Add files via upload

2025-12-08 14:58:54 +00:00 · 2021-04-08 12:11:18 +02:00
parent 86401dc29c
commit a0389d5b64
6 changed files with 488 additions and 0 deletions
@@ -0,0 +1,367 @@
+////////////////////
+//Define parameter//
+////////////////////
+
+param objectId string
+@description('Location for all resources.')
+param location string = resourceGroup().location
+
+@description('Project Name')
+param projectname string = 'eaeaedemo'
+
+param currentTime string = utcNow('u')
+
+param adminUsername string
+param adminPassword string
+param AADSQLAdmin string 
+param clientIP string 
+
+//Make the subscription Contributor of the resource group
+resource AssignContributorToUser_Resource 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
+  name: guid(uniqueString(resourceGroup().id),currentTime)
+  scope: any(resourceGroup().id)
+  properties: {
+    roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
+    principalId: objectId
+    principalType: 'User'
+  }
+}
+
+///////////////////////////////////////////////////
+//Create a storage account with a database bacpac//
+//////////////////////////////////////////////////
+
+// Create a storage account
+@description('Storage Account type')
+param storageAccountType string = 'Standard_LRS'
+var storageAccountName_var = '${projectname}storage'
+
+resource storageAccountResource 'Microsoft.Storage/storageAccounts@2020-08-01-preview' = {
+  name: storageAccountName_var
+  location: location
+  sku: {
+    name: storageAccountType
+  }
+  kind: 'StorageV2'
+  properties: {}
+}
+
+output storageoutput string = storageAccountResource.name
+
+resource storageAccountname 'Microsoft.Storage/storageAccounts/blobServices@2020-08-01-preview' = {
+  name: '${storageAccountResource.name}/default'
+  properties: {
+    cors: {
+      corsRules: []
+    }
+    deleteRetentionPolicy: {
+      enabled: false
+    }
+  }
+}
+
+resource Containerbacpacfiles 'Microsoft.Storage/storageAccounts/blobServices/containers@2020-08-01-preview' = {
+  name: '${storageAccountname.name}/bacpacfiles'
+  properties: {
+    defaultEncryptionScope: '$account-encryption-key'
+    denyEncryptionScopeOverride: false
+    publicAccess: 'None'
+  }
+  dependsOn: [
+    storageAccountResource
+  ]
+}
+
+////////////////////////////
+//Create a database server//
+////////////////////////////
+
+// Create the server
+
+var SQLServerName_var = '${projectname}server'
+resource Server_Name_resource 'Microsoft.Sql/servers@2019-06-01-preview' = {
+  name: SQLServerName_var
+  location: location
+  tags: {}
+  identity: {
+    type: 'SystemAssigned'
+  }
+  properties: {
+    administratorLogin: adminUsername
+    administratorLoginPassword: adminPassword
+    //version: 'string' //optional
+    minimalTlsVersion: '1.2'
+    publicNetworkAccess: 'Enabled'
+  }
+}
+
+//Allow Azure services and resources to access this server
+resource Server_Name_AllowAllWindowsAzureIps 'Microsoft.Sql/servers/firewallRules@2015-05-01-preview' = {
+  name: '${Server_Name_resource.name}/AllowAllWindowsAzureIps'
+  properties: {
+    endIpAddress: '0.0.0.0'
+    startIpAddress: '0.0.0.0'
+  }
+}
+
+//Allow Client IP to access this server
+resource Server_Name_AllowClientIP 'Microsoft.Sql/servers/firewallRules@2015-05-01-preview' = {
+  name: '${Server_Name_resource.name}/AllowClientIP'
+  properties: {
+    endIpAddress: clientIP
+    startIpAddress: clientIP
+  }
+}
+
+//Make yourself an administrator, so that you can connect with universal authentication
+resource Server_Name_activeDirectory 'Microsoft.Sql/servers/administrators@2019-06-01-preview' = {
+  name: '${Server_Name_resource.name}/activeDirectory'
+  properties: {
+    administratorType: 'ActiveDirectory'
+    login: AADSQLAdmin
+    sid: reference(resourceId('Microsoft.Sql/servers', '${projectname}server'), '2019-06-01-preview', 'Full').identity.principalId
+    //tenantId: AAD_TenantId //optional
+  }
+}
+
+///////////////////////////////////////////////
+//Import and configure the ContosoHR database//
+///////////////////////////////////////////////
+resource Database_Resource 'Microsoft.Sql/servers/databases@2020-08-01-preview' = {
+  name: '${Server_Name_resource.name}/ContosoHR'
+  location: location
+  tags: {}
+  sku: {
+    name: 'GP_DC_2'
+    tier: 'GeneralPurpose'
+    
+  }
+  properties: {}
+}
+
+//Import the BACPAC
+resource ImportBACPAC_resource 'Microsoft.Sql/servers/databases/extensions@2014-04-01' = {
+  name: '${Database_Resource.name}/extensions'
+  properties: {
+    storageKeyType: 'SharedAccessKey'
+    storageKey: '?'
