Docs Home
We recommend using Azure Native.
Azure v6.10.0 published on Tuesday, Nov 19, 2024 by Pulumi
azure.mssql.ManagedInstanceTransparentDataEncryption
Explore with Pulumi AI
Manages the transparent data encryption configuration for a MSSQL Managed Instance
NOTE: Once transparent data encryption(TDE) is enabled on a MS SQL instance, it is not possible to remove TDE. You will be able to switch between ‘ServiceManaged’ and ‘CustomerManaged’ keys, but will not be able to remove encryption. For safety when this resource is deleted, the TDE mode will automatically be set to ‘ServiceManaged’. See
key_vault_urifor more information on how to specify the key types. As SQL Managed Instance only supports a single configuration for encryption settings, this resource will replace the current encryption settings on the server.
Note: See documentation for important information on how handle lifecycle management of the keys to prevent data lockout.
Example Usage
With Service Managed Key
import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";
const example = new azure.core.ResourceGroup("example", {
name: "example-resources",
location: "EastUs",
});
const exampleVirtualNetwork = new azure.network.VirtualNetwork("example", {
name: "acctest-vnet1-mssql",
resourceGroupName: example.name,
addressSpaces: ["10.0.0.0/16"],
location: test.location,
});
const exampleSubnet = new azure.network.Subnet("example", {
name: "subnet1-mssql",
resourceGroupName: example.name,
virtualNetworkName: exampleVirtualNetwork.name,
addressPrefixes: ["10.0.0.0/24"],
delegations: [{
name: "managedinstancedelegation",
serviceDelegation: {
name: "Microsoft.Sql/managedInstances",
actions: [
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
"Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action",
],
},
}],
});
const exampleManagedInstance = new azure.mssql.ManagedInstance("example", {
name: "mssqlinstance",
resourceGroupName: example.name,
location: example.location,
licenseType: "BasePrice",
skuName: "GP_Gen5",
storageSizeInGb: 32,
subnetId: exampleSubnet.id,
vcores: 4,
administratorLogin: "missadministrator",
administratorLoginPassword: "NCC-1701-D",
identity: {
type: "SystemAssigned",
},
});
const exampleManagedInstanceTransparentDataEncryption = new azure.mssql.ManagedInstanceTransparentDataEncryption("example", {managedInstanceId: exampleManagedInstance.id});
import pulumi
import pulumi_azure as azure
example = azure.core.ResourceGroup("example",
name="example-resources",
location="EastUs")
example_virtual_network = azure.network.VirtualNetwork("example",
name="acctest-vnet1-mssql",
resource_group_name=example.name,
address_spaces=["10.0.0.0/16"],
location=test["location"])
example_subnet = azure.network.Subnet("example",
name="subnet1-mssql",
resource_group_name=example.name,
virtual_network_name=example_virtual_network.name,
address_prefixes=["10.0.0.0/24"],
delegations=[{
"name": "managedinstancedelegation",
"service_delegation": {
"name": "Microsoft.Sql/managedInstances",
"actions": [
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
"Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action",
],
},
}])
example_managed_instance = azure.mssql.ManagedInstance("example",
name="mssqlinstance",
resource_group_name=example.name,
location=example.location,
license_type="BasePrice",
sku_name="GP_Gen5",
storage_size_in_gb=32,
subnet_id=example_subnet.id,
vcores=4,
administrator_login="missadministrator",
administrator_login_password="NCC-1701-D",
identity={
"type": "SystemAssigned",
})
example_managed_instance_transparent_data_encryption = azure.mssql.ManagedInstanceTransparentDataEncryption("example", managed_instance_id=example_managed_instance.id)
package main
import (
"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/core"
"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/mssql"
"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/network"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
Name: pulumi.String("example-resources"),
Location: pulumi.String("EastUs"),
})
if err != nil {
return err
}
exampleVirtualNetwork, err := network.NewVirtualNetwork(ctx, "example", &network.VirtualNetworkArgs{
Name: pulumi.String("acctest-vnet1-mssql"),
ResourceGroupName: example.Name,
AddressSpaces: pulumi.StringArray{
pulumi.String("10.0.0.0/16"),
},
Location: pulumi.Any(test.Location),
})
if err != nil {
return err
}
exampleSubnet, err := network.NewSubnet(ctx, "example", &network.SubnetArgs{
Name: pulumi.String("subnet1-mssql"),
ResourceGroupName: example.Name,
VirtualNetworkName: exampleVirtualNetwork.Name,
AddressPrefixes: pulumi.StringArray{
pulumi.String("10.0.0.0/24"),
},
Delegations: network.SubnetDelegationArray{
&network.SubnetDelegationArgs{
