From a0389d5b645478cf3d6866879fc3f3664f702178 Mon Sep 17 00:00:00 2001 From: Pieter Vanhove Date: Thu, 8 Apr 2021 12:11:18 +0200 Subject: [PATCH] Add files via upload --- .../Deploy AE Demo.bicep | 367 ++++++++++++++++++ .../Deploy.ps1 | 35 ++ .../Post Deployment.sql | 56 +++ .../QueryColumns.sql | 21 + .../contosohr.bacpac | Bin 0 -> 11368 bytes .../policy.txt | 9 + 6 files changed, 488 insertions(+) create mode 100644 samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Deploy AE Demo.bicep create mode 100644 samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Deploy.ps1 create mode 100644 samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Post Deployment.sql create mode 100644 samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/QueryColumns.sql create mode 100644 samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/contosohr.bacpac create mode 100644 samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/policy.txt diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Deploy AE Demo.bicep b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Deploy AE Demo.bicep new file mode 100644 index 00000000..e34420b1 --- /dev/null +++ b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Deploy AE Demo.bicep @@ -0,0 +1,367 @@ +//////////////////// +//Define parameter// +//////////////////// + +param objectId string +@description('Location for all resources.') +param location string = resourceGroup().location + +@description('Project Name') +param projectname string = 'eaeaedemo' + +param currentTime string = utcNow('u') + +param adminUsername string +param adminPassword string +param AADSQLAdmin string +param clientIP string + +//Make the subscription Contributor of the resource group +resource AssignContributorToUser_Resource 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = { + name: guid(uniqueString(resourceGroup().id),currentTime) + scope: any(resourceGroup().id) + properties: { + roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c' + principalId: objectId + principalType: 'User' + } +} + +/////////////////////////////////////////////////// +//Create a storage account with a database bacpac// +////////////////////////////////////////////////// + +// Create a storage account +@description('Storage Account type') +param storageAccountType string = 'Standard_LRS' +var storageAccountName_var = '${projectname}storage' + +resource storageAccountResource 'Microsoft.Storage/storageAccounts@2020-08-01-preview' = { + name: storageAccountName_var + location: location + sku: { + name: storageAccountType + } + kind: 'StorageV2' + properties: {} +} + +output storageoutput string = storageAccountResource.name + +resource storageAccountname 'Microsoft.Storage/storageAccounts/blobServices@2020-08-01-preview' = { + name: '${storageAccountResource.name}/default' + properties: { + cors: { + corsRules: [] + } + deleteRetentionPolicy: { + enabled: false + } + } +} + +resource Containerbacpacfiles 'Microsoft.Storage/storageAccounts/blobServices/containers@2020-08-01-preview' = { + name: '${storageAccountname.name}/bacpacfiles' + properties: { + defaultEncryptionScope: '$account-encryption-key' + denyEncryptionScopeOverride: false + publicAccess: 'None' + } + dependsOn: [ + storageAccountResource + ] +} + +//////////////////////////// +//Create a database server// +//////////////////////////// + +// Create the server + +var SQLServerName_var = '${projectname}server' +resource Server_Name_resource 'Microsoft.Sql/servers@2019-06-01-preview' = { + name: SQLServerName_var + location: location + tags: {} + identity: { + type: 'SystemAssigned' + } + properties: { + administratorLogin: adminUsername + administratorLoginPassword: adminPassword + //version: 'string' //optional + minimalTlsVersion: '1.2' + publicNetworkAccess: 'Enabled' + } +} + +//Allow Azure services and resources to access this server +resource Server_Name_AllowAllWindowsAzureIps 'Microsoft.Sql/servers/firewallRules@2015-05-01-preview' = { + name: '${Server_Name_resource.name}/AllowAllWindowsAzureIps' + properties: { + endIpAddress: '0.0.0.0' + startIpAddress: '0.0.0.0' + } +} + +//Allow Client IP to access this server +resource Server_Name_AllowClientIP 'Microsoft.Sql/servers/firewallRules@2015-05-01-preview' = { + name: '${Server_Name_resource.name}/AllowClientIP' + properties: { + endIpAddress: clientIP + startIpAddress: clientIP + } +} + +//Make yourself an administrator, so that you can connect with universal authentication +resource Server_Name_activeDirectory 'Microsoft.Sql/servers/administrators@2019-06-01-preview' = { + name: '${Server_Name_resource.name}/activeDirectory' + properties: { + administratorType: 'ActiveDirectory' + login: AADSQLAdmin + sid: reference(resourceId('Microsoft.Sql/servers', '${projectname}server'), '2019-06-01-preview', 'Full').identity.principalId + //tenantId: AAD_TenantId //optional + } +} + +/////////////////////////////////////////////// +//Import and configure the ContosoHR database// +/////////////////////////////////////////////// +resource Database_Resource 'Microsoft.Sql/servers/databases@2020-08-01-preview' = { + name: '${Server_Name_resource.name}/ContosoHR' + location: location + tags: {} + sku: { + name: 'GP_DC_2' + tier: 'GeneralPurpose' + + } + properties: {} +} + +//Import the BACPAC +resource ImportBACPAC_resource 'Microsoft.Sql/servers/databases/extensions@2014-04-01' = { + name: '${Database_Resource.name}/extensions' + properties: { + storageKeyType: 'SharedAccessKey' + storageKey: '?' + storageUri: 'https://easetupfiles.blob.core.windows.net/setup/contosohr.bacpac' + administratorLogin: adminUsername + administratorLoginPassword: adminPassword + authenticationType: 'SQL' + operationMode: 'Import' + } +} + +//Create ManagedIdenty to perform any Azure-specific actions in the deployment scripts +resource ManagedIdentity_Resource 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = { + name: 'EAEDemoManagedIdentity' + tags: {} + location: location +} + +var uamiId = resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', '${ManagedIdentity_Resource.name}') + +//Add the Managed Identity to the Contributor Role +resource AssignContributor_Resource 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = { + //name: guid(resourceGroup().id,currentTime) + name: guid(uniqueString(resourceGroup().id),dateTimeAdd(currentTime,'PT1S')) + scope: any(resourceGroup().id) + properties: { + roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c' + principalId: ManagedIdentity_Resource.properties.principalId + principalType: 'ServicePrincipal' + } + dependsOn: [ + ManagedIdentity_Resource + ] +} + +///////////////////////////////////// +//Configure an attestation provider// +///////////////////////////////////// + +//Create the attestation provider +resource attestationProviderName_resource 'Microsoft.Attestation/attestationProviders@2020-10-01' = { + name: '${projectname}attest' + location: location + properties: {} +} + +//Upload the recommended attestation policy for SGX enclaves +//!!!!Not working