+    storageUri: 'https://easetupfiles.blob.core.windows.net/setup/contosohr.bacpac'
+    administratorLogin: adminUsername
+    administratorLoginPassword: adminPassword
+    authenticationType: 'SQL'
+    operationMode: 'Import'
+  }
+}
+
+//Create ManagedIdenty to perform any Azure-specific actions in the deployment scripts
+resource ManagedIdentity_Resource 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = {
+  name: 'EAEDemoManagedIdentity'
+  tags: {}
+  location: location
+}
+
+var uamiId = resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', '${ManagedIdentity_Resource.name}')
+
+//Add the Managed Identity to the Contributor Role
+resource AssignContributor_Resource 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
+  //name: guid(resourceGroup().id,currentTime)
+  name: guid(uniqueString(resourceGroup().id),dateTimeAdd(currentTime,'PT1S'))
+  scope: any(resourceGroup().id)
+  properties: {
+    roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c'
+    principalId: ManagedIdentity_Resource.properties.principalId
+    principalType: 'ServicePrincipal'
+  }
+  dependsOn: [
+    ManagedIdentity_Resource
+  ]
+}
+
+/////////////////////////////////////
+//Configure an attestation provider//
+/////////////////////////////////////
+
+//Create the attestation provider
+resource attestationProviderName_resource 'Microsoft.Attestation/attestationProviders@2020-10-01' = {
+  name: '${projectname}attest'
+  location: location
+  properties: {}
+}
+
+//Upload the recommended attestation policy for SGX enclaves
+//!!!!Not working yet!!!
+
+// resource UploadAttestinationPolicy 'Microsoft.Resources/deploymentScripts@2020-10-01' = {
+//   name: 'UploadAttestinationPolicy'
+//   location: location
+//   identity: {
+//     type: 'UserAssigned'
+//     userAssignedIdentities: {
+//       '${uamiId}': {}
+//     }
+//   }
+//   kind: 'AzurePowerShell'
+//     properties: {
+//     azPowerShellVersion: '5.0'
+//     // storageAccountSettings: {
+//     //   storageAccountName: storageAccountResource.name
+//     //   storageAccountKey: listKeys(storageAccountResource.id, storageAccountResource.apiVersion).keys[0].value
+//     // }
+//     //scriptContent: '\r\n az storage blob copy start --account-key ${listKeys(storageAccountResource.id, storageAccountResource.apiVersion).keys[0].value} --account-name ${storageAccountResource.name} --destination-blob contosohr.bacpac --destination-container bacpacfiles --source-uri https://easetupfiles.blob.core.windows.net/setup/contosohr.bacpac'
+//     //scriptContent: 'az config set extension.use_dynamic_install=yes_without_prompt \r\n az attestation policy set --name ${projectname}attest --resource-group ${resourceGroup().name} --attestation-type SGX-IntelSDK --new-attestation-policy-file "{https://easetupfiles.blob.core.windows.net/setup/policy.txt}"'
+//     scriptContent: 'Import-Module "Az.Attestation" -MinimumVersion "0.1.8" \r\n $blobContext=New-AzstorageContext -StorageAccountName "easetupfiles" -Anonymous -Protocol "https" \r\n $policyFile=Get-AzStorageBlob -Blob policy.txt -Container setup -Context $blobContext \r\n $Policy = $policyFile.ICloudBlob.DownloadText() \r\n Set-AzAttestationPolicy -Name ${projectname}attest -ResourceGroupName ${resourceGroup().name} -Tee SgxEnclave -Policy $policy -PolicyFormat Text'
