Summary

• Page properties (2 modified, 0 added, 0 removed)
• Attachments (0 modified, 0 added, 1 removed)
  • image-20250305152543-1.png

Details

Page properties

Author

...	...	@@ -1,1 +1,1 @@
1		-XWiki.rudim
	1	+XWiki.nikhils

Content

...	...	@@ -6,9 +6,6 @@
6	6	The process also includes creating a **credential** for secure backup to **Azure Blob Storage**, providing a scalable and secure solution for storing encrypted databases in the cloud.
7	7
8	8
9		-[[image:image-20250305152543-1.png]]
10		-
11		-
12	12	**~1. Create a Master Key in the master Database**
13	13	The first step is to create a **Master Key** in the master database. This key will be used to encrypt other cryptographic objects, such as certificates and symmetric keys, within SQL Server.
14	14
...	...	@@ -50,7 +50,7 @@
50	50	@Verify = 'N'
51	51	{{/code}}
52	52
53		-=== ===
	50	+=== ===
54	54
55	55	=== Conclusion: Backup to Azure Storage Account with TDE Encrypted Databases ===
56	56
...	...	@@ -75,10 +75,12 @@
75	75
76	76	* Go to the **Azure Portal** and select **Key Vault** (DemoRudiTest).
77	77
	75	+
78	78	**- Generate a New Key:**
79	79
80	80	* Go to the **Keys** section and click **Generate** to create a new key.
81	81
	80	+
82	82	**- Configure Key Settings:**
83	83
84	84	* **Name the Key**: Choose a name for your key, e.g., mysqlmikey.
...	...	@@ -91,6 +91,7 @@
91	91	* **It will likely affect CPU usage** more than disk I/O, and the impact might be more noticeable during key management operations (key generation, encryption, etc.).
92	92	* If your database is not under heavy load and your hardware can handle the extra processing, the trade-off for better security may be worth it.
93	93
	93	+
94	94	**- Create the Key:**
95	95
96	96	* Click **Create** to generate the key.
...	...	@@ -97,18 +97,21 @@
97	97
98	98
99	99
	100	+
100	100	===== **2. Enable TDE on the SQL Managed Instance** =====
101	101
102		-===== =====
	103	+===== =====
103	103
104	104	**- Navigate to Your Managed Instance:**
105	105
106	106	* Go to your **SQL Managed Instance** (sqlmi-ebs-lab).
107	107
	109	+
108	108	**- Enable Transparent Data Encryption (TDE):**
109	109
110	110	* Under **Security**, select **Transparent Data Encryption**.
111	111
	114	+
112	112	**- Configure TDE with a Customer-Managed Key (CMK):**
113	113
114	114	* Select **Customer-managed key** as the encryption type.
...	...	@@ -115,15 +115,18 @@
115	115	* Choose the key you created earlier from **Azure Key Vault** (mysqlmikey).
116	116
117	117
	121	+
118	118	**- Set the Key as Default TDE Protector:**
119	119
120	120	* Make the key the **default TDE protector** for your instance.
121	121
	126	+
122	122	**- Save Configuration:**
123	123
124	124	* Click **Save** to apply the changes.
125	125
126	126
	132	+
127	127	=== **Conclusion** ===
128	128
129	129	After following these steps, **TDE** has been successfully enabled on your **SQL Managed Instance** using an **asymmetric key** stored in **Azure Key Vault**. All databases within the instance are now encrypted using the same encryption key (identified by the same encryption thumbprint). You can now securely back up these encrypted databases from **SSMS** to **Azure Storage**.
...	...	@@ -260,6 +260,7 @@
260	260	* **CLOSE db_cursor**: This closes the cursor once the loop finishes processing all databases.
261	261	* **DEALLOCATE db_cursor**: This deallocates the cursor, freeing up any resources used by the cursor. It’s a good practice to always deallocate cursors to avoid resource leaks.
262	262
	269	+(% class="wikigeneratedid" %)
263	263	====== ======
264	264
265	265	====== **8. Full Script** ======
...	...	@@ -364,6 +364,7 @@
364	364
365	365	The SQL Server Agent job is now configured to automatically back up the **DBA databases** daily to an **Azure Storage Account**. The job will only back up databases that start with 'dba', and it handles encrypted databases with **Transparent Data Encryption (TDE)**. This ensures secure, encrypted backups are stored in the cloud without requiring manual intervention.
366	366
	374	+(% class="wikigeneratedid" %)
367	367	=== ===
368	368
369	369	===== Note: We could use the job activity monitor to see if the job executed successfully. =====
...	...	@@ -676,3 +676,4 @@
676	676
677	677
678	678
	687	+

image-20250305152543-1.png

Author

...	...	@@ -1,1 +1,0 @@
1		-XWiki.rudim

Size

...	...	@@ -1,1 +1,0 @@
1		-19.6 KB

Content