yet!!! + +// resource UploadAttestinationPolicy 'Microsoft.Resources/deploymentScripts@2020-10-01' = { +// name: 'UploadAttestinationPolicy' +// location: location +// identity: { +// type: 'UserAssigned' +// userAssignedIdentities: { +// '${uamiId}': {} +// } +// } +// kind: 'AzurePowerShell' +// properties: { +// azPowerShellVersion: '5.0' +// // storageAccountSettings: { +// // storageAccountName: storageAccountResource.name +// // storageAccountKey: listKeys(storageAccountResource.id, storageAccountResource.apiVersion).keys[0].value +// // } +// //scriptContent: '\r\n az storage blob copy start --account-key ${listKeys(storageAccountResource.id, storageAccountResource.apiVersion).keys[0].value} --account-name ${storageAccountResource.name} --destination-blob contosohr.bacpac --destination-container bacpacfiles --source-uri https://easetupfiles.blob.core.windows.net/setup/contosohr.bacpac' +// //scriptContent: 'az config set extension.use_dynamic_install=yes_without_prompt \r\n az attestation policy set --name ${projectname}attest --resource-group ${resourceGroup().name} --attestation-type SGX-IntelSDK --new-attestation-policy-file "{https://easetupfiles.blob.core.windows.net/setup/policy.txt}"' +// scriptContent: 'Import-Module "Az.Attestation" -MinimumVersion "0.1.8" \r\n $blobContext=New-AzstorageContext -StorageAccountName "easetupfiles" -Anonymous -Protocol "https" \r\n $policyFile=Get-AzStorageBlob -Blob policy.txt -Container setup -Context $blobContext \r\n $Policy = $policyFile.ICloudBlob.DownloadText() \r\n Set-AzAttestationPolicy -Name ${projectname}attest -ResourceGroupName ${resourceGroup().name} -Tee SgxEnclave -Policy $policy -PolicyFormat Text' +// cleanupPreference: 'OnSuccess' +// retentionInterval: 'P1D' +// forceUpdateTag: currentTime // ensures script will run every time +// } +// } + +//Grant the database server access to the attestation provider +resource AssignAttestationReader_Resource 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = { + name: guid(resourceGroup().id,currentTime) + properties: { + roleDefinitionId: '/subscriptions/${subscription().subscriptionId}/providers/Microsoft.Authorization/roleDefinitions/fd1bd22b-8476-40bc-a0bc-69b95687b9f3' + principalId: Server_Name_resource.identity.principalId + } +} + +///////////////////////////////////// +//Configure the web application // +///////////////////////////////////// + +//Create an App Service plan in Free tier +resource WebAppServicePlan_Resource 'Microsoft.Web/serverfarms@2020-09-01' = { + name: '${projectname}plan' + location: location + properties: {} + sku: { + name: 'F1' + tier: 'Free' + } +} + +//Create the App Service +resource WebApp_Resource 'Microsoft.Web/sites@2020-09-01' = { + name: '${projectname}app' + location: location + identity: { + type: 'SystemAssigned' + } + properties: { + serverFarmId: WebAppServicePlan_Resource.id + + } +} + +//Add the connection string to the Azure SQL Database +resource WebAppConnectionString_Resource 'Microsoft.Web/sites/config@2020-09-01' = { + name: '${WebApp_Resource.name}/connectionstrings' + properties: { + ContosoHRDatabase: { + value: 'Server=tcp:${Server_Name_resource.name}.database.windows.net;Database=ContosoHR;Column Encryption Setting=Enabled; Attestation Protocol = AAS; Enclave Attestation Url=${attestationProviderName_resource.properties.attestUri}/attest/SgxEnclave; Authentication=Active Directory Managed Identity' + type: 'SQLAzure' + } + } +} + +//Deploy the Web Application +resource DeployWebApp 