Name: pulumi.String("managedinstancedelegation"),
ServiceDelegation: &network.SubnetDelegationServiceDelegationArgs{
Name: pulumi.String("Microsoft.Sql/managedInstances"),
Actions: pulumi.StringArray{
pulumi.String("Microsoft.Network/virtualNetworks/subnets/join/action"),
pulumi.String("Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action"),
pulumi.String("Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action"),
},
},
},
},
})
if err != nil {
return err
}
exampleManagedInstance, err := mssql.NewManagedInstance(ctx, "example", &mssql.ManagedInstanceArgs{
Name: pulumi.String("mssqlinstance"),
ResourceGroupName: example.Name,
Location: example.Location,
LicenseType: pulumi.String("BasePrice"),
SkuName: pulumi.String("GP_Gen5"),
StorageSizeInGb: pulumi.Int(32),
SubnetId: exampleSubnet.ID(),
Vcores: pulumi.Int(4),
AdministratorLogin: pulumi.String("missadministrator"),
AdministratorLoginPassword: pulumi.String("NCC-1701-D"),
Identity: &mssql.ManagedInstanceIdentityArgs{
Type: pulumi.String("SystemAssigned"),
},
})
if err != nil {
return err
}
_, err = mssql.NewManagedInstanceTransparentDataEncryption(ctx, "example", &mssql.ManagedInstanceTransparentDataEncryptionArgs{
ManagedInstanceId: exampleManagedInstance.ID(),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;
return await Deployment.RunAsync(() =>
{
var example = new Azure.Core.ResourceGroup("example", new()
{
Name = "example-resources",
Location = "EastUs",
});
var exampleVirtualNetwork = new Azure.Network.VirtualNetwork("example", new()
{
Name = "acctest-vnet1-mssql",
ResourceGroupName = example.Name,
AddressSpaces = new[]
{
"10.0.0.0/16",
},
Location = test.Location,
});
var exampleSubnet = new Azure.Network.Subnet("example", new()
{
Name = "subnet1-mssql",
ResourceGroupName = example.Name,
VirtualNetworkName = exampleVirtualNetwork.Name,
AddressPrefixes = new[]
{
"10.0.0.0/24",
},
Delegations = new[]
{
new Azure.Network.Inputs.SubnetDelegationArgs
{
Name = "managedinstancedelegation",
ServiceDelegation = new Azure.Network.Inputs.SubnetDelegationServiceDelegationArgs
{
Name = "Microsoft.Sql/managedInstances",
Actions = new[]
{
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
"Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action",
},
},
},
},
});
var exampleManagedInstance = new Azure.MSSql.ManagedInstance("example", new()
{
Name = "mssqlinstance",
ResourceGroupName = example.Name,
Location = example.Location,
LicenseType = "BasePrice",
SkuName = "GP_Gen5",
StorageSizeInGb = 32,
SubnetId = exampleSubnet.Id,
Vcores = 4,
AdministratorLogin = "missadministrator",
AdministratorLoginPassword = "NCC-1701-D",
Identity = new Azure.MSSql.Inputs.ManagedInstanceIdentityArgs
{
Type = "SystemAssigned",
},
});
var exampleManagedInstanceTransparentDataEncryption = new Azure.MSSql.ManagedInstanceTransparentDataEncryption("example", new()
{
ManagedInstanceId = exampleManagedInstance.Id,
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.network.VirtualNetwork;
import com.pulumi.azure.network.VirtualNetworkArgs;
import com.pulumi.azure.network.Subnet;
import com.pulumi.azure.network.SubnetArgs;
import com.pulumi.azure.network.inputs.SubnetDelegationArgs;
import com.pulumi.azure.network.inputs.SubnetDelegationServiceDelegationArgs;
import com.pulumi.azure.mssql.ManagedInstance;
import com.pulumi.azure.mssql.ManagedInstanceArgs;
import com.pulumi.azure.mssql.inputs.ManagedInstanceIdentityArgs;
import com.pulumi.azure.mssql.ManagedInstanceTransparentDataEncryption;
import com.pulumi.azure.mssql.ManagedInstanceTransparentDataEncryptionArgs;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
var example = new ResourceGroup("example", ResourceGroupArgs.builder()
.name("example-resources")
.location("EastUs")
.build());
var exampleVirtualNetwork = new VirtualNetwork("exampleVirtualNetwork", VirtualNetworkArgs.builder()
.name("acctest-vnet1-mssql")
.resourceGroupName(example.name())
.addressSpaces("10.0.0.0/16")
.location(test.location())
.build());
var exampleSubnet = new Subnet("exampleSubnet", SubnetArgs.builder()
.name("subnet1-mssql")
.resourceGroupName(example.name())
.virtualNetworkName(exampleVirtualNetwork.name())
.addressPrefixes("10.0.0.0/24")
.delegations(SubnetDelegationArgs.builder()
.name("managedinstancedelegation")
.serviceDelegation(SubnetDelegationServiceDelegationArgs.builder()
.name("Microsoft.Sql/managedInstances")
.actions(
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
"Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action")
.build())
.build())
.build());
var exampleManagedInstance = new ManagedInstance("exampleManagedInstance", ManagedInstanceArgs.builder()
.name("mssqlinstance")
.resourceGroupName(example.name())