+//     cleanupPreference: 'OnSuccess'
+//     retentionInterval: 'P1D'
+//     forceUpdateTag: currentTime // ensures script will run every time
+//   }
+// }
+
+//Grant the database server access to the attestation provider
+resource AssignAttestationReader_Resource 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = {
+  name: guid(resourceGroup().id,currentTime)
+  properties: {
+    roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/fd1bd22b-8476-40bc-a0bc-69b95687b9f3'
+    principalId: Server_Name_resource.identity.principalId
+  }
+}
+
+/////////////////////////////////////
+//Configure the web application    //
+/////////////////////////////////////
+
+//Create an App Service plan in Free tier
+resource WebAppServicePlan_Resource 'Microsoft.Web/serverfarms@2020-09-01' = {
+  name: '${projectname}plan'
+ location: location
+ properties: {}
+  sku: {
+    name: 'F1'
+    tier: 'Free'
+  }
+}
+
+//Create the App Service
+resource WebApp_Resource 'Microsoft.Web/sites@2020-09-01' = {
+  name: '${projectname}app'
+  location: location
+  identity: {
+    type: 'SystemAssigned'
+  }
+  properties: {
+    serverFarmId: WebAppServicePlan_Resource.id
+       
+ }
+}
+
+//Add the connection string to the Azure SQL Database
+resource WebAppConnectionString_Resource 'Microsoft.Web/sites/config@2020-09-01' = {
+  name: '${WebApp_Resource.name}/connectionstrings'
+  properties: {
+    ContosoHRDatabase: {
+      value: 'Server=tcp:${Server_Name_resource.name}.database.windows.net;Database=ContosoHR;Column Encryption Setting=Enabled; Attestation Protocol = AAS; Enclave Attestation Url=${attestationProviderName_resource.properties.attestUri}/attest/SgxEnclave; Authentication=Active Directory Managed Identity'
+      type: 'SQLAzure'
+    }
+  } 
+}
+
+//Deploy the Web Application
+resource DeployWebApp 'Microsoft.Resources/deploymentScripts@2020-10-01' = {
+  name: 'DeployWebApp'
+  location: location
+  identity: {
+    type: 'UserAssigned'
+    userAssignedIdentities: {
+      '${uamiId}': {}
+    }
+  }
+  kind: 'AzurePowerShell'
+    properties: {
+    azPowerShellVersion: '5.0'
+    storageAccountSettings: {
+       storageAccountName: storageAccountResource.name
+       storageAccountKey: listKeys(storageAccountResource.id, storageAccountResource.apiVersion).keys[0].value
+    }
+    scriptContent: '$PropertiesObject = @{repoUrl = "https://github.com/Pietervanhove/AEDemo.git"; branch = "master"; isManualIntegration = "true";} \r\n Set-AzResource -Properties $PropertiesObject -ResourceGroupName ${resourceGroup().name} -ResourceType Microsoft.Web/sites/sourcecontrols -ResourceName ${WebApp_Resource.name}/web -ApiVersion 2015-08-01 -Force'
+    cleanupPreference: 'OnSuccess'
+    retentionInterval: 'P1D'
+    forceUpdateTag: currentTime // ensures script will run every time
+  }
+}
+
+
+////////////////////////////////////
+//Create and configure a key vault//
+////////////////////////////////////
+
+//Create a key vault and Assign key permissions to yourself, so that you manage the keys
+resource KeyVault_Resource 'Microsoft.KeyVault/vaults@2019-09-01' = {
+  name: '${projectname}vault'
+  location: location
+  tags: {}
+  properties: {