'Microsoft.Resources/deploymentScripts@2020-10-01' = { + name: 'DeployWebApp' + location: location + identity: { + type: 'UserAssigned' + userAssignedIdentities: { + '${uamiId}': {} + } + } + kind: 'AzurePowerShell' + properties: { + azPowerShellVersion: '5.0' + storageAccountSettings: { + storageAccountName: storageAccountResource.name + storageAccountKey: listKeys(storageAccountResource.id, storageAccountResource.apiVersion).keys[0].value + } + scriptContent: '$PropertiesObject = @{repoUrl = "https://github.com/Pietervanhove/AEDemo.git"; branch = "master"; isManualIntegration = "true";} \r\n Set-AzResource -Properties $PropertiesObject -ResourceGroupName ${resourceGroup().name} -ResourceType Microsoft.Web/sites/sourcecontrols -ResourceName ${WebApp_Resource.name}/web -ApiVersion 2015-08-01 -Force' + cleanupPreference: 'OnSuccess' + retentionInterval: 'P1D' + forceUpdateTag: currentTime // ensures script will run every time + } +} + + +//////////////////////////////////// +//Create and configure a key vault// +//////////////////////////////////// + +//Create a key vault and Assign key permissions to yourself, so that you manage the keys +resource KeyVault_Resource 'Microsoft.KeyVault/vaults@2019-09-01' = { + name: '${projectname}vault' + location: location + tags: {} + properties: { + tenantId: subscription().tenantId + sku: { + family: 'A' + name: 'standard' + } + enableSoftDelete: false + accessPolicies: [ + { + tenantId: subscription().tenantId + objectId: objectId + permissions: { + keys: [ + 'unwrapKey' + 'wrapKey' + 'verify' + 'sign' + 'get' + 'list' + 'create' + 'delete' + 'purge' + ] + } + } + ] + } +} + +//Assign key permissions to the web app +resource KeyVaultWebAppAccessPolicy_Resource 'Microsoft.KeyVault/vaults/accessPolicies@2019-09-01' = { + name: any('${KeyVault_Resource.name}/add') + properties: { + accessPolicies: [ + { + tenantId: subscription().tenantId + //objectId: reference(resourceId('Microsoft.Web/sites', '${projectname}app'), '2020-12-01', 'Full').resourceId + objectId: WebApp_Resource.identity.principalId + permissions: { + keys: [ + 'unwrapKey' + 'wrapKey' + 'verify' + 'sign' + 'get' + 'list' + ] + } + } + ] + } +} + +//Create a Key +resource Key_Resource 'Microsoft.KeyVault/vaults/keys@2019-09-01' = { + name: '${KeyVault_Resource.name}/CMK' + tags: {} + properties: { + kty: 'RSA' + } + dependsOn: [ + KeyVault_Resource + ] +} + +//Post Deploy Script not working +//The term 'New-SqlColumnEncryptionSettings' is not recognized as a name of a cmdlet, function, script file, or executable program. diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Deploy.ps1 b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Deploy.ps1 new file mode 100644 index 00000000..78e2dade --- /dev/null +++ b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Deploy.ps1 @@ -0,0 +1,35 @@ +###################################################################### +# Request parameters to the user that are needed for the deployment +###################################################################### + +$subscriptionName = Read-Host -Prompt "Enter your subscription name" +$projectName = Read-Host -Prompt "Enter a project name that is used to generate resource names" +$location = Read-Host -Prompt "Enter a region where you want to deploy the demo environment" +$upn = Read-Host -Prompt "Enter your email address used to sign in to Azure" +$adminUsername = Read-Host -Prompt "Enter the SQL Admin Username" +$adminPassword = Read-Host -Prompt "Enter the SQL Admin