Description
Description:
I am trying to create my database in azure with TDE with database level customer-managed keys - using Terraform. Need help in achieving that.
I see --encryption-protector $keyid can be used in creation of db using Azure CLI. Is there something similar to use in terraform?
I am trying to achieve,
New supported scenario: Logical server configured with customer-managed key
Key1 is configured as the customer-managed key at the logical server level. A different customer-managed key (Key2) can be configured at the database level.
Server – Key1 set as CMK
Database1 – Key2 used as CMK
Database2 – Key1 used as CMK
Database3 – Key1 used as CMK
We have azurerm_mssql_server_transparent_data_encryption" for TDE at server level. I am looking for something similar for database level.
New or Affected Resource(s)/Data Source(s):
azurerm_mssql_database
Potential Terraform Configuration:
resource "azurerm_mssql_database_transparent_data_encryption" "msql_db_tde"{
server_id = azurerm_mssql_server.sql_server.id
database_name = azurerm_mssql_database.databases.name
key_vault_key_id = data.azurerm_key_vault_key.mssql_db_key.id
}
I was asked to create a thread here as there was no supporting Azure REST API that supports this feature ([https://github.com/hashicorp/terraform-provider-azurerm/issues/24316]). Please confirm if one exists and route me to there or help me with this issue.
Reference:
[https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok-database-level-overview?view=azuresql]
[https://learn.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok-database-level-basic-actions?view=azuresql&tabs=azure-portal%2Cazure-portal2#view-the-database-level-customer-managed-key-settings-on-an-azure-sql-database]