+    tenantId: subscription().tenantId
+    sku: {
+      family: 'A'
+      name: 'standard'
+    }
+    enableSoftDelete: false
+    accessPolicies: [
+      {
+        tenantId: subscription().tenantId
+        objectId: objectId
+        permissions: {
+          keys: [
+            'unwrapKey'
+            'wrapKey'
+            'verify'
+            'sign'
+            'get'
+            'list'
+            'create'
+            'delete'
+            'purge'
+          ]
+        }
+      }
+    ]
+  }
+}
+
+//Assign key permissions to the web app 
+resource KeyVaultWebAppAccessPolicy_Resource 'Microsoft.KeyVault/vaults/accessPolicies@2019-09-01' = {
+  name: any('${KeyVault_Resource.name}/add')
+  properties: {
+    accessPolicies: [
+      {
+        tenantId: subscription().tenantId
+        //objectId: reference(resourceId('Microsoft.Web/sites', '${projectname}app'), '2020-12-01', 'Full').resourceId
+        objectId: WebApp_Resource.identity.principalId
+        permissions: {
+          keys: [
+            'unwrapKey'
+            'wrapKey'
+            'verify'
+            'sign'
+            'get'
+            'list'
+          ]
+        }
+      }
+    ]
+  }
+}
+
+//Create a Key
+resource Key_Resource 'Microsoft.KeyVault/vaults/keys@2019-09-01' = {
+  name: '${KeyVault_Resource.name}/CMK'
+  tags: {}
+  properties: {
+    kty: 'RSA'
+  }
+  dependsOn: [
+    KeyVault_Resource
+  ]
+}
+
+//Post Deploy Script not working 
+//The term 'New-SqlColumnEncryptionSettings' is not recognized as a name of a cmdlet, function, script file, or executable program.
@@ -0,0 +1,35 @@
+######################################################################
+# Request parameters to the user that are needed for the deployment
+######################################################################
+
+$subscriptionName = Read-Host -Prompt "Enter your subscription name"
+$projectName = Read-Host -Prompt "Enter a project name that is used to generate resource names"
+$location = Read-Host -Prompt "Enter a region where you want to deploy the demo environment"
+$upn = Read-Host -Prompt "Enter your email address used to sign in to Azure"
+$adminUsername = Read-Host -Prompt "Enter the SQL Admin Username"
+$adminPassword = Read-Host -Prompt "Enter the SQL Admin Password"
+
+$adUserId = (az ad user show --id $upn --query objectId)
+$clientIP = (Invoke-WebRequest ifconfig.me/ip).Content.Trim()
+$bicepFile = "Deploy AE Demo.bicep"
+$projectName = $projectName.ToLower()
+
+######################################################################
+# Sign in to Azure
+######################################################################
+
+Connect-AzAccount
+$context = Set-AzContext -Subscription $subscriptionName
+
+######################################################################
+# Create a resource group
+######################################################################
+$resourceGroupName = "${projectName}"
+New-AzResourceGroup -Name $resourceGroupName -Location $location
+
+######################################################################
+# Deploy the resources for the demo environment
+######################################################################