Password" + +$adUserId = (az ad user show --id $upn --query objectId) +$clientIP = (Invoke-WebRequest ifconfig.me/ip).Content.Trim() +$bicepFile = "Deploy AE Demo.bicep" +$projectName = $projectName.ToLower() + +###################################################################### +# Sign in to Azure +###################################################################### + +Connect-AzAccount +$context = Set-AzContext -Subscription $subscriptionName + +###################################################################### +# Create a resource group +###################################################################### +$resourceGroupName = "${projectName}" +New-AzResourceGroup -Name $resourceGroupName -Location $location + +###################################################################### +# Deploy the resources for the demo environment +###################################################################### +az deployment group create --name DeployAEWithEnclavesDemo --template-file $bicepFile --resource-group $resourceGroupName --parameters objectId=$adUserId projectname=$projectName adminUsername=$adminUsername adminPassword=$adminPassword AADSQLAdmin=$upn clientIP=$clientIP + + diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Post Deployment.sql b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Post Deployment.sql new file mode 100644 index 00000000..34408190 --- /dev/null +++ b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/Post Deployment.sql @@ -0,0 +1,56 @@ +--Create app user +CREATE USER aeenclavedemoapp FROM EXTERNAL PROVIDER; +GO +EXEC sp_addrolemember 'db_datareader', 'aeenclavedemoapp'; +GO + +--Create XEvent Session +IF EXISTS (SELECT * + FROM sys.database_event_sessions + WHERE name = 'Demo') +BEGIN + DROP EVENT SESSION Demo + ON Database; +END +go + +CREATE EVENT SESSION [Demo] ON DATABASE +ADD EVENT sqlserver.rpc_completed(SET collect_data_stream=(1),collect_statement=(1) + ACTION(sqlserver.sql_text) + WHERE ([sqlserver].[like_i_sql_unicode_string]([sqlserver].[sql_text],N'%SSN%')AND [package0].[not_equal_unicode_string]([statement],N'exec sp_reset_connection')) + ) +ADD TARGET package0.ring_buffer +WITH (MAX_MEMORY=4096 KB,EVENT_RETENTION_MODE=ALLOW_SINGLE_EVENT_LOSS,MAX_DISPATCH_LATENCY=30 SECONDS,MAX_EVENT_SIZE=0 KB,MEMORY_PARTITION_MODE=NONE,TRACK_CAUSALITY=OFF,STARTUP_STATE=OFF) +GO + +--CREATE EVENT SESSION [Demo] ON DATABASE +--ADD EVENT sqlserver.rpc_completed(SET collect_data_stream=(1),collect_statement=(1) +-- WHERE ([sqlserver].[equal_i_sql_unicode_string]([sqlserver].[database_name],N'ContosoHR') AND [package0].[not_equal_unicode_string]([statement],N'exec sp_reset_connection'))) +--ADD TARGET package0.ring_buffer(SET max_memory=(4096)) +--WITH (MAX_MEMORY=4096 KB,EVENT_RETENTION_MODE=ALLOW_SINGLE_EVENT_LOSS,MAX_DISPATCH_LATENCY=2 SECONDS,MAX_EVENT_SIZE=0 KB,MEMORY_PARTITION_MODE=NONE,TRACK_CAUSALITY=OFF,STARTUP_STATE=ON) +--GO + + +ALTER EVENT SESSION [Demo] + ON DATABASE + STATE = START; -- STOP; + + + +--Upload Policy File +--Setup CMK and CEK + +-- Data Owner's script - the user needs access to the keys + +ALTER TABLE [dbo].[Employees] +ALTER COLUMN [SSN] [char](11) COLLATE Latin1_General_BIN2 +ENCRYPTED WITH (COLUMN_ENCRYPTION_KEY = [CEK], ENCRYPTION_TYPE = Randomized, ALGORITHM = 'AEAD_AES_256_CBC_HMAC_SHA_256') NOT NULL; +GO + +ALTER TABLE [dbo].