH (MAX_MEMORY=4096 KB,EVENT_RETENTION_MODE=ALLOW_SINGLE_EVENT_LOSS,MAX_DISPATCH_LATENCY=30 SECONDS,MAX_EVENT_SIZE=0 KB,MEMORY_PARTITION_MODE=NONE,TRACK_CAUSALITY=OFF,STARTUP_STATE=OFF) +GO + +--CREATE EVENT SESSION [Demo] ON DATABASE +--ADD EVENT sqlserver.rpc_completed(SET collect_data_stream=(1),collect_statement=(1) +-- WHERE ([sqlserver].[equal_i_sql_unicode_string]([sqlserver].[database_name],N'ContosoHR') AND [package0].[not_equal_unicode_string]([statement],N'exec sp_reset_connection'))) +--ADD TARGET package0.ring_buffer(SET max_memory=(4096)) +--WITH (MAX_MEMORY=4096 KB,EVENT_RETENTION_MODE=ALLOW_SINGLE_EVENT_LOSS,MAX_DISPATCH_LATENCY=2 SECONDS,MAX_EVENT_SIZE=0 KB,MEMORY_PARTITION_MODE=NONE,TRACK_CAUSALITY=OFF,STARTUP_STATE=ON) +--GO + + +ALTER EVENT SESSION [Demo] + ON DATABASE + STATE = START; -- STOP; + diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/PopulateDatabase.sql b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/PopulateDatabase.sql new file mode 100644 index 00000000..23c7fb67 --- /dev/null +++ b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/PopulateDatabase.sql @@ -0,0 +1,290 @@ +/****** Object: Table [dbo].[Employees] Script Date: 4/7/2021 9:31:31 AM ******/ +SET ANSI_NULLS ON +GO + +SET QUOTED_IDENTIFIER ON +GO + +CREATE TABLE [dbo].[Employees]( + [EmployeeID] [int] IDENTITY(1,1) NOT NULL, + [SSN] [char](11) NOT NULL, + [FirstName] [nvarchar](50) NOT NULL, + [LastName] [nvarchar](50) NOT NULL, + [Salary] [money] NOT NULL, + CONSTRAINT [PK_dbo.Employees] PRIMARY KEY CLUSTERED +( + [EmployeeID] ASC +)WITH (STATISTICS_NORECOMPUTE = OFF, IGNORE_DUP_KEY = OFF, OPTIMIZE_FOR_SEQUENTIAL_KEY = OFF) ON [PRIMARY] +) ON [PRIMARY] +GO + +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('795-73-9838', 'Catherine', 'Abel', 31692) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('990-00-6818', 'Kim', 'Abercrombie', 990) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('009-37-3952', 'Frances', 'Adams', 5684) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('708-44-3627', 'Jay', 'Adams', 55415) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('447-62-6279', 'Robert', 'Ahlering', 49744) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('872-78-4732', 'Stanley', 'Alan', 38584) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('898-79-8701', 'Paul', 'Alcorn', 11918) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('561-88-3757', 'Mary', 'Alexander', 17349) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('904-55-0991', 'Michelle', 'Alexander', 70796) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('293-95-6617', 'Marvin', 'Allen', 96956) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('260-99-4784', 'Oscar', 'Alpuerto', 18386) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('605-29-1370', 'Ramona', 'Antrim', 72548) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('731-35-9387', 'Thomas', 'Armstrong', 72180) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('854-76-1401', 'John', 'Arthur', 79054) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('775-20-2697', 'Chris', 'Ashton', 6011) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('117-79-5230', 'Teresa', 'Atkinson', 87089) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('607-41-3750', 'Stephen', 'Ayers', 72344) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('412-66-3694', 'James', 'Bailey', 33950) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('775-63-2547', 'Douglas', 'Baldwin', 89945) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('779-52-1722', 'Wayne', 'Banack', 73236) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('647-03-0271', 'Robert', 'Barker', 23861) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('353-98-6954', 'John', 'Beaver', 75812) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('817-89-8819', 'John', 'Beaver', 19047) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('611-82-6762', 'Edna', 'Benson', 59478) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('665-55-5653', 'Payton', 'Benson', 98459) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('947-37-8651', 'Robert', 'Bernacchi', 78183) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('071-31-7824', 'Robert', 'Bernacchi', 79399) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('610-55-3726', 'Matthias', 'Berndt', 20209) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('590-27-0856', 'Jimmy', 'Bischoff', 24730) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('008-73-9012', 'Mae', 'Black', 60057) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('137-23-1723', 'Donald', 'Blanton', 65301) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('969-53-6095', 'Michael', 'Blythe', 5635) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('222-42-8458', 'Gabriel', 'Bockenkamp', 41020) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('163-08-2988', 'Luis', 'Bonifaz', 85014) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('898-11-0280', 'Cory', 'Booth', 49351) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('432-52-2738', 'Randall', 'Boseman', 24063) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('018-29-9539', 'Cornelius', 'Brandon', 91513) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('472-36-9060', 'Richard', 'Bready', 26084) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('566-87-9214', 'Ted', 'Bremer', 95506) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('771-34-9714', 'Alan', 'Brewer', 35682) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('413-73-7072', 'Walter', 'Brian', 5198) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('497-65-6363', 'Christopher', 'Bright', 24216) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('450-26-2195', 'Willie', 'Brooks', 55078) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('052-78-7929', 'Jo', 'Brown', 17396) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('087-92-6356', 'Robert', 'Brown', 99872) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('048-71-8953', 'Steven', 'Brown', 88633) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('488-68-6075', 'Mary', 'Browning', 59229) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('819-63-3780', 'Michael', 'Brundage', 30996) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('599-61-7739', 'Shirley', 'Bruner', 35872) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('772-36-0661', 'June', 'Brunner', 84642) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('990-78-3760', 'Megan', 'Burke', 76800) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('103-38-5903', 'Karren', 'Burkhardt', 93306) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('146-43-8832', 'Linda', 'Burnett', 56479) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('448-72-5948', 'Jared', 'Bustamante', 7997) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('254-13-4819', 'Barbara', 'Calone', 28720) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('666-45-9926', 'Lindsey', 'Camacho', 11870) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('260-46-2402', 'Frank', 'Campbell', 87501) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('189-92-4702', 'Henry', 'Campen', 30494) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('718-12-8401', 'Chris', 'Cannon', 2324) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('918-66-9747', 'Jane', 'Carmichael', 22620) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('806-97-1958', 'Jovita', 'Carmody', 37601) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('482-61-8230', 'Rob', 'Caron', 16904) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('897-39-6229', 'Andy', 'Carothers', 40261) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('656-79-6279', 'Donna', 'Carreras', 78393) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('745-99-0161', 'Rosmarie', 'Carroll', 98109) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('216-16-4120', 'Raul', 'Casts', 41706) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('102-56-5530', 'Matthew', 'Cavallari', 75290) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('787-23-4125', 'Andrew', 'Cencini', 75121) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('424-55-1778', 'Stacey', 'Cereghino', 25456) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('572-19-0999', 'Forrest', 'Chandler', 49996) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('745-81-6513', 'Lee', 'Chapla', 70991) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('947-66-5585', 'Yao-Qiang', 'Cheng', 72455) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('531-83-4784', 'Nicky', 'Chesnut', 13676) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('109-99-0299', 'Ruth', 'Choin', 55818) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('483-85-6853', 'Anthony', 'Chor', 71421) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('567-39-1024', 'Pei', 'Chow', 57284) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('382-49-7387', 'Jill', 'Christie', 94767) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('336-03-8102', 