diff --git a/samples/features/security/contoso-hr-sql-db/README.md b/samples/features/security/contoso-hr-sql-db/README.md index 96987045..acd7bae3 100644 --- a/samples/features/security/contoso-hr-sql-db/README.md +++ b/samples/features/security/contoso-hr-sql-db/README.md @@ -33,15 +33,15 @@ You also need to make sure the following software is installed on your machine: Get-InstalledModule -Name SqlServer ``` -1. [Bicep](https://docs.microsoft.com/azure/azure-resource-manager/templates/bicep-overview) version 0.3.255 or later. You need install Bicep and ensure it can be invoked from PowerShell. The recommended way to achieve that is to [install Bicep manually with PowerShell](https://docs.microsoft.com/azure/azure-resource-manager/templates/bicep-install?tabs=azure-powershell#manual-with-powershell). +1. [Bicep](https://docs.microsoft.com/azure/azure-resource-manager/templates/bicep-overview) version 0.4.63 or later. You need install Bicep and ensure it can be invoked from PowerShell. The recommended way to achieve that is to [install Bicep manually with PowerShell](https://docs.microsoft.com/azure/azure-resource-manager/templates/bicep-install?tabs=azure-powershell#manual-with-powershell). 1. [SQL Server Management Studio](https://msdn.microsoft.com/en-us/library/mt238290.aspx) - version 18.9.1 or later is recommended. ## Setup 1. Clone/download the repository. 1. Open a PowerShell session. -1. In the PowerShell session, change the directory to the Setup folder within this demo's directory. -1. Run the setup.ps1 PowerShell script. +1. In the PowerShell session, change the directory to the setup folder within this demo's directory. +1. Run the setup.ps1 PowerShell script. 1. When prompted, enter the following information: 1. Your Azure subscription id. To determine your subscription id, see [Find your Azure subscription](https://docs.microsoft.com/en-us/azure/media-services/latest/setup-azure-subscription-how-to?tabs=portal). 1. The project name. The resource group containing all your demo resources will have that name. The project name will also be used as a prefix for the names of all demo resources. Please use only lowercase letters and numbers for the project name and make sure it is unique. diff --git a/samples/features/security/contoso-hr-sql-db/setup/azuredeploy.bicep b/samples/features/security/contoso-hr-sql-db/setup/azuredeploy.bicep index 13ffcb28..229b7429 100644 --- a/samples/features/security/contoso-hr-sql-db/setup/azuredeploy.bicep +++ b/samples/features/security/contoso-hr-sql-db/setup/azuredeploy.bicep @@ -17,7 +17,7 @@ param sqlAdminUserName string @description('The password of the Azure SQL database server administrator for SQL authentication.') param sqlAdminPassword string -@description('The IP address the user will connect from to the Azure SQL database server.') +@description('The IP address the user will connect from to the logical server in Azure SQL Database.') param clientIP string @description('The location (the Azure region) for all resources.') @@ -27,7 +27,7 @@ param location string = resourceGroup().location param currentTime string = utcNow('u') //////////////////////////////////////////// -// Create and configure a database server // +// Create and configure a logical server // //////////////////////////////////////////// // Create the server @@ -104,15 +104,6 @@ resource attestationProviderName_resource 'Microsoft.Attestation/attestationProv properties: {} } -// Grant the database server access to the attestation provider -resource AssignAttestationReader_Resource 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = { - name: guid(resourceGroup().id,currentTime) - properties: { - roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/fd1bd22b-8476-40bc-a0bc-69b95687b9f3' - principalId: Server_Name_resource.identity.principalId - } -} - /////////////////////////////////// // Configure the web application // /////////////////////////////////// @@ -137,16 +128,18 @@ resource WebApp_Resource 'Microsoft.Web/sites@2020-12-01' = { properties: { serverFarmId: WebAppServicePlan_Resource.id } + //Set the database connection string for the application resource WebAppConnectionString_Resource 'config' = { name: 'connectionstrings' properties: { ContosoHRDatabase: { - value: 'Server=tcp:${Server_Name_resource.name}.database.windows.net;Database=ContosoHR;Column Encryption Setting=Enabled; Attestation Protocol = AAS; Enclave Attestation Url=${attestationProviderName_resource.properties.attestUri}/attest/SgxEnclave; Authentication=Active Directory Managed Identity' + value: 'Server=tcp:${Server_Name_resource.name}.database.windows.net;Database=ContosoHR;Column Encryption Setting=Enabled; Attestation Protocol = AAS; Enclave Attestation Url=${attestationProviderName_resource.properties.attestUri}; Authentication=Active Directory Managed Identity' type: 'SQLAzure' } } } + // Deploy the application resource sourceControl 'sourcecontrols' = { name: 'web' @@ -158,7 +151,6 @@ resource WebApp_Resource 'Microsoft.Web/sites@2020-12-01' = { } } - ////////////////////////////////////// // Create and configure a key vault // ////////////////////////////////////// diff --git a/samples/features/security/contoso-hr-sql-db/setup/setup.ps1 b/samples/features/security/contoso-hr-sql-db/setup/setup.ps1 index 22037985..33d3560c 100644 --- a/samples/features/security/contoso-hr-sql-db/setup/setup.ps1 +++ b/samples/features/security/contoso-hr-sql-db/setup/setup.ps1 @@ -151,7 +151,7 @@ Set-AzAttestationPolicy -Name $attestationProviderName -ResourceGroupName $resou # Get the attestation URL $attestationProvider = Get-AzAttestation -Name $attestationProviderName -ResourceGroupName $resourceGroupName -$attestationUrl = $attestationProvider.AttestUri + “/attest/SgxEnclave” +$attestationUrl = $attestationProvider.AttestUri ###################################################################### # Print parameters for the demo