[Employees] +ALTER COLUMN [Salary] [Money] +ENCRYPTED WITH (COLUMN_ENCRYPTION_KEY = [CEK], ENCRYPTION_TYPE = Randomized, ALGORITHM = 'AEAD_AES_256_CBC_HMAC_SHA_256') NOT NULL; +GO + +ALTER DATABASE SCOPED CONFIGURATION CLEAR PROCEDURE_CACHE; +GO diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/QueryColumns.sql b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/QueryColumns.sql new file mode 100644 index 00000000..cf8e4add --- /dev/null +++ b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/QueryColumns.sql @@ -0,0 +1,21 @@ +USE ContosoHR +GO +SELECT * FROM [dbo].[Employees] + + +DECLARE @SSN CHAR(11) = '795-73-9838' +SELECT * FROM [dbo].[Employees] WHERE [SSN] = @SSN +GO + +DECLARE @SSNPattern CHAR(11) = '%9838' +SELECT * FROM [dbo].[Employees] WHERE [SSN] LIKE @SSNPattern +GO + +DECLARE @MinSalary MONEY = 40000 +DECLARE @MaxSalary MONEY = 45000 +SELECT * FROM [dbo].[Employees] WHERE [Salary] > @MinSalary AND [Salary] < @MaxSalary +GO + +DECLARE @LastNamePrefix NVARCHAR(50) = 'Aber%'; +SELECT * FROM [dbo].[Employees] WHERE [LastName] LIKE @LastNamePrefix; +GO \ No newline at end of file diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/contosohr.bacpac b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/contosohr.bacpac new file mode 100644 index 0000000000000000000000000000000000000000..7438a3c07f3466a6256604284148915a492c75eb GIT binary patch literal 11368 zcmbt)2UwHa(k_Ug2vS5usz?!$l7tX?@4a_K3?Xy~B%wtDA_6J`(m|SnbdV;X^j@S1 zBE1Pn@4a(_?(Nz8oPF;9-{*#Wd9upPto2S=i_B=L5?s8Fhlh6=@1l;hPD<8l0OdtI zJV6>fJYqZsJV%5j+=17_(SbSTCf?mQ=M(?)wPNImm=dBm9gSF(lsoVy{_@B;asK^X z0JVt?r*xD?&J|i~ya{2qem9|_n$zZs7yK_~z8|PE+ab`ob`SmUdJ zIp2?F8@e!3=mn^CydP~;^TEt{dz?*^@7w^fy+J)wG7qRtB%A&cc8_HiO7i}bh5*Nz z+k#oShH6V0+Y_#`?#yr#jbQ6ePgc%PyL?Y+yk>U?_QUUbWcDvVCGL3@Ocr^+fFg2< zpM9?J%?cCz_F?Y*2diEVCKoSvlA6A$2~(+c1T{SgX!ABr2i#aX<5=*GZhc zR_rB7wmxzxQ2kI$lzNRpR{ya|XA}SZKEs}oj37+B?8SPaRDK2XR&2uoZ>dnQFIYW= zIG(*x$=}lO4#o5Djc?QzEp6KtD!K^16MHXw&&doyNIhop@*1mZ>N{+jfA93Lmf+g( z>oG@1^yL8bMb~5{0;pgk#bBf_hUi1wT^@asbhhtz-UwkDemq?tm5SciIaay{Vg}dZ z6Z9#ZlFlVQ-J;}HH+@AMxGt8gPTLgwm3X@2U1@-D?jb7ey1$4K@XCP7ssF+A9Yo+%}*iO$%PkXCwJ{YKfs4}1E7BJHDuaj9j3=BNwsDYu2V z^#*3sBubz*E?l{CRoKB0s#oq^*vfhL{(_X~N*X@)WkJu`a#Pk zZk}$$9#v%?iS{p^@&-FNt`7vswyA)MdOKGFsSf6`c8Z`F&d1)|#&?PoYUB@=bl}(7 zF2cj)ZmPR5k!2E+dP))9gMY-XmI|OrXiZCvbN$E6p0!1@McfE9x|a6iR-=@m>QHpg zgOC1{G1Bdf;&JHtsZWO%^!KC3w~YC4?_rhp(^yE7`Z!vXO4APL}i(}9a;9YmHX)BkbJ;I$fS3c z7h~OXLhXr9^O%`;v*VGQ>DQ0WnL$aeFhvS@T;L`=~OAG zQj`*g7Y@=OP^$ji)0XwLO@UD_f;1CN^F@y)KUbtGc2Uy{v08JC*mtfUv)ynP{URsr zA$UNQDcrd@IlO8gRS+6~UF%Hx!21!`MBC=KlTI_l*hIyN_Zhj?-(m{aMy7ufE^5@_ z9&%hvk%Pk2;b^EO6b=2KA`2u0L{<+Zm3L=brGRs2h~AD&CjpZ@6G!UOWhtvLP&h+~ zLK>-`U76QBojCPgn^P?jlq||opRusyVzxTkz#a@d>nJ4Kte;?2NxL+dmMY)fJu2YrcsT zW(t4enG`WiqpS*2t(&;Zz3$g@>+jn{aJES_;I^oTkB3Kv+oq{3!U+v`LYwP(I>S+B z|I=2nTB7G$tx}1kF5xA;{I*od%Z-Saf^d&@nC-<_c0#Z(s|%rwFCl(v@FS78L^_*u>Ez8uM?&tDscZatj^wQ zbwNrD82TSVSQQ(Y^pD!>V6r~k7}T-NjVhBSX<=k$HlzBuV*P&VG1=eo5EK@@9@N4CE{C%N9v~2S{s4izGO}9#x3ebLlsNXj zew4QvabkLJmYzsrB3q*WQ|`n{%$k0cA^zLqK<+PWx1n)DS*v>GTva+|iC^&3TwvGx z+@RXhrj`_6!d_;wil|H#T(LlFX)D-_YR9(CPYO8gozB&)RcTyE9=nx@&O}XASs!%! zbbUhTM8OXX#y^_`FKQZ|beQ@cf(sUNOAP9=jaCeL?wPXZn4TEJ@=8tmk`tp(MKH%L zuC6K)`PGi>w$s)cZB~6g-}-N`e}k*1sSVlbpY3G&*lM3WXuQHog($g`L;b<>L0h>U z`C-O*C@d}as!Gb6q|t1N32XLmDo1^5W{YcwISW($pq;^*yrcme&qY(!xyao7q#9$a z+vN4E@kh;_@hR`NGqB48-!=0BP3$X%QZs~+v@mB_qdW0+S@ zdcTw5UL~u%XlDNje?FJ0W+}g}x<(_BXh`gxSAu9QE#G2s=VHXk;#SEkJN-wTy2u$b zaErQOxN*qqA1?3@=CQS} z%j~!3PZT%^95?wBndOEBmMtZ&>17O@8f#U2$pAE1-&;3<9i?-08wp(6ZI=nE9u6A! zRXlPuNOm+#e(zrylH|SUI0Hr*bTxg&u8uW#Ck*@McU2o;4c1D?i?EAjSCVpSLOcXR zZMBMM=LbE4LnvwH#))|rZgNVYsB;Jo*GLSNd=_X{#q7EQyTEVv2DgV&dfi1G(pCf> zL)fi|Y9Q7_UX5x2J>jr-KcHouUmj6DGEY5ykg_&CYM5kL!