'Alice', 'Clark', 47963) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('994-22-9926', 'Connie', 'Coffman', 32136) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('129-28-7723', 'John', 'Colon', 82858) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('347-44-2949', 'Scott', 'Colvin', 1121) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('706-66-0382', 'Scott', 'Cooper', 22281) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('500-63-2220', 'Eva', 'Corets', 34410) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('942-15-7859', 'Marlin', 'Coriell', 43154) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('143-78-9971', 'Jack', 'Creasey', 66527) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('372-18-7905', 'Grant', 'Culbertson', 69903) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('153-33-1155', 'Scott', 'Culp', 87717) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('790-69-5423', 'Megan', 'Davis', 69707) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('105-16-8373', 'Alvaro', 'De Matos Miranda Filho', 15198) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('989-18-3523', 'Aidan', 'Delaney', 86115) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('771-07-7325', 'Stefan', 'Delmarco', 50994) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('545-83-9747', 'Prashanth', 'Desai', 97968) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('994-72-1605', 'Bev', 'Desalvo', 76954) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('558-23-5595', 'Brenda', 'Diaz', 4027) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('752-63-1338', 'Blaine', 'Dockter', 12312) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('825-10-8923', 'Cindy', 'Dodd', 82876) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('368-69-8964', 'Patricia', 'Doyle', 97282) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('597-44-1424', 'Gerald', 'Drury', 20153) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('957-28-1545', 'Bart', 'Duncan', 89903) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('187-17-8616', 'Maciej', 'Dusza', 6725) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('194-76-9481', 'Carol', 'Elliott', 49287) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('679-79-8165', 'Shannon', 'Elliott', 94194) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('367-73-8845', 'John', 'Emory', 65560) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('814-03-3691', 'Gail', 'Erickson', 99845) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('214-28-9968', 'Mark', 'Erickson', 95242) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('913-55-6645', 'Ann', 'Evans', 48046) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('763-33-5650', 'John', 'Evans', 59254) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('658-41-8532', 'Twanna', 'Evans', 35364) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('943-41-6011', 'Carolyn', 'Farino', 76201) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('691-30-8623', 'Geri', 'Farrell', 39600) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('361-08-3217', 'François', 'Ferrier', 3704) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('827-51-1487', 'Kathie', 'Flood', 78467) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('483-93-0057', 'John', 'Ford', 77552) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('738-37-1607', 'Garth', 'Fort', 34381) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('822-59-9384', 'Dorothy', 'Fox', 32679) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('309-79-2521', 'Mihail', 'Frintu', 52898) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('814-32-0421', 'Paul', 'Fulton', 1320) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('076-35-8143', 'Michael', 'Galos', 24061) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('620-03-4764', 'Jon', 'Ganio', 70002) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('769-76-3600', 'Dominic', 'Gash', 89479) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('160-92-3129', 'Janet', 'Gates', 49178) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('318-00-6667', 'Janet', 'Gates', 68327) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('982-77-3975', 'Orlando', 'Gee', 53281) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('328-68-1544', 'Darren', 'Gehring', 13353) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('053-51-9173', 'Jim', 'Geist', 91180) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('840-05-6646', 'Guy', 'Gilbert', 3780) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('446-11-2924', 'Janet', 'Gilliat', 89588) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('273-16-2522', 'Mary', 'Gimmi', 53352) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('003-23-9305', 'Jeanie', 'Glenn', 49086) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('878-44-1968', 'Scott', 'Gode', 2744) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('910-05-4138', 'Mete', 'Goktepe', 89053) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('912-33-3174', 'Abigail', 'Gonzalez', 56550) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('058-26-3234', 'Michael', 'Graff', 41144) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('687-28-3396', 'Douglas', 'Groncki', 22262) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('496-75-4904', 'Brian', 'Groth', 35712) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('071-00-8057', 'Erin', 'Hagens', 48197) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('288-05-9705', 'Betty', 'Haines', 6286) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('002-47-6040', 'Jean', 'Handley', 22940) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('936-84-1664', 'Kerim', 'Hanif', 80093) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('216-03-0835', 'John', 'Hanson', 10237) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('525-81-0810', 'Lucy', 'Harrington', 69388) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('331-25-9319', 'Keith', 'Harris', 7729) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('770-01-5105', 'Keith', 'Harris', 67336) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('208-84-9956', 'Roger', 'Harui', 78271) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('633-34-5095', 'Ann', 'Hass', 62689) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('022-89-0200', 'Valerie', 'Hendricks', 10269) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('912-85-8027', 'Cheryl', 'Herring', 95103) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('307-29-4403', 'Ronald', 'Heymsfield', 30421) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('083-68-5072', 'Mike', 'Hines', 35109) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('239-20-6174', 'Matthew', 'Hink', 75140) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('162-43-8489', 'Bob', 'Hodges', 84875) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('717-37-3032', 'David', 'Hodgson', 15920) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('280-15-5623', 'Helge', 'Hoeing', 23680) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('353-00-9496', 'Juanita', 'Holman', 83632) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('162-65-6542', 'Peter', 'Houston', 6335) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('427-43-7296', 'George', 'Huckaby', 90908) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('603-61-0319', 'Joshua', 'Huff', 55166) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('877-01-3415', 'Phyllis', 'Huntsman', 58528) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('391-25-8382', 'Phyllis', 'Huntsman', 86920) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('626-56-2930', 'Lawrence', 'Hurkett', 11698) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('731-19-3470', 'Lucio', 'Iallo', 83202) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('171-33-3481', 'Richard', 'Irwin', 83990) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('828-77-1376', 'Erik', 'Ismert', 7706) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('611-48-4137', 'Eric', 'Jacobsen', 784) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('477-14-7161', 'Jodan', 'Jacobson', 17695) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('738-83-2602', 'Sean', 'Jacobson', 9412) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('589-30-3617', 'Joyce', 'Jarvis', 42556) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('538-28-5108', 'Barry', 'Johnson', 36190) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('661-09-8547', 'Barry', 'Johnson', 80820) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('025-55-7602', 'Brian', 'Johnson', 54767) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('422-34-6020', 'David', 'Johnson', 26695) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('500-92-8728', 'Tom', 'Johnston', 52805) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('170-89-3691', 'Jean', 'Jordan', 68936) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('108-25-0733', 'Peggy', 'Justice', 