+az deployment group create --name DeployAEWithEnclavesDemo --template-file $bicepFile --resource-group $resourceGroupName --parameters objectId=$adUserId projectname=$projectName adminUsername=$adminUsername adminPassword=$adminPassword AADSQLAdmin=$upn clientIP=$clientIP
+
+
@@ -0,0 +1,56 @@
+--Create app user
+CREATE USER aeenclavedemoapp FROM EXTERNAL PROVIDER;
+GO
+EXEC sp_addrolemember 'db_datareader', 'aeenclavedemoapp';
+GO
+
+--Create XEvent Session
+IF EXISTS (SELECT *
+      FROM sys.database_event_sessions
+      WHERE name = 'Demo')
+BEGIN
+    DROP EVENT SESSION Demo
+          ON Database;
+END
+go
+
+CREATE EVENT SESSION [Demo] ON DATABASE 
+ADD EVENT sqlserver.rpc_completed(SET collect_data_stream=(1),collect_statement=(1)
+    ACTION(sqlserver.sql_text)
+	WHERE ([sqlserver].[like_i_sql_unicode_string]([sqlserver].[sql_text],N'%SSN%')AND [package0].[not_equal_unicode_string]([statement],N'exec sp_reset_connection'))
+	)
+ADD TARGET package0.ring_buffer
+WITH (MAX_MEMORY=4096 KB,EVENT_RETENTION_MODE=ALLOW_SINGLE_EVENT_LOSS,MAX_DISPATCH_LATENCY=30 SECONDS,MAX_EVENT_SIZE=0 KB,MEMORY_PARTITION_MODE=NONE,TRACK_CAUSALITY=OFF,STARTUP_STATE=OFF)
+GO
+
+--CREATE EVENT SESSION [Demo] ON DATABASE 
+--ADD EVENT sqlserver.rpc_completed(SET collect_data_stream=(1),collect_statement=(1)
+--    	WHERE ([sqlserver].[equal_i_sql_unicode_string]([sqlserver].[database_name],N'ContosoHR') AND [package0].[not_equal_unicode_string]([statement],N'exec sp_reset_connection')))
+--ADD TARGET package0.ring_buffer(SET max_memory=(4096))
+--WITH (MAX_MEMORY=4096 KB,EVENT_RETENTION_MODE=ALLOW_SINGLE_EVENT_LOSS,MAX_DISPATCH_LATENCY=2 SECONDS,MAX_EVENT_SIZE=0 KB,MEMORY_PARTITION_MODE=NONE,TRACK_CAUSALITY=OFF,STARTUP_STATE=ON)
+--GO
+
+
+ALTER EVENT SESSION [Demo]
+      ON DATABASE
+    STATE = START;   -- STOP;
+
+
+
+--Upload Policy File
+--Setup CMK and CEK
+
+-- Data Owner's script - the user needs access to the keys
+
+ALTER TABLE [dbo].[Employees]
+ALTER COLUMN [SSN] [char](11) COLLATE Latin1_General_BIN2
+ENCRYPTED WITH (COLUMN_ENCRYPTION_KEY = [CEK], ENCRYPTION_TYPE = Randomized, ALGORITHM = 'AEAD_AES_256_CBC_HMAC_SHA_256') NOT NULL;
+GO
+
+ALTER TABLE [dbo].[Employees]
+ALTER COLUMN [Salary] [Money] 
+ENCRYPTED WITH (COLUMN_ENCRYPTION_KEY = [CEK], ENCRYPTION_TYPE = Randomized, ALGORITHM = 'AEAD_AES_256_CBC_HMAC_SHA_256') NOT NULL;
+GO
+
+ALTER DATABASE SCOPED CONFIGURATION CLEAR PROCEDURE_CACHE;
+GO
@@ -0,0 +1,21 @@
+USE ContosoHR
+GO
+SELECT * FROM [dbo].[Employees] 
+
+
+DECLARE @SSN CHAR(11) = '795-73-9838'
+SELECT * FROM [dbo].[Employees] WHERE [SSN] = @SSN
+GO
+
+DECLARE @SSNPattern CHAR(11) = '%9838'
+SELECT * FROM [dbo].[Employees] WHERE [SSN] LIKE @SSNPattern
+GO 
+
+DECLARE @MinSalary MONEY = 40000
+DECLARE @MaxSalary MONEY = 45000
+SELECT * FROM [dbo].[Employees] WHERE [Salary] > @MinSalary AND [Salary] < @MaxSalary
+GO
+
+DECLARE @LastNamePrefix NVARCHAR(50) = 'Aber%';
+SELECT * FROM [dbo].[Employees] WHERE [LastName] LIKE @LastNamePrefix;
+GO 
@@ -0,0 +1,9 @@
+version= 1.0;
+authorizationrules 
+{
+     [ type=="x-ms-sgx-is-debuggable", value==false ]
+      && [ type=="x-ms-sgx-product-id", value==4639 ]
+      && [ type=="x-ms-sgx-svn", value>= 0 ]
+      && [ type=="x-ms-sgx-mrsigner", value=="e31c9e505f37a58de09335075fc8591254313eb20bb1a27e5443cc450b6e33e5"] 
+  => permit();
+};