|b-oP}%Hz>a{cDY8QH< zQjz%O(Ur}_&l6;;%c?eH=Rj8#p}^n`-KRI{-p&zNS<~o+asT4S*~dOZtS69!2W!u{#h5qZQ1Bk z!dzK{?#BW*GNH6$9l~V5mubsH?4tSiCHK&L$BR0+OP|F7Uip{tY|6K)3oLn-s181spwVr0Ek?^!n?Gn&WX=0op(^IiA%3=#OHBI`HFB_Z#vzI8{I zXe*cEK|gp^g|F3(m(ZY@y&n;#((I|bJBKj9*qM9n*76EVvu$`lIy>X4D)xj+1s;>R znxanJ70)j%*^u;g)A_rIw`wc5?mpZrI7lKW7M~0XGE;pj`lWLG$Zht`g`($TpEOr0 zxjJ$LLl9XG2jV1=D3_s2cQ zR;^aD2#n60MWRFOS2`D~JfEt-Ys&^KGBMC2vf1dWIq|Q~Ox!WSg`Brc+D&1;k;*EJ zQ(f^QyGmvir#sq;`d`y`iQg(>N{+lOL878^N32y$$i&U&2s}{@$0-kOZ!hv)HwoO^_MWqjxdG@oA!Q32@3QGqo~_8x=9fl(LqxLy-F z_@|e=*SRmfRw=VU_55hok$H(GM|9Np)a<4jZI3bef`s!vuf>Oisr>`;(6P%;saH8D z=X#Pjivn*P_Z@ihSma+isvQUsjt~Gzwi6f4)QVW>d?!A9SaE%(;uUnb%}4RLZJPJx zhIMGzEIup(TGjWq(wYZU<^Ph2s@Qi<)GY)}#1d#xiVl%B~dACIjw`<@@iJE6879m`@x~8w?mM zlpRuFQG1h=sVy_WKs`8-+e^iQDzD++VNrNb)vPW>WTxJzq|>|nXuYVdEhw&A4SugA zh2TaR-7ek3y!%!PK^~~B)fx@^fTrTXl3SmbYS`O|%j<>*0zg_s`S{~rM|IROQgdPX z{4x{5eGVgGmnxWzW%^$0V_4#oeLTLo?W+ZpsDvC(NNbFDz0mD?fASzn{I~=4)g5TX zxTyq%@%DUP2PTHf5nPIU3zsy4@3n3w3Q1GITS2k6``@yF76RoLhgKG+5yA> z0cD`@7tsEB@lxc_kHIR{WLL#+9W=KMM4sJT5t1(}%A6eU$p>VAdScMgBGy_r@nPo( zD(h*dX@t58Fp*qSX%3onh(6F*V{IBPXFL_fvl<}dsh>XGuTDFYx^Z1Tct6Zay3;N+ zO>6cQb7L{d+?sS6HATdxB^aMlMo12GoePA0M`il{>iA{bi0=EtO3sduK}9a3Ba_37 zf?d|Nnjg77mKs}=$r_{)_I30X--EB2>9EUHqMU6uW~#pA12qDNzCrs?-@E!5*x&|ai4?ca#a9CW`8)AC%anNc$o}S}F zy+FF@+-4t{v$MFx$7rulH{aH&BeEtGC8KYC4#&6bfl$qUeJ-AU*X#v6DWIiVD7AHY zC1CWnW(XIp)T6>^YK<`(HwujziBBGqX!z6sP_C0UBD;tathsdjwy?vwCbL}Jg$tEeOJr_|5rhR>13tsy41d#e0Y0!ySHDMO2cjRP8m0+e~(RG{eIgxa{av z=PNNMRel|G?NJUrcFgH^Y6v`f{vBoMlWKfQ3O-*Ks_x~-;ujQRoC~@4N=&erTkmv@ zDk5kN`0cuf7u=c`ug06P$7FIdct~3IM#gY|wG(lPc!4UPR3suFGg8Rc1@Ri^CPv!^ zdcTupZ*{_YPGqkd&CrghAoA(-Po!6?$vuBCCyRU4Z3T;axJ8#Fsj5X`U{~YbN%#bZ z1N?Uu!gBUFFfOYOMxe`~s4(?+_W)t|`7rI?4!AmNNcL^Lu17g2v zd*f+-%RK;YJ=mIR9Q1ny>8I|$;~+d`T>jd;d$EASa;fUpu;>wmM?|;SD~_bOFC;_K zHP-?>%c<$SKLS6#rW35@`Sv71r2faw@}kEoVQX!NHSUlIEg6BwixgeT<5ZE4tWm%;7FPGn3frDYWK0mgV!rS}1{&t~8#&ee~trGd)2Triv9G z=QdGVf&&W2`!)mV(d9<^ANXDzsjU^FZFkL<-G`y-%i%rj4Z|PmGYnpZQsmcEc!1U3f{fc7ey@yVWhlzcx5YP|by z(SKJDz~XZ5q&9!X4Qb*m+kUP^+wVBjq3}N@~xkrhGRnv4Z2UIqSV||vycHdC0=tnUA*@UPIT*I z@uHvHnv!B~4D~XgoSmn*5sqiOBmqdk%8f85Cx&tFN65 zb$3?yM^hU_!bZ!Dru#mA6|%Kr@{5=NoftHlQNW0Kz4+W;bB-yvDVu<78@J3&1iuTo zMWhXc!5OU^dbQVtm2JPClszHI@VYAiDT=#Fn({v5(tt_)ATh)<({nne>kxR%`tYJv zn@k#?Q3Kf|9^8Kjgy6;6bSTcVrjy(e?tqPRhf5+}xDq^NXBgXBATDcoz-wHkxYqGK z*EF`K{EIG^v&se4OXkL∈W#*)V)(J_(x9MlXBk9S@|{j$$2tqS2*#t0*p1oIyzq zMk%@>GxXKLe1jqH!Off*(rKj>7J_#pPhtlQvV!w&5387OgcUaA-fXM@%aQkNFSU`4 zgU=E|r#r%P2s8vY6IvE{4d^+pvy5mai+sl-n-bSms3?00!sBA0a*$VxV9_ei?xEzz zW{hrk)mvndb-W6}>%JnpVtY;dH$R+gCM;H1P||A6@d>|&XQYvaB-PXX&=z`RF@HLl z9EZiWcchB#N4FFE#}W0*dgGN{-7U7e(f>t^FMrjkOL&xGr8r@=k2ziRF*IJ`zzww< zb*L#b&0Ab;dB=|<^^rRya<;K@vvKoLEIB*x{b4oxBD&(T8%D-3bJP6}R>`WSPcbLo zZM>JKDm8LN#xG%?JIstlAEkrWU~D7N3joWu%W2@T=NWAgK^sRx@m3iU`qb(RjpM%Sz*7)1-?{FI}Tr5uED4Uf z)%-3fA=Ow8EcDj0Pa+B;@U}Xq0M=1Fv6p(F_@=^(lY`0Jx|mE>oF_jHTkCw`e;E#%m-d;D&-VY;^JD8A^4rWqxrnJOAp1t zq7Ws@H#ca-i@){$7#s_)>Q+ZfD0(}JxX&tR^LB_cekP-t>Yyy9Jsr=3Nt#oSeO<4= z_c<7zXW;6+;JA>vK$5}P-$HI|o*AxO+&wI76(-!*5>I)%*XMbA;DeY-&I3dthK0Gi z4gam(byd#l5cF5!vg8f_A&9I>c ztdj_gpNXYcVC~E5t%|AU-{30jvQ6@=3nbchFdw+N5No;Yq&QMLn%}Fa-g0+bA9!Cj zrAn=xwKVB<`OIxMNB&Z6&E7D@2tNL{-+?0SLA8I#;pZnCSax!~+z#?g}!0)x9LFgVwX~Adf z(9LDV#Z$kp2D$_SMN{jVaT}r0E7ea5#e8v1)Iuo5!29f=S$w zf9IWATa#w#Q%2xI+0_R{YzIOhBZ|?ELkDNkxPk5UM)pQ!4y$yJ%|hawq-W~Sy_!D+ zUd|DQn%Asbsi(3X(G6dPO_D{MQJVYncDXL$xIudB}BGqqwZ z-ev@$et%5*CCe<-?