39764) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('392-44-2253', 'Sandeep', 'Kaliyath', 84549) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('666-10-8497', 'Sandeep', 'Katyal', 27585) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('738-29-5963', 'John', 'Kelly', 31491) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('253-47-6467', 'Robert', 'Kelly', 43239) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('059-47-6363', 'Kevin', 'Kennedy', 18192) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('382-51-9530', 'Mitch', 'Kennedy', 68959) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('480-79-4419', 'Imtiaz', 'Khan', 66870) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('097-39-6667', 'Karan', 'Khanna', 17048) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('625-86-1609', 'Anton', 'Kirilov', 97398) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('109-78-5455', 'Christian', 'Kleinerman', 22492) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('914-28-0431', 'Andrew', 'Kobylinski', 47853) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('428-15-1588', 'Eugene', 'Kogan', 61377) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('612-70-0567', 'Scott', 'Konersmann', 87060) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('025-76-2628', 'Joy', 'Koski', 165) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('920-75-2262', 'Diane', 'Krane', 12316) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('748-12-0172', 'Kay', 'Krane', 13614) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('230-78-1884', 'Kay', 'Krane', 98499) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('121-03-7961', 'Margaret', 'Krupka', 98845) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('993-16-0574', 'Peter', 'Kurniawan', 67823) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('560-17-8321', 'Jeffrey', 'Kurtz', 18840) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('176-23-2126', 'Eric', 'Lang', 39005) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('678-53-5154', 'Elsa', 'Leavitt', 71752) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('950-17-4726', 'Marjorie', 'Lee', 28116) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('649-28-8360', 'Roger', 'Lengel', 75588) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('507-95-7549', 'A.', 'Leonetti', 71639) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('442-99-4943', 'Bonnie', 'Lepro', 9089) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('674-71-8512', 'Elsie', 'Lewin', 93630) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('418-20-4458', 'George', 'Li', 74540) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('986-20-3872', 'Joseph', 'Lique', 96968) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('716-41-6291', 'Paulo', 'Lisboa', 11243) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('475-64-2482', 'Paulo', 'Lisboa', 84392) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('471-03-3608', 'David', 'Liu', 57309) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('440-49-4765', 'Jinghao', 'Liu', 34991) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('321-33-7277', 'Kevin', 'Liu', 20305) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('113-69-0506', 'Sharon', 'Looney', 5368) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('311-21-1551', 'Judy', 'Lundahl', 15667) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('710-73-5330', 'Denise', 'Maccietto', 2258) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('321-14-1319', 'Scott', 'MacDonald', 30158) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('340-75-5874', 'Kathy', 'Marcovecchio', 10228) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('043-85-0648', 'Melissa', 'Marple', 46100) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('253-33-7509', 'Frank', 'Mart¡nez', 46267) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('335-68-4629', 'Chris', 'Maxwell', 92921) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('535-30-6577', 'Sandra', 'Maynard', 60264) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('613-34-9127', 'Walter', 'Mays', 70620) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('754-70-9484', 'Lola', 'McCarthy', 75175) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('758-46-9282', 'Jane', 'McCarty', 78021) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('287-44-2853', 'Yvonne', 'McKay', 38787) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('173-12-0893', 'Nkenge', 'McLin', 27222) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('028-18-1290', 'R. Morgan', 'Mendoza', 80464) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('035-47-1686', 'Helen', 'Meyer', 79306) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('926-47-4349', 'Dylan', 'Miller', 64819) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('947-84-3762', 'Frank', 'Miller', 97091) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('598-00-4792', 'Virginia', 'Miller', 77286) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('069-59-6908', 'Virginia', 'Miller', 57881) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('864-49-8796', 'Neva', 'Mitchell', 36848) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('484-78-0561', 'Joseph', 'Mitzner', 42987) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('684-27-6433', 'Margaret', 'Smith', 46020) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('521-85-5433', 'Laura', 'Steele', 87969) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('239-08-6212', 'Alan', 'Steiner', 71635) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('655-64-2836', 'Alice', 'Steiner', 60544) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('850-56-7206', 'Derik', 'Stenerson', 16798) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('077-42-9130', 'Vassar', 'Stern', 55399) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('094-90-4314', 'Wathalee', 'Steuber', 20296) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('409-83-6433', 'Liza Marie', 'Stevens', 6631) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('351-34-7304', 'Robert', 'Stotka', 88774) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('866-96-8557', 'Kayla', 'Stotler', 19835) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('716-37-0786', 'Ruth', 'Suffin', 38058) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('689-86-1583', 'Elizabeth', 'Sullivan', 98566) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('622-25-6018', 'Michael', 'Sullivan', 9242) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('137-21-0253', 'Brad', 'Sutton', 44883) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('237-99-8262', 'Abraham', 'Swearengin', 85958) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('518-41-6271', 'Julie', 'Taft-Rider', 63622) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('554-31-5202', 'Clarence', 'Tatman', 25188) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('591-44-7136', 'Chad', 'Tedford', 22306) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('069-09-3831', 'Vanessa', 'Tench', 44398) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('523-93-8801', 'Judy', 'Thames', 89067) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('266-03-4963', 'Daniel', 'Thompson', 36910) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('496-54-0726', 'Donald', 'Thompson', 85206) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('984-43-6756', 'Kendra', 'Thompson', 7375) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('047-31-4129', 'Diane', 'Tibbott', 95073) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('217-20-9777', 'Delia', 'Toone', 17369) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('420-28-0429', 'Michael John', 'Troyer', 69381) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('236-75-2355', 'Christie', 'Trujillo', 79299) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('984-20-5166', 'Sairaj', 'Uddin', 41036) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('353-75-0098', 'Sunil', 'Uppal', 23245) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('934-96-8406', 'Jessie', 'Valerio', 62357) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('773-23-3159', 'Gregory', 'Vanderbout', 21434) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('951-08-3331', 'Michael', 'Vanderhyde', 72246) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('856-23-4990', 'Margaret', 'Vanderkamp', 18918) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('359-67-5826', 'Gary', 'Vargas', 37729) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('743-66-8203', 'Nieves', 'Vargas', 61754) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('368-97-5673', 'Ranjit', 'Varkey Chudukatil', 19423) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('890-04-1424', 'Patricia', 'Vasquez', 59489) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('267-37-1036', 'Wanda', 'Vernon', 11749) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('101-14-5907', 'Robert', 'Vessa', 58459) +INSERT INTO [dbo].