.location(example.location())
.licenseType("BasePrice")
.skuName("GP_Gen5")
.storageSizeInGb(32)
.subnetId(exampleSubnet.id())
.vcores(4)
.administratorLogin("missadministrator")
.administratorLoginPassword("NCC-1701-D")
.identity(ManagedInstanceIdentityArgs.builder()
.type("SystemAssigned")
.build())
.build());
var exampleManagedInstanceTransparentDataEncryption = new ManagedInstanceTransparentDataEncryption("exampleManagedInstanceTransparentDataEncryption", ManagedInstanceTransparentDataEncryptionArgs.builder()
.managedInstanceId(exampleManagedInstance.id())
.build());
}
}
resources:
example:
type: azure:core:ResourceGroup
properties:
name: example-resources
location: EastUs
exampleVirtualNetwork:
type: azure:network:VirtualNetwork
name: example
properties:
name: acctest-vnet1-mssql
resourceGroupName: ${example.name}
addressSpaces:
- 10.0.0.0/16
location: ${test.location}
exampleSubnet:
type: azure:network:Subnet
name: example
properties:
name: subnet1-mssql
resourceGroupName: ${example.name}
virtualNetworkName: ${exampleVirtualNetwork.name}
addressPrefixes:
- 10.0.0.0/24
delegations:
- name: managedinstancedelegation
serviceDelegation:
name: Microsoft.Sql/managedInstances
actions:
- Microsoft.Network/virtualNetworks/subnets/join/action
- Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action
- Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action
exampleManagedInstance:
type: azure:mssql:ManagedInstance
name: example
properties:
name: mssqlinstance
resourceGroupName: ${example.name}
location: ${example.location}
licenseType: BasePrice
skuName: GP_Gen5
storageSizeInGb: 32
subnetId: ${exampleSubnet.id}
vcores: 4
administratorLogin: missadministrator
administratorLoginPassword: NCC-1701-D
identity:
type: SystemAssigned
exampleManagedInstanceTransparentDataEncryption:
type: azure:mssql:ManagedInstanceTransparentDataEncryption
name: example
properties:
managedInstanceId: ${exampleManagedInstance.id}
With Customer Managed Key
import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";
const current = azure.core.getClientConfig({});
const example = new azure.core.ResourceGroup("example", {
name: "example-resources",
location: "EastUs",
});
const exampleVirtualNetwork = new azure.network.VirtualNetwork("example", {
name: "acctest-vnet1-mssql",
resourceGroupName: example.name,
addressSpaces: ["10.0.0.0/16"],
location: test.location,
});
const exampleSubnet = new azure.network.Subnet("example", {
name: "subnet1-mssql",
resourceGroupName: example.name,
virtualNetworkName: exampleVirtualNetwork.name,
addressPrefixes: ["10.0.0.0/24"],
delegations: [{
name: "managedinstancedelegation",
serviceDelegation: {
name: "Microsoft.Sql/managedInstances",
actions: [
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
"Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action",
],
},
}],
});
const exampleManagedInstance = new azure.mssql.ManagedInstance("example", {
name: "mssqlinstance",
resourceGroupName: example.name,
location: example.location,
licenseType: "BasePrice",
skuName: "GP_Gen5",
storageSizeInGb: 32,
subnetId: exampleSubnet.id,
vcores: 4,
administratorLogin: "missadministrator",
administratorLoginPassword: "NCC-1701-D",
identity: {
type: "SystemAssigned",
},
});
// Create a key vault with policies for the deployer to create a key & SQL Managed Instance to wrap/unwrap/get key
const exampleKeyVault = new azure.keyvault.KeyVault("example", {
name: "example",
location: example.location,
resourceGroupName: example.name,
enabledForDiskEncryption: true,
tenantId: current.then(current => current.tenantId),
softDeleteRetentionDays: 7,
purgeProtectionEnabled: false,
skuName: "standard",
accessPolicies: [
{
tenantId: current.then(current => current.tenantId),
objectId: current.then(current => current.objectId),
keyPermissions: [
"Get",
"List",
"Create",
"Delete",
"Update",
"Recover",
"Purge",
"GetRotationPolicy",
],
},
{
tenantId: exampleManagedInstance.identity.apply(identity => identity?.tenantId),
objectId: exampleManagedInstance.identity.apply(identity => identity?.principalId),
keyPermissions: [
"Get",
"WrapKey",
"UnwrapKey",
],
},
],
});
const exampleKey = new azure.keyvault.Key("example", {
name: "byok",
keyVaultId: exampleKeyVault.id,
keyType: "RSA",
keySize: 2048,
keyOpts: [
"unwrapKey",
"wrapKey",
],
}, {
dependsOn: [exampleKeyVault],
});
const exampleManagedInstanceTransparentDataEncryption = new azure.mssql.ManagedInstanceTransparentDataEncryption("example", {
managedInstanceId: exampleManagedInstance.id,
keyVaultKeyId: exampleKey.id,
});
import pulumi
import pulumi_azure as azure
current = azure.core.get_client_config()
example = azure.core.ResourceGroup("example",
name="example-resources",
location="EastUs")