%lHtjzSgFkACQ-PLgC6K2=x8MNkh+udZzick5nBQJ@qa@t*Q# z4d9nRnS}K4Ugp#caT^;IYQWH0yW1RbPxB~}=~-0eu(uzJekk?c`-nhR-&7xPR9y|# zZ`dWsPzqj7FheDX0m{R|pvhY$@0MZ7<~uxHxugRWl2KVjdfyxke5u};wC?51uf8c` ztXYW3sqP%d>cyy5%?4YjxvChfT13`fs2|^46X`zC?7Hl~cF{}2s1KX*F9|K-EDtcC*M6{ zkCuhuz!>isvu&Fiq$W4b;BSzc)NTt;UeuT`QFqT6?Njd79;~C+JPJ?I0rY zcEi|;ae}Wb54&tM5n|$)hu3hgHTOO9&> z$=m&Pc#Cts*CHj2oeuB&$A2&AsL$Axv>byv3A8c>iN!`P=hjE&aAmmn`1RmwNQy+Q|4|pQtLSv8y&3 zLPDL4TQD~v@XG>)F11d_LhK}yX+yl-%J%)EQZwt*r*4!ENLm!q8p|kFb+Mw~C7SK) zI~DZAS#x`~H=QV|nQ!ksABTEd=ami9()E`7Q)q8@wq+O7ZRCxlAD|4CH7^m^M{483 zo8!vSiTqeQ%uaU>_bliudBJxO{=G#O`*#w3u|)<5p*s6vH;;aRg+sFup#7Mk=2J;< z@#D~jYYF!yPJN95h3+sXi`Emsf{r4sN%m2Wi(+4gT7bmx)LD3fIQ`}c!}@R_&GpzQ zlE_<+Z**>3tc%x}taDlQWs9MIHW%743Rkw@K^h2m)8!`T(uJD-wfyZ zUSWnxKOx@=qHk};-!#i}rCd`l^Di<@eX;r0>+oWnUt4ooe5bKXv~RoyxMJEvpF!s{7I|VuXCnrNXjGL zgI;u1p}%^iOTH%Sg%cNH!pZ&&AS@&%cHyl6u=WsHmvbX>Wx0b-T5{3 z?kP*vlzzg{Xi+Ow;fL9?BnX`m#;_a1YQI`N8FW)qt9MOmxJkr?5tRXUv zLpsJth9cLSJCu#@Hc^wA_M8l|no0;v?=8O#%8z>?ueg#`sWNRyQ;}Z#Y+k9bg#vzrF#~wB&3b@8?9W>eX%l9y;ZDwR-y=?TAizmYu$LY0!Q}s~XT7fCv=#g~P&qtj^56zTGZYN*`=m zb;4(yVr--}_;E_Rbz1*g8Q7Lywsb#?h)@63w8&ck>WO!Mh*Vh&?ss8oH^H&Xf>vdi z#?p{>+^@;kP3Imu(DfX3PP{C<)*JZJ33q>JYD3gKBYd=;9xZn~zE(Y>&)(=x_yf7^ z>tJ-EJd-Xn)VdYwwLUUU_52y(r{&9sMu76UjASmx#`W}M>{%a(cw^Wr7ug|0?mCG< zp5E|qtms`ND_}WUyOg@P6H1;(7ys&t-uO6$dAJ~-M%9>iIV9kuEWt&A<&-Sg(}ykS zfp2ADVQ5BXqX_qIU}#sa#&w;=6eUSf1ovVPy$1X&Wz)L_1ktDCyaDhILm=iJ6R<=*dC<-U^VHK{}y zT^;M=vzm${uIp8ct?-&>Z;6i}+|HT_4nHZ3C%W2TdWVgQ^2KXGdxB-z*;{;^Unrv* zuZ$ItT5Od1fm=8(`lXCq#mCUPG;<(SUzeRu`U+}v_TQOt!tf7m4$g(Op#?MO7uL<% z$A!pVmZWPa$x+GmBz4l+Z`12#m_rdGR2uhgyFRs!dw~0&?RKC@e+TADeqsG{)gTzh zou_jLZ&xbU1*G)q?8jmv4NDrG7}L(Y%wK7=qPxkLV#S<0Ic|LR5`FFs-FB+|($5th zajkc)AkSk!PSX8Qx#ufIJk{#ON1>ZOTLgyOSui#^l+mTkNb$~-A%25-!xDSWe*H3z zJX2xebmhQ7Ua$uAB~ns*;-vh#;FuaIV^y9H2FvogWq;`Cp0a?*17!H+a+P4(7DzSl<;QpI8!{pIHO_No?XNv?h3 ziCr!zJF8Z-&tQKy96A9)(#odhfiR4nW}S(Tt0WUXI$&gwu)d6SZco2iJp~{pZQs=M z(b^Euo5=NbhNdbbD~PJ1NN;hcR&mzt8ba>{K*%MWdE)eaaoBaF#=VZp!n zT2E(_SaN)^R~Kljni`MCcE`o{8FIQ}|Dj z+)7TA6ui9`+c}yVHdIGGF*OgBELQ5z=I|bSd2{)+=?LsYaGnUf^0Q9lyr!hq^u>E8 zTvGJ>A;BdA&5>{i6oB{q^Z%CVTdSxMlRU3Haf2gKwg@M277#Cxg&FPyLs;56S&Or{ zqOEv@SR^IHbl?t9G;RjU#?~3dj3aSEiL=wo?3e_L7BJ4~n#gqs3VO=PAtp zU22nsS=myYMF$RtTR?yUAPC%opWn(#n1vbek0O7qUL2P-{r`~$gn>bVU?D3(K`4YD zYVk`N;BTl&{7Yp-IF-?WF?`R7@bJ!`D>#*DB5kd0o&Kj3_WxRASFecSiU58w{V)1* zw1puND1;T77lv>Ipj;eKa3szU0G3b~Ko^d*g*w<`eku&7J`f)O$j2ga^$IhynAR_) zY9Vn7N1|=vsGr@q0fS#wBmw5dnGr8g4De^iIT>#JJX;U7bwbH|I3ti~xaGM{CD2G$ zxESCchyEbbMI+%*$3J-eDePb3n179HKpk-gbk34Rg6~}Xe=gv^(ZJ7><&L;Ig7Z}% zZ7p2U2qcO{;^!v*lZzPO9~LAA_-9naG;tXH1o2Ohlr3?BY|)+)0zzOb3w|L8k1$jK z%EJ#7V64i3ZFva1vNFWz$Q85U3!T+{hy9GAc$`tM!8=y5yN zf+HPmQRgQD&Wh0RbJvjI!(sCe-T$IN+B!m!o;ZEuyagXf^!ENZT?ccNX&X0w2X1~7t>c{Ej-#7XvAU|~@_AAVs@4yy?wuSwPg_thF z6$$%U6LXG-t}O<~8pID2!cqU{$RDzP3f4im|3p;}frdKhL9HeD1aYqO&qL>QIJf#4 z>HcjAVzM@Hm_5qX@%M`U>|oYM+TzZ--xZ-O60$%Apd3(I7R(P4l#`Yh0Lk%53rj=VykIfFKlGp5+wUU$`W}`aiwPE^hz; literal 0 HcmV?d00001 diff --git a/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/policy.txt b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/policy.txt new file mode 100644 index 00000000..047110f4 --- /dev/null +++ b/samples/features/security/Always-Encrypted-with-secure-enclaves-in-Azure-SQL-Database/policy.txt @@ -0,0 +1,9 @@ +version= 1.0; +authorizationrules +{ + [ type=="x-ms-sgx-is-debuggable", value==false ] + && [ type=="x-ms-sgx-product-id", value==4639 ] + && [ type=="x-ms-sgx-svn", value>= 0 ] + && [ type=="x-ms-sgx-mrsigner", value=="e31c9e505f37a58de09335075fc8591254313eb20bb1a27e5443cc450b6e33e5"] + => permit(); +}; \ No newline at end of file