[Employees] ([SSN], [FirstName], [LastName], [Salary]) VALUES ('148-51-2717', 'Caroline', 'Vicknair', 83361) diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Deploy AE Demo.bicep b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/azuredeploy.bicep similarity index 54% rename from samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Deploy AE Demo.bicep rename to samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/azuredeploy.bicep index 9a88d1c0..22403c12 100644 --- a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Deploy AE Demo.bicep +++ b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/azuredeploy.bicep @@ -1,368 +1,313 @@ -//////////////////// -//Define parameter// -//////////////////// - -param objectId string -@description('Location for all resources.') -param location string = resourceGroup().location - -@description('Project Name') -param projectname string = 'eaeaedemo' - -param currentTime string = utcNow('u') - -param adminUsername string -param adminPassword string -param AADSQLAdmin string -param clientIP string - -//Make the subscription Contributor of the resource group -resource AssignContributorToUser_Resource 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = { - name: guid(uniqueString(resourceGroup().id),currentTime) - scope: any(resourceGroup().id) - properties: { - roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c' - principalId: objectId - principalType: 'User' - } -} - -/////////////////////////////////////////////////// -//Create a storage account with a database bacpac// -////////////////////////////////////////////////// - -// Create a storage account -@description('Storage Account type') -param storageAccountType string = 'Standard_LRS' -var storageAccountName_var = '${projectname}storage' - -resource storageAccountResource 'Microsoft.Storage/storageAccounts@2020-08-01-preview' = { - name: storageAccountName_var - location: location - sku: { - name: storageAccountType - } - kind: 'StorageV2' - properties: {} -} - -output storageoutput string = storageAccountResource.name - -resource storageAccountname 'Microsoft.Storage/storageAccounts/blobServices@2020-08-01-preview' = { - name: '${storageAccountResource.name}/default' - properties: { - cors: { - corsRules: [] - } - deleteRetentionPolicy: { - enabled: false - } - } -} - -resource Containerbacpacfiles 'Microsoft.Storage/storageAccounts/blobServices/containers@2020-08-01-preview' = { - name: '${storageAccountname.name}/bacpacfiles' - properties: { - defaultEncryptionScope: '$account-encryption-key' - denyEncryptionScopeOverride: false - publicAccess: 'None' - } - dependsOn: [ - storageAccountResource - ] -} - -//////////////////////////// -//Create a database server// -//////////////////////////// - -// Create the server - -var SQLServerName_var = '${projectname}server' -resource Server_Name_resource 'Microsoft.Sql/servers@2019-06-01-preview' = { - name: SQLServerName_var - location: location - tags: {} - identity: { - type: 'SystemAssigned' - } - properties: { - administratorLogin: adminUsername - administratorLoginPassword: adminPassword - //version: 'string' //optional - minimalTlsVersion: '1.2' - publicNetworkAccess: 'Enabled' - } -} - -//Allow Azure services and resources to access this server -resource Server_Name_AllowAllWindowsAzureIps 'Microsoft.Sql/servers/firewallRules@2015-05-01-preview' = { - name: '${Server_Name_resource.name}/AllowAllWindowsAzureIps' - properties: { - endIpAddress: '0.0.0.0' - startIpAddress: '0.0.0.0' - } -} - -//Allow Client IP to access this server -resource Server_Name_AllowClientIP 'Microsoft.Sql/servers/firewallRules@2015-05-01-preview' = { - name: '${Server_Name_resource.name}/AllowClientIP' - properties: { - endIpAddress: clientIP - startIpAddress: clientIP - } -} - -//Make yourself an administrator, so that you can connect with universal authentication -resource Server_Name_activeDirectory 'Microsoft.Sql/servers/administrators@2019-06-01-preview' = { - name: '${Server_Name_resource.name}/activeDirectory' - properties: { - administratorType: 'ActiveDirectory' - login: AADSQLAdmin - //sid: reference(resourceId('Microsoft.Sql/servers', '${projectname}server'), '2019-06-01-preview', 'Full').identity.principalId - sid: objectId - //tenantId: AAD_TenantId //optional - } -} - -/////////////////////////////////////////////// -//Import and configure the ContosoHR database// -/////////////////////////////////////////////// -resource Database_Resource 'Microsoft.Sql/servers/databases@2020-08-01-preview' = { - name: '${Server_Name_resource.name}/ContosoHR' - location: location - tags: {} - sku: { - name: 'GP_DC_2' - tier: 'GeneralPurpose' - - } - properties: {} -} - -//Import the BACPAC -resource ImportBACPAC_resource 'Microsoft.Sql/servers/databases/extensions@2014-04-01' = { - name: '${Database_Resource.name}/extensions' - properties: { - storageKeyType: 'SharedAccessKey' - storageKey: '?' - storageUri: 'https://easetupfiles.blob.core.windows.net/setup/contosohr.bacpac' - administratorLogin: adminUsername - administratorLoginPassword: adminPassword - authenticationType: 'SQL' - operationMode: 'Import' - } -} - -//Create ManagedIdenty to perform any Azure-specific actions in the deployment scripts -resource ManagedIdentity_Resource 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = { - name: 'EAEDemoManagedIdentity' - tags: {} - location: location -} - -var uamiId = resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', '${ManagedIdentity_Resource.name}') - -//Add the Managed Identity to the Contributor Role -resource AssignContributor_Resource 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = { - //name: guid(resourceGroup().id,currentTime) - name: guid(uniqueString(resourceGroup().id),dateTimeAdd(currentTime,'PT1S')) - scope: any(resourceGroup().id) - properties: { - roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c' - principalId: ManagedIdentity_Resource.properties.principalId - principalType: 'ServicePrincipal' - } - dependsOn: [ - ManagedIdentity_Resource - ] -} - -///////////////////////////////////// -//Configure an attestation provider// -///////////////////////////////////// - -//Create the attestation provider -resource attestationProviderName_resource 'Microsoft.Attestation/attestationProviders@2020-10-01' = { - name: '${projectname}attest' - location: location - properties: {} -} - -//Upload the recommended attestation policy for SGX enclaves -//!!!!Not working yet!!! - -// resource UploadAttestinationPolicy 'Microsoft.Resources/deploymentScripts@2020-10-01' = { -// name: 'UploadAttestinationPolicy' -// location: location -// identity: { -// type: 'UserAssigned' -// userAssignedIdentities: { -// '${uamiId}': {} -// } -// } -// kind: 'AzurePowerShell' -// properties: { -// azPowerShellVersion: '5.0' -// // storageAccountSettings: { -// // storageAccountName: storageAccountResource.name -// // storageAccountKey: listKeys(storageAccountResource.id, storageAccountResource.apiVersion).keys[0].value -// // } -// //scriptContent: '\r\n az storage blob copy start --account-key ${listKeys(storageAccountResource.id, storageAccountResource.apiVersion).keys[0].value} --account-name ${storageAccountResource.name} --destination-blob contosohr.bacpac --destination-container bacpacfiles --source-uri https://easetupfiles.blob.core.windows.net/setup/contosohr.bacpac' -// //scriptContent: 'az config set extension.use_dynamic_install=yes_without_prompt \r\n az attestation policy set --name ${projectname}attest --resource-group ${resourceGroup().name} --attestation-type SGX-IntelSDK --new-attestation-policy-file "{https://easetupfiles.blob.core.windows.net/setup/policy.txt}"' -// scriptContent: 'Import-Module "Az.Attestation" -MinimumVersion "0.1.8" \r\n $blobContext=New-AzstorageContext -StorageAccountName "easetupfiles" -Anonymous -Protocol "https" \r\n $policyFile=Get-AzStorageBlob -Blob policy.txt -Container setup -Context $blobContext \r\n $Policy = $policyFile.ICloudBlob.DownloadText() \r\n Set-AzAttestationPolicy -Name ${projectname}attest -ResourceGroupName ${resourceGroup().name} -Tee SgxEnclave -Policy $policy -PolicyFormat Text' -// cleanupPreference: 'OnSuccess' -// retentionInterval: 'P1D' -// forceUpdateTag: currentTime // ensures script will run every time -// } -// } - -//Grant the database server access to the attestation provider -resource AssignAttestationReader_Resource 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = { - name: guid(resourceGroup().id,currentTime) - properties: { - roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/fd1bd22b-8476-40bc-a0bc-69b95687b9f3' - principalId: Server_Name_resource.identity.principalId - } -} - -///////////////////////////////////// -//Configure the web application // -///////////////////////////////////// - -//Create an App Service plan in Free tier -resource WebAppServicePlan_Resource 'Microsoft.Web/serverfarms@2020-09-01' = { - name: '${projectname}plan' - location: location - properties: {} - sku: { - name: 'F1' - tier: 'Free' - } -} - -//Create the App Service -resource WebApp_Resource 'Microsoft.Web/sites@2020-09-01' = { - name: '${projectname}app' - location: location - identity: { - type: 'SystemAssigned' - } - properties: { - serverFarmId: WebAppServicePlan_Resource.id - - } -} - -//Add the connection string to the Azure SQL Database -resource WebAppConnectionString_Resource 'Microsoft.Web/sites/config@2020-09-01' = { - name: '${WebApp_Resource.name}/connectionstrings' - properties: { - ContosoHRDatabase: { - value: 'Server=tcp:${Server_Name_resource.name}.database.windows.net;Database=ContosoHR;Column Encryption Setting=Enabled; Attestation Protocol = AAS; Enclave Attestation Url=${attestationProviderName_resource.properties.attestUri}/attest/SgxEnclave; Authentication=Active Directory Managed Identity' - type: 'SQLAzure' - } - } -} - -//Deploy the Web Application -resource DeployWebApp 'Microsoft.Resources/deploymentScripts@2020-10-01' = { - name: 'DeployWebApp' - location: location - identity: { - type: 'UserAssigned' - userAssignedIdentities: { - '${uamiId}': {} - } - } - kind: 'AzurePowerShell' - properties: { - azPowerShellVersion: '5.0' - storageAccountSettings: { - storageAccountName: storageAccountResource.name - storageAccountKey: listKeys(storageAccountResource.id, storageAccountResource.apiVersion).keys[0].value - } - scriptContent: '$PropertiesObject = @{repoUrl = "https://github.com/Pietervanhove/AEDemo.git"; branch = "master"; isManualIntegration = "true";} \r\n Set-AzResource -Properties $PropertiesObject -ResourceGroupName ${resourceGroup().name} -ResourceType Microsoft.Web/sites/sourcecontrols -ResourceName ${WebApp_Resource.name}/web -ApiVersion 2015-08-01 -Force' - cleanupPreference: 'OnSuccess' - retentionInterval: 'P1D' - forceUpdateTag: currentTime // ensures script will run every time - } -} - - -//////////////////////////////////// -//Create and configure a key vault// -//////////////////////////////////// - -//Create a key vault and Assign key permissions to yourself, so that you manage the keys -resource KeyVault_Resource 'Microsoft.KeyVault/vaults@2019-09-01' = { - name: '${projectname}vault' - location: location - tags: {} - properties: { - tenantId: subscription().tenantId - sku: { - family: 'A' - name: 'standard' - } - enableSoftDelete: false - accessPolicies: [ - { - tenantId: subscription().tenantId - objectId: objectId - permissions: { - keys: [ - 'unwrapKey' - 'wrapKey' - 'verify' - 'sign' - 'get' - 'list' - 'create' - 'delete' - 'purge' - ] - } - } - ] - } -} - -//Assign key permissions to the web app -resource KeyVaultWebAppAccessPolicy_Resource 'Microsoft.KeyVault/vaults/accessPolicies@2019-09-01' = { - name: any('${KeyVault_Resource.name}/add') - properties: { - accessPolicies: [ - { - tenantId: subscription().tenantId - //objectId: reference(resourceId('Microsoft.Web/sites', '${projectname}app'), '2020-12-01', 'Full').resourceId - objectId: WebApp_Resource.identity.principalId - permissions: { - keys: [ - 'unwrapKey' - 'wrapKey' - 'verify' - 'sign' - 'get' - 'list' - ] - } - } - ] - } -} - -//Create a Key -resource Key_Resource 'Microsoft.KeyVault/vaults/keys@2019-09-01' = { - name: '${KeyVault_Resource.name}/CMK' - tags: {} - properties: { - kty: 'RSA' - } - dependsOn: [ - KeyVault_Resource - ] -} - -//Post Deploy Script not working -//The term 'New-SqlColumnEncryptionSettings' is not recognized as a name of a cmdlet, function, script file, or executable program. +/////////////////////// +// Define parameters // +/////////////////////// + +@description('The project name. The names of all resources will be derived from the project name.') +param projectName string + +@description('The object id of the user running the deployment.') +param userObjectId string + +@description('The username of the user running the deployment.') +param userName string + +@description('The username of the Azure SQL database server administrator for SQL authentication.') +param sqlAdminUserName string + +@description('The password of the Azure SQL database server administrator for SQL authentication.') +param sqlAdminPassword string + +@description('The IP address the user will connect from to the Azure SQL database server.') +param clientIP string + +@description('The location (the Azure region) for all resources.') +param location string = resourceGroup().location + +@description('The current time.') +param currentTime string = utcNow('u') + +//////////////////////////////////////////////////////////////////// +// Assign the user to the Contributor role for the resource group // +//////////////////////////////////////////////////////////////////// + +resource AssignContributorToUser_Resource 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = { + name: guid(uniqueString(resourceGroup().id),currentTime) + scope: any(resourceGroup().id) + properties: { + roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c' + principalId: userObjectId + principalType: 'User' + } +} +//////////////////////////////////////////// +// Create and configure a database server // +//////////////////////////////////////////// + +// Create the server +var SQLServerName_var = '${projectName}server' +resource Server_Name_resource 'Microsoft.Sql/servers@2019-06-01-preview' = { + name: SQLServerName_var + location: location + tags: {} + identity: { + type: 'SystemAssigned' + } + properties: { + administratorLogin: sqlAdminUserName + administratorLoginPassword: sqlAdminPassword + //version: 'string' //optional + minimalTlsVersion: '1.2' + publicNetworkAccess: 'Enabled' + } +} + +// Allow Azure services and resources to access this server +resource Server_Name_AllowAllWindowsAzureIps 'Microsoft.Sql/servers/firewallRules@2015-05-01-preview' = { + name: '${Server_Name_resource.name}/AllowAllWindowsAzureIps' + properties: { + endIpAddress: '0.0.0.0' + startIpAddress: '0.0.0.0' + } +} + +// Allow Client IP to access this server +resource Server_Name_AllowClientIP 'Microsoft.Sql/servers/firewallRules@2015-05-01-preview' = { + name: '${Server_Name_resource.name}/AllowClientIP' + properties: { + endIpAddress: clientIP + startIpAddress: clientIP + } +} + +// Make the user an Azure AD administrator for the server, so that the user can connect with universal authentication +resource Server_Name_activeDirectory 'Microsoft.Sql/servers/administrators@2019-06-01-preview' = { + name: '${Server_Name_resource.name}/activeDirectory' + properties: { + administratorType: 'ActiveDirectory' + login: userName + //sid: reference(resourceId('Microsoft.Sql/servers', '${projectName}server'), '2019-06-01-preview', 'Full').identity.principalId + sid: userObjectId + //tenantId: AAD_TenantId //optional + } +} + +////////////////////////////////////////////////////////////////////////////// +// Create the ContosoHR database using the DC-series hardware configuration // +////////////////////////////////////////////////////////////////////////////// + +resource Database_Resource 'Microsoft.Sql/servers/databases@2020-08-01-preview' = { + name: '${Server_Name_resource.name}/ContosoHR' + location: location + tags: {} + sku: { + name: 'GP_DC_2' + tier: 'GeneralPurpose' + } + properties: {} +} + +/////////////////////////////////////// +// Configure an attestation provider // +/////////////////////////////////////// + +// Create the attestation provider +resource attestationProviderName_resource 'Microsoft.Attestation/attestationProviders@2020-10-01' = { + name: '${projectName}attest' + location: location + properties: {} +} + +// Grant the database server access to the attestation provider +resource AssignAttestationReader_Resource 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = { + name: guid(resourceGroup().id,currentTime) + properties: { + roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/fd1bd22b-8476-40bc-a0bc-69b95687b9f3' + principalId: Server_Name_resource.identity.principalId + } +} + +/////////////////////////////////// +// Configure the web application // +/////////////////////////////////// + +// Create a managed identity for the web app deployment +resource ManagedIdentity_Resource 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = { + name: '${projectName}identity' + tags: {} + location: location +} + +var uamiId = resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', '${ManagedIdentity_Resource.name}') + +//Add the Managed Identity to the Contributor Role +resource AssignContributor_Resource 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = { + //name: guid(resourceGroup().id,currentTime) + name: guid(uniqueString(resourceGroup().id),dateTimeAdd(currentTime,'PT1S')) + scope: any(resourceGroup().id) + properties: { + roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c' + principalId: ManagedIdentity_Resource.properties.principalId + principalType: 'ServicePrincipal' + } + dependsOn: [ + ManagedIdentity_Resource + ] +} + +// Create a storage account +@description('Storage Account type') +param storageAccountType string = 'Standard_LRS' +var storageAccountName_var = '${projectName}storage' + +resource storageAccountResource 'Microsoft.Storage/storageAccounts@2020-08-01-preview' = { + name: storageAccountName_var + location: location + sku: { + name: storageAccountType + } + kind: 'StorageV2' + properties: {} +} + +output storageoutput string = storageAccountResource.name + +resource storageAccountname 'Microsoft.Storage/storageAccounts/blobServices@2020-08-01-preview' = { + name: '${storageAccountResource.name}/default' + properties: { + cors: { + corsRules: [] + } + deleteRetentionPolicy: { + enabled: false + } + } +} + +// Create an App Service plan in Free tier +resource WebAppServicePlan_Resource 'Microsoft.Web/serverfarms@2020-09-01' = { + name: '${projectName}plan' + location: location + properties: {} + sku: { + name: 'F1' + tier: 'Free' + } +} + +// Create the App Service +resource WebApp_Resource 'Microsoft.Web/sites@2020-09-01' = { + name: '${projectName}app' + location: location + identity: { + type: 'SystemAssigned' + } + properties: { + serverFarmId: WebAppServicePlan_Resource.id + } +} + +// Set the database connection string for the application +resource WebAppConnectionString_Resource 'Microsoft.Web/sites/config@2020-09-01' = { + name: '${WebApp_Resource.name}/connectionstrings' + properties: { + ContosoHRDatabase: { + value: 'Server=tcp:${Server_Name_resource.name}.database.windows.net;Database=ContosoHR;Column Encryption Setting=Enabled; Attestation Protocol = AAS; Enclave Attestation Url=${attestationProviderName_resource.properties.attestUri}/attest/SgxEnclave; Authentication=Active Directory Managed Identity' + type: 'SQLAzure' + } + } +} + +// Deploy the application +resource DeployWebApp 'Microsoft.Resources/deploymentScripts@2020-10-01' = { + name: '${projectName}script' + location: location + identity: { + type: 'UserAssigned' + userAssignedIdentities: { + '${uamiId}': {} + } + } + kind: 'AzurePowerShell' + properties: { + azPowerShellVersion: '5.0' + storageAccountSettings: { + storageAccountName: storageAccountResource.name + storageAccountKey: listKeys(storageAccountResource.id, storageAccountResource.apiVersion).keys[0].value + } + scriptContent: '$PropertiesObject = @{repoUrl = "https://github.com/Pietervanhove/AEDemo.git"; branch = "master"; isManualIntegration = "true";} \r\n Set-AzResource -Properties $PropertiesObject -ResourceGroupName ${resourceGroup().name} -ResourceType Microsoft.Web/sites/sourcecontrols -ResourceName ${WebApp_Resource.name}/web -ApiVersion 2015-08-01 -Force' + cleanupPreference: 'OnSuccess' + retentionInterval: 'P1D' + forceUpdateTag: currentTime // ensures script will run every time + } +} + +////////////////////////////////////// +// Create and configure a key vault // +////////////////////////////////////// + +// Create a key vault and assign key permissions to the user, so that the user can manage the keys +resource KeyVault_Resource 'Microsoft.KeyVault/vaults@2019-09-01' = { + name: '${projectName}vault' + location: location + tags: {} + properties: { + tenantId: subscription().tenantId + sku: { + family: 'A' + name: 'standard' + } + enableSoftDelete: false + accessPolicies: [ + { + tenantId: subscription().tenantId + objectId: userObjectId + permissions: { + keys: [ + 'unwrapKey' + 'wrapKey' + 'verify' + 'sign' + 'get' + 'list' + 'create' + 'delete' + 'purge' + ] + } + } + ] + } +} + +// Assign key permissions to the web app +resource KeyVaultWebAppAccessPolicy_Resource 'Microsoft.KeyVault/vaults/accessPolicies@2019-09-01' = { + name: any('${KeyVault_Resource.name}/add') + properties: { + accessPolicies: [ + { + tenantId: subscription().tenantId + // objectId: reference(resourceId('Microsoft.Web/sites', '${projectName}app'), '2020-12-01', 'Full').resourceId + objectId: WebApp_Resource.identity.principalId + permissions: { + keys: [ + 'unwrapKey' + 'verify' + 'get' + ] + } + } + ] + } +} + +// Create a key +resource Key_Resource 'Microsoft.KeyVault/vaults/keys@2019-09-01' = { + name: '${KeyVault_Resource.name}/CMK' + tags: {} + properties: { + kty: 'RSA' + } + dependsOn: [ + KeyVault_Resource + ] +} diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/setup.ps1 b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/setup.ps1 new file mode 100644 index 00000000..8f161094 --- /dev/null +++ b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Setup/setup.ps1 @@ -0,0 +1,157 @@ +Import-Module "Az" -MinimumVersion "5.6" +Import-Module "Az.Attestation" -MinimumVersion "0.1.8" +Import-Module "SqlServer" -MinimumVersion "21.1.18235" + +###################################################################### +# Prompt the user to enter the values of deployment parameters +###################################################################### + +$subscriptionName = Read-Host -Prompt "Enter your subscription name" +$projectName = Read-Host -Prompt "Enter a project name that is used to generate resource names" +$location = Read-Host -Prompt "Enter a region where you want to deploy the demo environment" +$sqlAdminUserName = Read-Host -Prompt "Enter the username of the Azure SQL database server administrator for SQL authentication" +$sqlAdminPasswordSecureString = Read-Host -Prompt "Enter the password of the Azure SQL database server administrator for SQL authentication" -AsSecureString + +$sqlAdminPassword = (New-Object PSCredential "user",$sqlAdminPasswordSecureString).GetNetworkCredential().Password +$clientIP = (Invoke-WebRequest ifconfig.me/ip).Content.Trim() +$bicepFile = "azuredeploy.bicep" +$projectName = $projectName.ToLower() + +###################################################################### +# Sign in to Azure +###################################################################### + +Connect-AzAccount +$context = Set-AzContext -Subscription $subscriptionName +$userName = $context.Account.Id +$userObjectId = $(Get-AzADUser -UserPrincipalName $userName).Id + +###################################################################### +# Create a resource group +###################################################################### +$resourceGroupName = "${projectName}" +New-AzResourceGroup -Name $resourceGroupName -Location $location + +###################################################################### +# Deploy the resources for the demo environment +###################################################################### + +New-AzResourceGroupDeployment ` + -ResourceGroupName $resourceGroupName ` + -TemplateFile $bicepFile ` + -projectName $projectName ` + -userObjectId $userObjectId ` + -userName $userName ` + -sqlAdminUserName $sqlAdminUserName ` + -sqlAdminPassword $sqlAdminPassword ` + -clientIP $clientIP + +###################################################################### +# Populate the database with data +###################################################################### + +$serverName = "${projectName}server.database.windows.net" +$databaseName = "ContosoHR" +$queryFile = "PopulateDatabase.sql" +$query = Get-Content -path $queryFile -Raw +$accessToken = (Get-AzAccessToken -ResourceUrl https://database.windows.net).Token +Invoke-Sqlcmd -ServerInstance "tcp:$serverName" -Database $databaseName -AccessToken $accessToken -QueryTimeout 30 -Query $query + +###################################################################### +# Configure an extended event session to intercept application queries +###################################################################### + +$queryFile = "CreateXESession.sql" +$query = Get-Content -path $queryFile -Raw +$accessToken = (Get-AzAccessToken -ResourceUrl https://database.windows.net).Token +Invoke-Sqlcmd -ServerInstance "tcp:$serverName" -Database $databaseName -AccessToken $accessToken -QueryTimeout 30 -Query $query + +###################################################################### +# Grant the web application access to the database +###################################################################### + +# Create a shadow principal, representing the application, in the database +$appName = "${projectName}app" +$query = "CREATE USER [$appName] FROM EXTERNAL PROVIDER;" +$accessToken = (Get-AzAccessToken -ResourceUrl https://database.windows.net).Token +Invoke-Sqlcmd -ServerInstance "tcp:$ServerName" -Database $databaseName -AccessToken $accessToken -QueryTimeout 30 -Query $query + +# Grant the application read access to the database. +$query = "EXEC sp_addrolemember 'db_datareader', '$appName';" +$accessToken = (Get-AzAccessToken -ResourceUrl https://database.windows.net).Token +Invoke-Sqlcmd -ServerInstance "tcp:$serverName" -Database $databaseName -AccessToken $accessToken -QueryTimeout 30 -Query $query + +# Grant the application write access to the database. +$query = "EXEC sp_addrolemember 'db_datawriter', '$appName';" +$accessToken = (Get-AzAccessToken -ResourceUrl https://database.windows.net).Token +Invoke-Sqlcmd -ServerInstance "tcp:$serverName" -Database $databaseName -AccessToken $accessToken -QueryTimeout 30 -Query $query + +# Grant the application access to the key metadata database. +$query = "GRANT VIEW ANY COLUMN MASTER KEY DEFINITION TO [$appName];" +$accessToken = (Get-AzAccessToken -ResourceUrl https://database.windows.net).Token +Invoke-Sqlcmd -ServerInstance "tcp:$serverName" -Database $databaseName -AccessToken $accessToken -QueryTimeout 30 -Query $query + +# Grant the application access to the key metadata database. +$query = "GRANT VIEW ANY COLUMN ENCRYPTION KEY DEFINITION TO [$appName];" +$accessToken = (Get-AzAccessToken -ResourceUrl https://database.windows.net).Token +Invoke-Sqlcmd -ServerInstance "tcp:$serverName" -Database $databaseName -AccessToken $accessToken -QueryTimeout 30 -Query $query + +###################################################################### +# Configure key metadata in the database +###################################################################### + +# Get the column master key from Azure Key Vault +$keyVaultName = "${projectName}vault" +$keyName = "CMK" +$key = Get-AzKeyVaultKey -VaultName $keyVaultName -Name $keyName + +# Connect to the database using the SqlServer PowerShell module +$connStr = "Data Source=tcp:$serverName;Initial Catalog=$databaseName;User ID=$sqlAdminUserName;Password=$sqlAdminPassword" +$database = Get-SqlDatabase -ConnectionString $connStr + +# Sign in to Azure with your email address using the SqlServer PowerShell module +Add-SqlAzureAuthenticationContext -Interactive + +# Create a column master key metadata object in the database for the key in Azure Key Vault +$cmkName = "CMK1" +$cmkSettings = New-SqlAzureKeyVaultColumnMasterKeySettings -KeyURL $key.Key.Kid -AllowEnclaveComputations +New-SqlColumnMasterKey -Name $cmkName -InputObject $database -ColumnMasterKeySettings $cmkSettings + +# Create a column encryption key and its metadata object in the database +$cekName = "CEK1" +New-SqlColumnEncryptionKey -Name $cekName -InputObject $database -ColumnMasterKey $cmkName + +###################################################################### +# Encrypt database columns +###################################################################### + +$encryptedColumnSettings = @() +$encryptedColumnSettings += New-SqlColumnEncryptionSettings -ColumnName "dbo.Employees.SSN" -EncryptionType "Randomized" -EncryptionKey $cekName +$encryptedColumnSettings += New-SqlColumnEncryptionSettings -ColumnName "dbo.Employees.Salary" -EncryptionType "Randomized" -EncryptionKey $cekName +Set-SqlColumnEncryption -ColumnEncryptionSettings $encryptedColumnSettings -InputObject $database -LogFileDirectory . + +###################################################################### +# Configure the attestation policy +###################################################################### + +$resourceGroupName = "${projectName}" +$attestationProviderName = "${projectName}attest" +$policyFile = "AttestationPolicy.txt" +$teeType = "SgxEnclave" +$policyFormat = "Text" +$policy=Get-Content -path $policyFile -Raw +Set-AzAttestationPolicy -Name $attestationProviderName -ResourceGroupName $resourceGroupName -Tee $teeType -Policy $policy -PolicyFormat $policyFormat + +# Get the attestation URL +$attestationProvider = Get-AzAttestation -Name $attestationProviderName -ResourceGroupName $resourceGroupName +$attestationUrl = $attestationProvider.AttestUri + “/attest/SgxEnclave†+ +###################################################################### +# Print parameters for the demo +###################################################################### + +$app = Get-AzWebApp -Name $appName -ResourceGroupName $resourceGroupName +Write-Host -ForegroundColor "green" "Database server name: $serverName" +Write-Host -ForegroundColor "green" "Database name: $databaseName" +Write-Host -ForegroundColor "green" "Attestation URL: $attestationUrl" +Write-Host -ForegroundColor "green" "Application URL: https://$($app.HostNames[0].ToString())" \ No newline at end of file diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/DecryptColumns.sql b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/DecryptColumns.sql new file mode 100644 index 00000000..9e296ddf --- /dev/null +++ b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/DecryptColumns.sql @@ -0,0 +1,17 @@ +ALTER TABLE [dbo].[Employees] +ALTER COLUMN [SSN] [char](11) NOT NULL +WITH (ONLINE = ON) +GO + +ALTER TABLE [dbo].[Employees] +ALTER COLUMN [Salary] [Money] NOT NULL +WITH (ONLINE = ON) +GO + +ALTER TABLE [dbo].[Employees] +ALTER COLUMN [LastName] [nvarchar](50) NOT NULL +WITH (ONLINE = ON) +GO + +ALTER DATABASE SCOPED CONFIGURATION CLEAR PROCEDURE_CACHE; +GO \ No newline at end of file diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/EncryptColumns.sql b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/EncryptColumns.sql new file mode 100644 index 00000000..86e38396 --- /dev/null +++ b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/EncryptColumns.sql @@ -0,0 +1,14 @@ +-- Data Owner's script - the user needs access to the keys + +ALTER TABLE [dbo].[Employees] +ALTER COLUMN [SSN] [char](11) COLLATE Latin1_General_BIN2 +ENCRYPTED WITH (COLUMN_ENCRYPTION_KEY = [CEK1], ENCRYPTION_TYPE = Randomized, ALGORITHM = 'AEAD_AES_256_CBC_HMAC_SHA_256') NOT NULL; +GO + +ALTER TABLE [dbo].[Employees] +ALTER COLUMN [Salary] [Money] +ENCRYPTED WITH (COLUMN_ENCRYPTION_KEY = [CEK1], ENCRYPTION_TYPE = Randomized, ALGORITHM = 'AEAD_AES_256_CBC_HMAC_SHA_256') NOT NULL; +GO + +ALTER DATABASE SCOPED CONFIGURATION CLEAR PROCEDURE_CACHE; +GO \ No newline at end of file diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/ListAllEmployees.sql b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/ListAllEmployees.sql new file mode 100644 index 0000000000000000000000000000000000000000..f8661c671f6294ce4e6528af1a2e608afde3e738 GIT binary patch literal 242 zcmezWFPOoV!3T()8A2Eo7@~o!T!sRM9EN;`N`_P*^ki^hh-Khq-~!4bpbk)FFcA9T zkaJ_mWGG@NW+(xwNCcXgibI_bP?oT&V4$iTAT9#B3E>tuh9Cxi24AqNQy7wfE{I2kt=i0Ksx1W&i*H literal 0 HcmV?d00001 diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/QueryColumns.sql b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/QueryColumns.sql similarity index 62% rename from samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/QueryColumns.sql rename to samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/QueryColumns.sql index cf8e4add..7a7e8975 100644 --- a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/QueryColumns.sql +++ b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/QueryColumns.sql @@ -1,21 +1,18 @@ -USE ContosoHR -GO -SELECT * FROM [dbo].[Employees] - - -DECLARE @SSN CHAR(11) = '795-73-9838' -SELECT * FROM [dbo].[Employees] WHERE [SSN] = @SSN -GO - -DECLARE @SSNPattern CHAR(11) = '%9838' -SELECT * FROM [dbo].[Employees] WHERE [SSN] LIKE @SSNPattern -GO - -DECLARE @MinSalary MONEY = 40000 -DECLARE @MaxSalary MONEY = 45000 -SELECT * FROM [dbo].[Employees] WHERE [Salary] > @MinSalary AND [Salary] < @MaxSalary -GO - -DECLARE @LastNamePrefix NVARCHAR(50) = 'Aber%'; -SELECT * FROM [dbo].[Employees] WHERE [LastName] LIKE @LastNamePrefix; +SELECT * FROM [dbo].[Employees]; + +DECLARE @SSN CHAR(11) = '795-73-9838' +SELECT * FROM [dbo].[Employees] WHERE [SSN] = @SSN; +GO + +DECLARE @SSNPattern CHAR(11) = '%9838' +SELECT * FROM [dbo].[Employees] WHERE [SSN] LIKE @SSNPattern; +GO + +DECLARE @MinSalary MONEY = 40000 +DECLARE @MaxSalary MONEY = 45000 +SELECT * FROM [dbo].[Employees] WHERE [Salary] > @MinSalary AND [Salary] < @MaxSalary; +GO + +DECLARE @LastNamePrefix NVARCHAR(50) = 'Aber%'; +SELECT * FROM [dbo].[Employees] WHERE [LastName] LIKE @LastNamePrefix; GO \ No newline at end of file diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/QueryXevents.sql b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/QueryXevents.sql new file mode 100644 index 00000000..6c6d54a7 --- /dev/null +++ b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/TSQL/QueryXevents.sql @@ -0,0 +1,56 @@ +DECLARE @ExtendedEventsSessionName sysname = N'Demo'; +DECLARE @StartTime datetimeoffset; +DECLARE @EndTime datetimeoffset; +DECLARE @Offset int; + +DROP TABLE IF EXISTS #xmlResults; +CREATE TABLE #xmlResults +( + xeTimeStamp datetimeoffset NOT NULL + , xeXML XML NOT NULL +); + +SET @StartTime = DATEADD(HOUR, -4, GETDATE()); --modify this to suit your needs +SET @EndTime = GETDATE(); +SET @Offset = DATEDIFF(MINUTE, GETDATE(), GETUTCDATE()); +SET @StartTime = DATEADD(MINUTE, @Offset, @StartTime); +SET @EndTime = DATEADD(MINUTE, @Offset, @EndTime); + + +DECLARE @target_data xml; +SELECT @target_data = CONVERT(xml, target_data) +FROM sys.dm_xe_database_sessions AS s +JOIN sys.dm_xe_database_session_targets AS t + ON t.event_session_address = s.address +WHERE s.name = @ExtendedEventsSessionName + AND t.target_name = N'ring_buffer'; + + +;WITH src AS +( + SELECT xeXML = xm.s.query('.') + FROM @target_data.nodes('/RingBufferTarget/event') AS xm(s) +) +INSERT INTO #xmlResults (xeXML, xeTimeStamp) +SELECT src.xeXML + , [xeTimeStamp] = src.xeXML.value('(/event/@timestamp)[1]', 'datetimeoffset(7)') +FROM src; + +DECLARE @xe xml; + +SET @xe = (SELECT TOP(1) +--[TimeStamp] = CONVERT(varchar(30), DATEADD(MINUTE, 0 - @Offset, xr.xeTimeStamp), 120) + --, + xr.xeXML + --,CONVERT(nvarchar(max), xr.xeXML) +FROM #xmlResults xr +WHERE xr.xeTimeStamp >= @StartTime + AND xr.xeTimeStamp<= @EndTime + AND CONVERT(nvarchar(max), xr.xeXML) LIKE '%SSN%' + AND CONVERT(nvarchar(max), xr.xeXML) NOT LIKE '%sp_describe_parameter_encryption%' +ORDER BY xr.xeTimeStamp desc) + +DECLARE @st xml; + +SET @st = @xe.query (N'/event/data[11]/value') +SELECT @st diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/contosohr.bacpac b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/contosohr.bacpac deleted file mode 100644 index 7438a3c07f3466a6256604284148915a492c75eb..