example_virtual_network = azure.network.VirtualNetwork("example",
name="acctest-vnet1-mssql",
resource_group_name=example.name,
address_spaces=["10.0.0.0/16"],
location=test["location"])
example_subnet = azure.network.Subnet("example",
name="subnet1-mssql",
resource_group_name=example.name,
virtual_network_name=example_virtual_network.name,
address_prefixes=["10.0.0.0/24"],
delegations=[{
"name": "managedinstancedelegation",
"service_delegation": {
"name": "Microsoft.Sql/managedInstances",
"actions": [
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
"Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action",
],
},
}])
example_managed_instance = azure.mssql.ManagedInstance("example",
name="mssqlinstance",
resource_group_name=example.name,
location=example.location,
license_type="BasePrice",
sku_name="GP_Gen5",
storage_size_in_gb=32,
subnet_id=example_subnet.id,
vcores=4,
administrator_login="missadministrator",
administrator_login_password="NCC-1701-D",
identity={
"type": "SystemAssigned",
})
# Create a key vault with policies for the deployer to create a key & SQL Managed Instance to wrap/unwrap/get key
example_key_vault = azure.keyvault.KeyVault("example",
name="example",
location=example.location,
resource_group_name=example.name,
enabled_for_disk_encryption=True,
tenant_id=current.tenant_id,
soft_delete_retention_days=7,
purge_protection_enabled=False,
sku_name="standard",
access_policies=[
{
"tenant_id": current.tenant_id,
"object_id": current.object_id,
"key_permissions": [
"Get",
"List",
"Create",
"Delete",
"Update",
"Recover",
"Purge",
"GetRotationPolicy",
],
},
{
"tenant_id": example_managed_instance.identity.tenant_id,
"object_id": example_managed_instance.identity.principal_id,
"key_permissions": [
"Get",
"WrapKey",
"UnwrapKey",
],
},
])
example_key = azure.keyvault.Key("example",
name="byok",
key_vault_id=example_key_vault.id,
key_type="RSA",
key_size=2048,
key_opts=[
"unwrapKey",
"wrapKey",
],
opts = pulumi.ResourceOptions(depends_on=[example_key_vault]))
example_managed_instance_transparent_data_encryption = azure.mssql.ManagedInstanceTransparentDataEncryption("example",
managed_instance_id=example_managed_instance.id,
key_vault_key_id=example_key.id)
package main
import (
"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/core"
"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/keyvault"
"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/mssql"
"github.com/pulumi/pulumi-azure/sdk/v6/go/azure/network"
"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)
func main() {
pulumi.Run(func(ctx *pulumi.Context) error {
current, err := core.GetClientConfig(ctx, map[string]interface{}{}, nil)
if err != nil {
return err
}
example, err := core.NewResourceGroup(ctx, "example", &core.ResourceGroupArgs{
Name: pulumi.String("example-resources"),
Location: pulumi.String("EastUs"),
})
if err != nil {
return err
}
exampleVirtualNetwork, err := network.NewVirtualNetwork(ctx, "example", &network.VirtualNetworkArgs{
Name: pulumi.String("acctest-vnet1-mssql"),
ResourceGroupName: example.Name,
AddressSpaces: pulumi.StringArray{
pulumi.String("10.0.0.0/16"),
},
Location: pulumi.Any(test.Location),
})
if err != nil {
return err
}
exampleSubnet, err := network.NewSubnet(ctx, "example", &network.SubnetArgs{
Name: pulumi.String("subnet1-mssql"),
ResourceGroupName: example.Name,
VirtualNetworkName: exampleVirtualNetwork.Name,
AddressPrefixes: pulumi.StringArray{
pulumi.String("10.0.0.0/24"),
},
Delegations: network.SubnetDelegationArray{
&network.SubnetDelegationArgs{
Name: pulumi.String("managedinstancedelegation"),
ServiceDelegation: &network.SubnetDelegationServiceDelegationArgs{
Name: pulumi.String("Microsoft.Sql/managedInstances"),
Actions: pulumi.StringArray{
pulumi.String("Microsoft.Network/virtualNetworks/subnets/join/action"),
pulumi.String("Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action"),
pulumi.String("Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action"),
},
},
},
},
})
if err != nil {
return err
}
exampleManagedInstance, err := mssql.NewManagedInstance(ctx, "example", &mssql.ManagedInstanceArgs{
Name: pulumi.String("mssqlinstance"),
ResourceGroupName: example.Name,
Location: example.Location,
LicenseType: pulumi.String("BasePrice"),
SkuName: pulumi.String("GP_Gen5"),
StorageSizeInGb: pulumi.Int(32),
SubnetId: exampleSubnet.ID(),
Vcores: pulumi.Int(4),
AdministratorLogin: pulumi.String("missadministrator"),
AdministratorLoginPassword: pulumi.String("NCC-1701-D"),
Identity: &mssql.ManagedInstanceIdentityArgs{
Type: pulumi.String("SystemAssigned"),
},
})
if err != nil {
return err
}
// Create a key vault with policies for the deployer to create a key & SQL Managed Instance to wrap/unwrap/get key
exampleKeyVault, err := keyvault.NewKeyVault(ctx, "example", &keyvault.KeyVaultArgs{
Name: pulumi.String("example"),
Location: example.Location,
ResourceGroupName: example.Name,
EnabledForDiskEncryption: pulumi.Bool(true),
TenantId: pulumi.String(current.TenantId),
SoftDeleteRetentionDays: pulumi.Int(7),
PurgeProtectionEnabled: pulumi.Bool(false),
SkuName: pulumi.String("standard"),
AccessPolicies: keyvault.KeyVaultAccessPolicyArray{
&keyvault.KeyVaultAccessPolicyArgs{
TenantId: pulumi.String(current.TenantId),
ObjectId: pulumi.String(current.ObjectId),
KeyPermissions: pulumi.StringArray{
pulumi.String("Get"),
pulumi.String("List"),
pulumi.String("Create"),
pulumi.String("Delete"),
pulumi.String("Update"),
pulumi.String("Recover"),
pulumi.String("Purge"),
pulumi.String("GetRotationPolicy"),
},
},
&keyvault.KeyVaultAccessPolicyArgs{
TenantId: exampleManagedInstance.Identity.ApplyT(func(identity mssql.ManagedInstanceIdentity) (*string, error) {
return &identity.TenantId, nil
}).(pulumi.StringPtrOutput),
ObjectId: exampleManagedInstance.Identity.ApplyT(func(identity mssql.ManagedInstanceIdentity) (*string, error) {
return &identity.PrincipalId, nil
}).(pulumi.StringPtrOutput),
KeyPermissions: pulumi.StringArray{
pulumi.String("Get"),
pulumi.String("WrapKey"),
pulumi.String("UnwrapKey"),
},
},
},
})
if err != nil {
return err
}
exampleKey, err := keyvault.NewKey(ctx, "example", &keyvault.KeyArgs{
Name: pulumi.String("byok"),
KeyVaultId: exampleKeyVault.ID(),
KeyType: pulumi.String("RSA"),
KeySize: pulumi.Int(2048),
KeyOpts: pulumi.StringArray{
pulumi.String("unwrapKey"),
pulumi.String("wrapKey"),
},
}, pulumi.DependsOn([]pulumi.Resource{
exampleKeyVault,
}))
if err != nil {
return err
}
_, err = mssql.NewManagedInstanceTransparentDataEncryption(ctx, "example", &mssql.ManagedInstanceTransparentDataEncryptionArgs{
ManagedInstanceId: exampleManagedInstance.ID(),
KeyVaultKeyId: exampleKey.ID(),
})
if err != nil {
return err
}
return nil
})
}
using System.Collections.Generic;
using System.Linq;
using Pulumi;
using Azure = Pulumi.Azure;
return await Deployment.RunAsync(() =>
{
var current = Azure.Core.GetClientConfig.Invoke();
var example = new Azure.Core.ResourceGroup("example", new()
{
Name = "example-resources",
Location = "EastUs",
});
var exampleVirtualNetwork = new Azure.Network.VirtualNetwork("example", new()
{
Name = "acctest-vnet1-mssql",
ResourceGroupName = example.Name,
AddressSpaces = new[]
{
"10.0.0.0/16",
},
Location = test.Location,
});
var exampleSubnet = new Azure.Network.Subnet("example", new()
{
Name = "subnet1-mssql",
ResourceGroupName = example.Name,
VirtualNetworkName = exampleVirtualNetwork.Name,
AddressPrefixes = new[]
{
"10.0.0.0/24",
},
Delegations = new[]
{
new Azure.Network.Inputs.SubnetDelegationArgs
{
Name = "managedinstancedelegation",
ServiceDelegation = new Azure.Network.Inputs.SubnetDelegationServiceDelegationArgs
{
Name = "Microsoft.Sql/managedInstances",
Actions = new[]
{
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
"Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action",
},
},
},
},
});
var exampleManagedInstance = new Azure.MSSql.ManagedInstance("example", new()
{
Name = "mssqlinstance",
ResourceGroupName = example.Name,
Location = example.Location,
LicenseType = "BasePrice",
SkuName = "GP_Gen5",
StorageSizeInGb = 32,
SubnetId = exampleSubnet.Id,
Vcores = 4,
AdministratorLogin = "missadministrator",
AdministratorLoginPassword = "NCC-1701-D",
Identity = new Azure.MSSql.Inputs.ManagedInstanceIdentityArgs
{
Type = "SystemAssigned",
},
});
// Create a key vault with policies for the deployer to create a key & SQL Managed Instance to wrap/unwrap/get key
var exampleKeyVault = new Azure.KeyVault.KeyVault("example", new()
{
Name = "example",
Location = example.Location,
ResourceGroupName = example.Name,
EnabledForDiskEncryption = true,
TenantId = current.Apply(getClientConfigResult => getClientConfigResult.TenantId),
SoftDeleteRetentionDays = 7,
PurgeProtectionEnabled = false,
SkuName = "standard",
AccessPolicies = new[]
{
new Azure.KeyVault.Inputs.KeyVaultAccessPolicyArgs
{
TenantId = current.Apply(getClientConfigResult => getClientConfigResult.TenantId),
ObjectId = current.Apply(getClientConfigResult => getClientConfigResult.ObjectId),
KeyPermissions = new[]
{
"Get",
"List",
"Create",
"Delete",
"Update",
"Recover",
"Purge",
"GetRotationPolicy",
},
},
new Azure.KeyVault.Inputs.KeyVaultAccessPolicyArgs
{
TenantId = exampleManagedInstance.Identity.Apply(identity => identity?.TenantId),
ObjectId = exampleManagedInstance.Identity.Apply(identity => identity?.PrincipalId),
KeyPermissions = new[]
{
"Get",
"WrapKey",
"UnwrapKey",
},
},
},
});
var exampleKey = new Azure.KeyVault.Key("example", new()
{
Name = "byok",