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 11368 zcmbt)2UwHa(k_Ug2vS5usz?!$l7tX?@4a_K3?Xy~B%wtDA_6J`(m|SnbdV;X^j@S1 zBE1Pn@4a(_?(Nz8oPF;9-{*#Wd9upPto2S=i_B=L5?s8Fhlh6=@1l;hPD<8l0OdtI zJV6>fJYqZsJV%5j+=17_(SbSTCf?mQ=M(?)wPNImm=dBm9gSF(lsoVy{_@B;asK^X z0JVt?r*xD?&J|i~ya{2qem9|_n$zZs7yK_~z8|PE+ab`ob`SmUdJ zIp2?F8@e!3=mn^CydP~;^TEt{dz?*^@7w^fy+J)wG7qRtB%A&cc8_HiO7i}bh5*Nz z+k#oShH6V0+Y_#`?#yr#jbQ6ePgc%PyL?Y+yk>U?_QUUbWcDvVCGL3@Ocr^+fFg2< zpM9?J%?cCz_F?Y*2diEVCKoSvlA6A$2~(+c1T{SgX!ABr2i#aX<5=*GZhc zR_rB7wmxzxQ2kI$lzNRpR{ya|XA}SZKEs}oj37+B?8SPaRDK2XR&2uoZ>dnQFIYW= zIG(*x$=}lO4#o5Djc?QzEp6KtD!K^16MHXw&&doyNIhop@*1mZ>N{+jfA93Lmf+g( z>oG@1^yL8bMb~5{0;pgk#bBf_hUi1wT^@asbhhtz-UwkDemq?tm5SciIaay{Vg}dZ z6Z9#ZlFlVQ-J;}HH+@AMxGt8gPTLgwm3X@2U1@-D?jb7ey1$4K@XCP7ssF+A9Yo+%}*iO$%PkXCwJ{YKfs4}1E7BJHDuaj9j3=BNwsDYu2V z^#*3sBubz*E?l{CRoKB0s#oq^*vfhL{(_X~N*X@)WkJu`a#Pk zZk}$$9#v%?iS{p^@&-FNt`7vswyA)MdOKGFsSf6`c8Z`F&d1)|#&?PoYUB@=bl}(7 zF2cj)ZmPR5k!2E+dP))9gMY-XmI|OrXiZCvbN$E6p0!1@McfE9x|a6iR-=@m>QHpg zgOC1{G1Bdf;&JHtsZWO%^!KC3w~YC4?_rhp(^yE7`Z!vXO4APL}i(}9a;9YmHX)BkbJ;I$fS3c z7h~OXLhXr9^O%`;v*VGQ>DQ0WnL$aeFhvS@T;L`=~OAG zQj`*g7Y@=OP^$ji)0XwLO@UD_f;1CN^F@y)KUbtGc2Uy{v08JC*mtfUv)ynP{URsr zA$UNQDcrd@IlO8gRS+6~UF%Hx!21!`MBC=KlTI_l*hIyN_Zhj?-(m{aMy7ufE^5@_ z9&%hvk%Pk2;b^EO6b=2KA`2u0L{<+Zm3L=brGRs2h~AD&CjpZ@6G!UOWhtvLP&h+~ zLK>-`U76QBojCPgn^P?jlq||opRusyVzxTkz#a@d>nJ4Kte;?2NxL+dmMY)fJu2YrcsT zW(t4enG`WiqpS*2t(&;Zz3$g@>+jn{aJES_;I^oTkB3Kv+oq{3!U+v`LYwP(I>S+B z|I=2nTB7G$tx}1kF5xA;{I*od%Z-Saf^d&@nC-<_c0#Z(s|%rwFCl(v@FS78L^_*u>Ez8uM?&tDscZatj^wQ zbwNrD82TSVSQQ(Y^pD!>V6r~k7}T-NjVhBSX<=k$HlzBuV*P&VG1=eo5EK@@9@N4CE{C%N9v~2S{s4izGO}9#x3ebLlsNXj zew4QvabkLJmYzsrB3q*WQ|`n{%$k0cA^zLqK<+PWx1n)DS*v>GTva+|iC^&3TwvGx z+@RXhrj`_6!d_;wil|H#T(LlFX)D-_YR9(CPYO8gozB&)RcTyE9=nx@&O}XASs!%! zbbUhTM8OXX#y^_`FKQZ|beQ@cf(sUNOAP9=jaCeL?wPXZn4TEJ@=8tmk`tp(MKH%L zuC6K)`PGi>w$s)cZB~6g-}-N`e}k*1sSVlbpY3G&*lM3WXuQHog($g`L;b<>L0h>U z`C-O*C@d}as!Gb6q|t1N32XLmDo1^5W{YcwISW($pq;^*yrcme&qY(!xyao7q#9$a z+vN4E@kh;_@hR`NGqB48-!=0BP3$X%QZs~+v@mB_qdW0+S@ zdcTw5UL~u%XlDNje?FJ0W+}g}x<(_BXh`gxSAu9QE#G2s=VHXk;#SEkJN-wTy2u$b zaErQOxN*qqA1?3@=CQS} z%j~!3PZT%^95?wBndOEBmMtZ&>17O@8f#U2$pAE1-&;3<9i?-08wp(6ZI=nE9u6A! zRXlPuNOm+#e(zrylH|SUI0Hr*bTxg&u8uW#Ck*@McU2o;4c1D?i?EAjSCVpSLOcXR zZMBMM=LbE4LnvwH#))|rZgNVYsB;Jo*GLSNd=_X{#q7EQyTEVv2DgV&dfi1G(pCf> zL)fi|Y9Q7_UX5x2J>jr-KcHouUmj6DGEY5ykg_&CYM5kL!|b-oP}%Hz>a{cDY8QH< zQjz%O(Ur}_&l6;;%c?eH=Rj8#p}^n`-KRI{-p&zNS<~o+asT4S*~dOZtS69!2W!u{#h5qZQ1Bk z!dzK{?#BW*GNH6$9l~V5mubsH?4tSiCHK&L$BR0+OP|F7Uip{tY|6K)3oLn-s181spwVr0Ek?^!n?Gn&WX=0op(^IiA%3=#OHBI`HFB_Z#vzI8{I zXe*cEK|gp^g|F3(m(ZY@y&n;#((I|bJBKj9*qM9n*76EVvu$`lIy>X4D)xj+1s;>R znxanJ70)j%*^u;g)A_rIw`wc5?mpZrI7lKW7M~0XGE;pj`lWLG$Zht`g`($TpEOr0 zxjJ$LLl9XG2jV1=D3_s2cQ zR;^aD2#n60MWRFOS2`D~JfEt-Ys&^KGBMC2vf1dWIq|Q~Ox!WSg`Brc+D&1;k;*EJ zQ(f^QyGmvir#sq;`d`y`iQg(>N{+lOL878^N32y$$i&U&2s}{@$0-kOZ!hv)HwoO^_MWqjxdG@oA!Q32@3QGqo~_8x=9fl(LqxLy-F z_@|e=*SRmfRw=VU_55hok$H(GM|9Np)a<4jZI3bef`s!vuf>Oisr>`;(6P%;saH8D z=X#Pjivn*P_Z@ihSma+isvQUsjt~Gzwi6f4)QVW>d?!A9SaE%(;uUnb%}4RLZJPJx zhIMGzEIup(TGjWq(wYZU<^Ph2s@Qi<)GY)}#1d#xiVl%B~dACIjw`<@@iJE6879m`@x~8w?mM zlpRuFQG1h=sVy_WKs`8-+e^iQDzD++VNrNb)vPW>WTxJzq|>|nXuYVdEhw&A4SugA zh2TaR-7ek3y!%!PK^~~B)fx@^fTrTXl3SmbYS`O|%j<>*0zg_s`S{~rM|IROQgdPX z{4x{5eGVgGmnxWzW%^$0V_4#oeLTLo?W+ZpsDvC(NNbFDz0mD?fASzn{I~=4)g5TX zxTyq%@%DUP2PTHf5nPIU3zsy4@3n3w3Q1GITS2k6``@yF76RoLhgKG+5yA> z0cD`@7tsEB@lxc_kHIR{WLL#+9W=KMM4sJT5t1(}%A6eU$p>VAdScMgBGy_r@nPo( zD(h*dX@t58Fp*qSX%3onh(6F*V{IBPXFL_fvl<}dsh>XGuTDFYx^Z1Tct6Zay3;N+ zO>6cQb7L{d+?sS6HATdxB^aMlMo12GoePA0M`il{>iA{bi0=EtO3sduK}9a3Ba_37 zf?d|Nnjg77mKs}=$r_{)_I30X--EB2>9EUHqMU6uW~#pA12qDNzCrs?-@E!5*x&|ai4?ca#a9CW`8)AC%anNc$o}S}F zy+FF@+-4t{v$MFx$7rulH{aH&BeEtGC8KYC4#&6bfl$qUeJ-AU*X#v6DWIiVD7AHY zC1CWnW(XIp)T6>^YK<`(HwujziBBGqX!z6sP_C0UBD;tathsdjwy?vwCbL}Jg$tEeOJr_|5rhR>13tsy41d#e0Y0!ySHDMO2cjRP8m0+e~(RG{eIgxa{av z=PNNMRel|G?NJUrcFgH^Y6v`f{vBoMlWKfQ3O-*Ks_x~-;ujQRoC~@4N=&erTkmv@ zDk5kN`0cuf7u=c`ug06P$7FIdct~3IM#gY|wG(lPc!4UPR3suFGg8Rc1@Ri^CPv!^ zdcTupZ*{_YPGqkd&CrghAoA(-Po!6?$vuBCCyRU4Z3T;axJ8#Fsj5X`U{~YbN%#bZ z1N?Uu!gBUFFfOYOMxe`~s4(?+_W)t|`7rI?4!AmNNcL^Lu17g2v zd*f+-%RK;YJ=mIR9Q1ny>8I|$;~+d`T>jd;d$EASa;fUpu;>wmM?|;SD~_bOFC;_K zHP-?>%c<$SKLS6#rW35@`Sv71r2faw@}kEoVQX!NHSUlIEg6BwixgeT<5ZE4tWm%;7FPGn3frDYWK0mgV!rS}1{&t~8#&ee~trGd)2Triv9G z=QdGVf&&W2`!)mV(d9<^ANXDzsjU^FZFkL<-G`y-%i%rj4Z|PmGYnpZQsmcEc!1U3f{fc7ey@yVWhlzcx5YP|by z(SKJDz~XZ5q&9!X4Qb*m+kUP^+wVBjq3}N@~xkrhGRnv4Z2UIqSV||vycHdC0=tnUA*@UPIT*I z@uHvHnv!B~4D~XgoSmn*5sqiOBmqdk%8f85Cx&tFN65 zb$3?yM^hU_!bZ!Dru#mA6|%Kr@{5=NoftHlQNW0Kz4+W;bB-yvDVu<78@J3&1iuTo zMWhXc!5OU^dbQVtm2JPClszHI@VYAiDT=#Fn({v5(tt_)ATh)<({nne>kxR%`tYJv zn@k#?Q3Kf|9^8Kjgy6;6bSTcVrjy(e?tqPRhf5+}xDq^NXBgXBATDcoz-wHkxYqGK z*EF`K{EIG^v&se4OXkL∈W#*)V)(J_(x9MlXBk9S@|{j$$2tqS2*#t0*p1oIyzq zMk%@>GxXKLe1jqH!Off*(rKj>7J_#pPhtlQvV!w&5387OgcUaA-fXM@%aQkNFSU`4 zgU=E|r#r%P2s8vY6IvE{4d^+pvy5mai+sl-n-bSms3?00!sBA0a*$VxV9_ei?xEzz zW{hrk)mvndb-W6}>%JnpVtY;dH$R+gCM;H1P||A6@d>|&XQYvaB-PXX&=z`RF@HLl z9EZiWcchB#N4FFE#}W0*dgGN{-7U7e(f>t^FMrjkOL&xGr8r@=k2ziRF*IJ`zzww< zb*L#b&0Ab;dB=|<^^rRya<;K@vvKoLEIB*x{b4oxBD&(T8%D-3bJP6}R>`WSPcbLo zZM>JKDm8LN#xG%?JIstlAEkrWU~D7N3joWu%W2@T=NWAgK^sRx@m3iU`qb(RjpM%Sz*7)1-?{FI}Tr5uED4Uf z)%-3fA=Ow8EcDj0Pa+B;@U}Xq0M=1Fv6p(F_@=^(lY`0Jx|mE>oF_jHTkCw`e;E#%m-d;D&-VY;^JD8A^4rWqxrnJOAp1t zq7Ws@H#ca-i@){$7#s_)>Q+ZfD0(}JxX&tR^LB_cekP-t>Yyy9Jsr=3Nt#oSeO<4= z_c<7zXW;6+;JA>vK$5}P-$HI|o*AxO+&wI76(-!*5>I)%*XMbA;DeY-&I3dthK0Gi z4gam(byd#l5cF5!vg8f_A&9I>c ztdj_gpNXYcVC~E5t%|AU-{30jvQ6@=3nbchFdw+N5No;Yq&QMLn%}Fa-g0+bA9!Cj zrAn=xwKVB<`OIxMNB&Z6&E7D@2tNL{-+?0SLA8I#;pZnCSax!~+z#?g}!0)x9LFgVwX~Adf z(9LDV#Z$kp2D$_SMN{jVaT}r0E7ea5#e8v1)Iuo5!29f=S$w zf9IWATa#w#Q%2xI+0_R{YzIOhBZ|?ELkDNkxPk5UM)pQ!4y$yJ%|hawq-W~Sy_!D+ zUd|DQn%Asbsi(3X(G6dPO_D{MQJVYncDXL$xIudB}BGqqwZ z-ev@$et%5*CCe<-?%lHtjzSgFkACQ-PLgC6K2=x8MNkh+udZzick5nBQJ@qa@t*Q# z4d9nRnS}K4Ugp#caT^;IYQWH0yW1RbPxB~}=~-0eu(uzJekk?c`-nhR-&7xPR9y|# zZ`dWsPzqj7FheDX0m{R|pvhY$@0MZ7<~uxHxugRWl2KVjdfyxke5u};wC?51uf8c` ztXYW3sqP%d>cyy5%?4YjxvChfT13`fs2|^46X`zC?7Hl~cF{}2s1KX*F9|K-EDtcC*M6{ zkCuhuz!>isvu&Fiq$W4b;BSzc)NTt;UeuT`QFqT6?Njd79;~C+JPJ?I0rY zcEi|;ae}Wb54&tM5n|$)hu3hgHTOO9&> z$=m&Pc#Cts*CHj2oeuB&$A2&AsL$Axv>byv3A8c>iN!`P=hjE&aAmmn`1RmwNQy+Q|4|pQtLSv8y&3 zLPDL4TQD~v@XG>)F11d_LhK}yX+yl-%J%)EQZwt*r*4!ENLm!q8p|kFb+Mw~C7SK) zI~DZAS#x`~H=QV|nQ!ksABTEd=ami9()E`7Q)q8@wq+O7ZRCxlAD|4CH7^m^M{483 zo8!vSiTqeQ%uaU>_bliudBJxO{=G#O`*#w3u|)<5p*s6vH;;aRg+sFup#7Mk=2J;< z@#D~jYYF!yPJN95h3+sXi`Emsf{r4sN%m2Wi(+4gT7bmx)LD3fIQ`}c!}@R_&GpzQ zlE_<+Z**>3tc%x}taDlQWs9MIHW%743Rkw@K^h2m)8!`T(uJD-wfyZ zUSWnxKOx@=qHk};-!#i}rCd`l^Di<@eX;r0>+oWnUt4ooe5bKXv~RoyxMJEvpF!s{7I|VuXCnrNXjGL zgI;u1p}%^iOTH%Sg%cNH!pZ&&AS@&%cHyl6u=WsHmvbX>Wx0b-T5{3 z?kP*vlzzg{Xi+Ow;fL9?BnX`m#;_a1YQI`N8FW)qt9MOmxJkr?5tRXUv zLpsJth9cLSJCu#@Hc^wA_M8l|no0;v?=8O#%8z>?ueg#`sWNRyQ;}Z#Y+k9bg#vzrF#~wB&3b@8?9W>eX%l9y;ZDwR-y=?TAizmYu$LY0!Q}s~XT7fCv=#g~P&qtj^56zTGZYN*`=m zb;4(yVr--}_;E_Rbz1*g8Q7Lywsb#?h)@63w8&ck>WO!Mh*Vh&?ss8oH^H&Xf>vdi z#?p{>+^@;kP3Imu(DfX3PP{C<)*JZJ33q>JYD3gKBYd=;9xZn~zE(Y>&)(=x_yf7^ z>tJ-EJd-Xn)VdYwwLUUU_52y(r{&9sMu76UjASmx#`W}M>{%a(cw^Wr7ug|0?mCG< zp5E|qtms`ND_}WUyOg@P6H1;(7ys&t-uO6$dAJ~-M%9>iIV9kuEWt&A<&-Sg(}ykS zfp2ADVQ5BXqX_qIU}#sa#&w;=6eUSf1ovVPy$1X&Wz)L_1ktDCyaDhILm=iJ6R<=*dC<-U^VHK{}y zT^;M=vzm${uIp8ct?-&>Z;6i}+|HT_4nHZ3C%W2TdWVgQ^2KXGdxB-z*;{;^Unrv* zuZ$ItT5Od1fm=8(`lXCq#mCUPG;<(SUzeRu`U+}v_TQOt!tf7m4$g(Op#?MO7uL<% z$A!pVmZWPa$x+GmBz4l+Z`12#m_rdGR2uhgyFRs!dw~0&?RKC@e+TADeqsG{)gTzh zou_jLZ&xbU1*G)q?8jmv4NDrG7}L(Y%wK7=qPxkLV#S<0Ic|LR5`FFs-FB+|($5th zajkc)AkSk!PSX8Qx#ufIJk{#ON1>ZOTLgyOSui#^l+mTkNb$~-A%25-!xDSWe*H3z zJX2xebmhQ7Ua$uAB~ns*;-vh#;FuaIV^y9H2FvogWq;`Cp0a?*17!H+a+P4(7DzSl<;QpI8!{pIHO_No?XNv?h3 ziCr!zJF8Z-&tQKy96A9)(#odhfiR4nW}S(Tt0WUXI$&gwu)d6SZco2iJp~{pZQs=M z(b^Euo5=NbhNdbbD~PJ1NN;hcR&mzt8ba>{K*%MWdE)eaaoBaF#=VZp!n zT2E(_SaN)^R~Kljni`MCcE`o{8FIQ}|Dj z+)7TA6ui9`+c}yVHdIGGF*OgBELQ5z=I|bSd2{)+=?LsYaGnUf^0Q9lyr!hq^u>E8 zTvGJ>A;BdA&5>{i6oB{q^Z%CVTdSxMlRU3Haf2gKwg@M277#Cxg&FPyLs;56S&Or{ zqOEv@SR^IHbl?t9G;RjU#?~3dj3aSEiL=wo?3e_L7BJ4~n#gqs3VO=PAtp zU22nsS=myYMF$RtTR?yUAPC%opWn(#n1vbek0O7qUL2P-{r`~$gn>bVU?D3(K`4YD zYVk`N;BTl&{7Yp-IF-?WF?`R7@bJ!`D>#*DB5kd0o&Kj3_WxRASFecSiU58w{V)1* zw1puND1;T77lv>Ipj;eKa3szU0G3b~Ko^d*g*w<`eku&7J`f)O$j2ga^$IhynAR_) zY9Vn7N1|=vsGr@q0fS#wBmw5dnGr8g4De^iIT>#JJX;U7bwbH|I3ti~xaGM{CD2G$ zxESCchyEbbMI+%*$3J-eDePb3n179HKpk-gbk34Rg6~}Xe=gv^(ZJ7><&L;Ig7Z}% zZ7p2U2qcO{;^!v*lZzPO9~LAA_-9naG;tXH1o2Ohlr3?BY|)+)0zzOb3w|L8k1$jK z%EJ#7V64i3ZFva1vNFWz$Q85U3!T+{hy9GAc$`tM!8=y5yN zf+HPmQRgQD&Wh0RbJvjI!(sCe-T$IN+B!m!o;ZEuyagXf^!ENZT?ccNX&X0w2X1~7t>c{Ej-#7XvAU|~@_AAVs@4yy?wuSwPg_thF z6$$%U6LXG-t}O<~8pID2!cqU{$RDzP3f4im|3p;}frdKhL9HeD1aYqO&qL>QIJf#4 z>HcjAVzM@Hm_5qX@%M`U>|oYM+TzZ--xZ-O60$%Apd3(I7R(P4l#`Yh0Lk%53rj=VykIfFKlGp5+wUU$`W}`aiwPE^hz;