KeyVaultId = exampleKeyVault.Id,
KeyType = "RSA",
KeySize = 2048,
KeyOpts = new[]
{
"unwrapKey",
"wrapKey",
},
}, new CustomResourceOptions
{
DependsOn =
{
exampleKeyVault,
},
});
var exampleManagedInstanceTransparentDataEncryption = new Azure.MSSql.ManagedInstanceTransparentDataEncryption("example", new()
{
ManagedInstanceId = exampleManagedInstance.Id,
KeyVaultKeyId = exampleKey.Id,
});
});
package generated_program;
import com.pulumi.Context;
import com.pulumi.Pulumi;
import com.pulumi.core.Output;
import com.pulumi.azure.core.CoreFunctions;
import com.pulumi.azure.core.ResourceGroup;
import com.pulumi.azure.core.ResourceGroupArgs;
import com.pulumi.azure.network.VirtualNetwork;
import com.pulumi.azure.network.VirtualNetworkArgs;
import com.pulumi.azure.network.Subnet;
import com.pulumi.azure.network.SubnetArgs;
import com.pulumi.azure.network.inputs.SubnetDelegationArgs;
import com.pulumi.azure.network.inputs.SubnetDelegationServiceDelegationArgs;
import com.pulumi.azure.mssql.ManagedInstance;
import com.pulumi.azure.mssql.ManagedInstanceArgs;
import com.pulumi.azure.mssql.inputs.ManagedInstanceIdentityArgs;
import com.pulumi.azure.keyvault.KeyVault;
import com.pulumi.azure.keyvault.KeyVaultArgs;
import com.pulumi.azure.keyvault.inputs.KeyVaultAccessPolicyArgs;
import com.pulumi.azure.keyvault.Key;
import com.pulumi.azure.keyvault.KeyArgs;
import com.pulumi.azure.mssql.ManagedInstanceTransparentDataEncryption;
import com.pulumi.azure.mssql.ManagedInstanceTransparentDataEncryptionArgs;
import com.pulumi.resources.CustomResourceOptions;
import java.util.List;
import java.util.ArrayList;
import java.util.Map;
import java.io.File;
import java.nio.file.Files;
import java.nio.file.Paths;
public class App {
public static void main(String[] args) {
Pulumi.run(App::stack);
}
public static void stack(Context ctx) {
final var current = CoreFunctions.getClientConfig();
var example = new ResourceGroup("example", ResourceGroupArgs.builder()
.name("example-resources")
.location("EastUs")
.build());
var exampleVirtualNetwork = new VirtualNetwork("exampleVirtualNetwork", VirtualNetworkArgs.builder()
.name("acctest-vnet1-mssql")
.resourceGroupName(example.name())
.addressSpaces("10.0.0.0/16")
.location(test.location())
.build());
var exampleSubnet = new Subnet("exampleSubnet", SubnetArgs.builder()
.name("subnet1-mssql")
.resourceGroupName(example.name())
.virtualNetworkName(exampleVirtualNetwork.name())
.addressPrefixes("10.0.0.0/24")
.delegations(SubnetDelegationArgs.builder()
.name("managedinstancedelegation")
.serviceDelegation(SubnetDelegationServiceDelegationArgs.builder()
.name("Microsoft.Sql/managedInstances")
.actions(
"Microsoft.Network/virtualNetworks/subnets/join/action",
"Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action",
"Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action")
.build())
.build())
.build());
var exampleManagedInstance = new ManagedInstance("exampleManagedInstance", ManagedInstanceArgs.builder()
.name("mssqlinstance")
.resourceGroupName(example.name())
.location(example.location())
.licenseType("BasePrice")
.skuName("GP_Gen5")
.storageSizeInGb(32)
.subnetId(exampleSubnet.id())
.vcores(4)
.administratorLogin("missadministrator")
.administratorLoginPassword("NCC-1701-D")
.identity(ManagedInstanceIdentityArgs.builder()
.type("SystemAssigned")
.build())
.build());
// Create a key vault with policies for the deployer to create a key & SQL Managed Instance to wrap/unwrap/get key
var exampleKeyVault = new KeyVault("exampleKeyVault", KeyVaultArgs.builder()
.name("example")
.location(example.location())
.resourceGroupName(example.name())
.enabledForDiskEncryption(true)
.tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
.softDeleteRetentionDays(7)
.purgeProtectionEnabled(false)
.skuName("standard")
.accessPolicies(
KeyVaultAccessPolicyArgs.builder()
.tenantId(current.applyValue(getClientConfigResult -> getClientConfigResult.tenantId()))
.objectId(current.applyValue(getClientConfigResult -> getClientConfigResult.objectId()))
.keyPermissions(
"Get",
"List",
"Create",
"Delete",
"Update",
"Recover",
"Purge",
"GetRotationPolicy")
.build(),
KeyVaultAccessPolicyArgs.builder()
.tenantId(exampleManagedInstance.identity().applyValue(identity -> identity.tenantId()))
.objectId(exampleManagedInstance.identity().applyValue(identity -> identity.principalId()))
.keyPermissions(
"Get",
"WrapKey",
"UnwrapKey")
.build())
.build());
var exampleKey = new Key("exampleKey", KeyArgs.builder()
.name("byok")
.keyVaultId(exampleKeyVault.id())
.keyType("RSA")
.keySize(2048)
.keyOpts(
"unwrapKey",
"wrapKey")
.build(), CustomResourceOptions.builder()
.dependsOn(exampleKeyVault)
.build());
var exampleManagedInstanceTransparentDataEncryption = new ManagedInstanceTransparentDataEncryption("exampleManagedInstanceTransparentDataEncryption", ManagedInstanceTransparentDataEncryptionArgs.builder()
.managedInstanceId(exampleManagedInstance.id())
.keyVaultKeyId(exampleKey.id())
.build());
}
}
resources:
example:
type: azure:core:ResourceGroup
properties:
name: example-resources
location: EastUs
exampleVirtualNetwork:
type: azure:network:VirtualNetwork
name: example
properties:
name: acctest-vnet1-mssql
resourceGroupName: ${example.name}
addressSpaces:
- 10.0.0.0/16
location: ${test.location}
exampleSubnet:
type: azure:network:Subnet
name: example
properties:
name: subnet1-mssql
resourceGroupName: ${example.name}
virtualNetworkName: ${exampleVirtualNetwork.name}
addressPrefixes:
- 10.0.0.0/24
delegations:
- name: managedinstancedelegation
serviceDelegation:
name: Microsoft.Sql/managedInstances
actions:
- Microsoft.Network/virtualNetworks/subnets/join/action
- Microsoft.Network/virtualNetworks/subnets/prepareNetworkPolicies/action
- Microsoft.Network/virtualNetworks/subnets/unprepareNetworkPolicies/action
exampleManagedInstance:
type: azure:mssql:ManagedInstance
name: example
properties:
name: mssqlinstance
resourceGroupName: ${example.name}
location: ${example.location}
licenseType: BasePrice
skuName: GP_Gen5
storageSizeInGb: 32
subnetId: ${exampleSubnet.id}
vcores: 4
administratorLogin: missadministrator
administratorLoginPassword: NCC-1701-D
identity:
type: SystemAssigned
# Create a key vault with policies for the deployer to create a key & SQL Managed Instance to wrap/unwrap/get key
exampleKeyVault:
type: azure:keyvault:KeyVault
name: example
properties:
name: example
location: ${example.location}
resourceGroupName: ${example.name}
enabledForDiskEncryption: true
tenantId: ${current.tenantId}
softDeleteRetentionDays: 7
purgeProtectionEnabled: false
skuName: standard
accessPolicies:
- tenantId: ${current.tenantId}
objectId: ${current.objectId}
keyPermissions:
- Get
- List
- Create
- Delete
- Update
- Recover
- Purge
- GetRotationPolicy
- tenantId: ${exampleManagedInstance.identity.tenantId}
objectId: ${exampleManagedInstance.identity.principalId}
keyPermissions:
- Get
- WrapKey
- UnwrapKey
exampleKey:
type: azure:keyvault:Key
name: example
properties:
name: byok
keyVaultId: ${exampleKeyVault.id}
keyType: RSA
keySize: 2048
keyOpts:
- unwrapKey
- wrapKey
options:
dependson:
- ${exampleKeyVault}
exampleManagedInstanceTransparentDataEncryption:
type: azure:mssql:ManagedInstanceTransparentDataEncryption
name: example
properties:
managedInstanceId: ${exampleManagedInstance.id}
keyVaultKeyId: ${exampleKey.id}
variables:
current:
fn::invoke:
Function: azure:core:getClientConfig
Arguments: {}
Create ManagedInstanceTransparentDataEncryption Resource
Resources are created with functions called constructors. To learn more about declaring and configuring resources, see Resources.
Constructor syntax
new ManagedInstanceTransparentDataEncryption(name: string, args: ManagedInstanceTransparentDataEncryptionArgs, opts?: CustomResourceOptions);@overload
def ManagedInstanceTransparentDataEncryption(resource_name: str,
args: ManagedInstanceTransparentDataEncryptionArgs,
opts: Optional[ResourceOptions] = None)
@overload
def ManagedInstanceTransparentDataEncryption(resource_name: str,
opts: Optional[ResourceOptions] = None,
managed_instance_id: Optional[str] = None,
auto_rotation_enabled: Optional[bool] = None,
key_vault_key_id: Optional[str] = None)func NewManagedInstanceTransparentDataEncryption(ctx *Context, name string, args ManagedInstanceTransparentDataEncryptionArgs, opts ...ResourceOption) (*ManagedInstanceTransparentDataEncryption, error)public ManagedInstanceTransparentDataEncryption(string name, ManagedInstanceTransparentDataEncryptionArgs args, CustomResourceOptions? opts = null)
public ManagedInstanceTransparentDataEncryption(String name, ManagedInstanceTransparentDataEncryptionArgs args)
public ManagedInstanceTransparentDataEncryption(String name, ManagedInstanceTransparentDataEncryptionArgs args, CustomResourceOptions options)
type: azure:mssql:ManagedInstanceTransparentDataEncryption
properties: # The arguments to resource properties.
options: # Bag of options to control resource's behavior.
Parameters
- name string
- The unique name of the resource.
- args ManagedInstanceTransparentDataEncryptionArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- resource_name str
- The unique name of the resource.
- args ManagedInstanceTransparentDataEncryptionArgs
- The arguments to resource properties.
- opts ResourceOptions
- Bag of options to control resource's behavior.
- ctx Context
- Context object for the current deployment.
- name string
- The unique name of the resource.
- args ManagedInstanceTransparentDataEncryptionArgs
- The arguments to resource properties.
- opts ResourceOption
- Bag of options to control resource's behavior.
- name string
- The unique name of the resource.
- args ManagedInstanceTransparentDataEncryptionArgs
- The arguments to resource properties.
- opts CustomResourceOptions
- Bag of options to control resource's behavior.
- name String
- The unique name of the resource.
- args ManagedInstanceTransparentDataEncryptionArgs
- The arguments to resource properties.
- options CustomResourceOptions
- Bag of options to control resource's behavior.
Constructor example
The following reference example uses placeholder values for all input properties.
var managedInstanceTransparentDataEncryptionResource = new Azure.MSSql.ManagedInstanceTransparentDataEncryption("managedInstanceTransparentDataEncryptionResource", new()
{
ManagedInstanceId = "string",
AutoRotationEnabled = false,
KeyVaultKeyId = "string",
});
example, err := mssql.NewManagedInstanceTransparentDataEncryption(ctx, "managedInstanceTransparentDataEncryptionResource", &mssql.ManagedInstanceTransparentDataEncryptionArgs{
ManagedInstanceId: pulumi.String("string"),
AutoRotationEnabled: pulumi.Bool(false),
KeyVaultKeyId: pulumi.String("string"),
})
var managedInstanceTransparentDataEncryptionResource = new ManagedInstanceTransparentDataEncryption("managedInstanceTransparentDataEncryptionResource", ManagedInstanceTransparentDataEncryptionArgs.builder()
.managedInstanceId("string")
.autoRotationEnabled(false)
.keyVaultKeyId("string")
.build());
managed_instance_transparent_data_encryption_resource = azure.mssql.ManagedInstanceTransparentDataEncryption("managedInstanceTransparentDataEncryptionResource",
managed_instance_id="string",
auto_rotation_enabled=False,
key_vault_key_id="string")
const managedInstanceTransparentDataEncryptionResource = new azure.mssql.ManagedInstanceTransparentDataEncryption("managedInstanceTransparentDataEncryptionResource", {
managedInstanceId: "string",
autoRotationEnabled: false,
keyVaultKeyId: "string",
});
type: azure:mssql:ManagedInstanceTransparentDataEncryption
properties:
autoRotationEnabled: false
keyVaultKeyId: string
managedInstanceId: string
ManagedInstanceTransparentDataEncryption Resource Properties
To learn more about resource properties and how to use them, see Inputs and Outputs in the Architecture and Concepts docs.
Inputs
In Python, inputs that are objects can be passed either as argument classes or as dictionary literals.
The ManagedInstanceTransparentDataEncryption resource accepts the following input properties:
- Managed
Instance stringId - Specifies the name of the MS SQL Managed Instance. Changing this forces a new resource to be created.
- Auto
Rotation boolEnabled - When enabled, the SQL Managed Instance will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the SQL Managed Instance will be automatically rotated to the latest key version within 60 minutes.
- Key
Vault stringKey Id - To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
- Managed
Instance stringId - Specifies the name of the MS SQL Managed Instance. Changing this forces a new resource to be created.
- Auto
Rotation boolEnabled - When enabled, the SQL Managed Instance will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the SQL Managed Instance will be automatically rotated to the latest key version within 60 minutes.
- Key
Vault stringKey Id - To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
- managed
Instance StringId - Specifies the name of the MS SQL Managed Instance. Changing this forces a new resource to be created.
- auto
Rotation BooleanEnabled - When enabled, the SQL Managed Instance will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the SQL Managed Instance will be automatically rotated to the latest key version within 60 minutes.
- key
Vault StringKey Id - To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
- managed
Instance stringId - Specifies the name of the MS SQL Managed Instance. Changing this forces a new resource to be created.
- auto
Rotation booleanEnabled - When enabled, the SQL Managed Instance will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the SQL Managed Instance will be automatically rotated to the latest key version within 60 minutes.
- key
Vault stringKey Id - To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
- managed_
instance_ strid - Specifies the name of the MS SQL Managed Instance. Changing this forces a new resource to be created.
- auto_
rotation_ boolenabled - When enabled, the SQL Managed Instance will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the SQL Managed Instance will be automatically rotated to the latest key version within 60 minutes.
- key_
vault_ strkey_ id - To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
- managed
Instance StringId - Specifies the name of the MS SQL Managed Instance. Changing this forces a new resource to be created.
- auto
Rotation BooleanEnabled - When enabled, the SQL Managed Instance will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the SQL Managed Instance will be automatically rotated to the latest key version within 60 minutes.
- key
Vault StringKey Id - To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
Outputs
All input properties are implicitly available as output properties. Additionally, the ManagedInstanceTransparentDataEncryption resource produces the following output properties:
- Id string
- The provider-assigned unique ID for this managed resource.
- Id string
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
- id string
- The provider-assigned unique ID for this managed resource.
- id str
- The provider-assigned unique ID for this managed resource.
- id String
- The provider-assigned unique ID for this managed resource.
Look up Existing ManagedInstanceTransparentDataEncryption Resource
Get an existing ManagedInstanceTransparentDataEncryption resource’s state with the given name, ID, and optional extra properties used to qualify the lookup.
public static get(name: string, id: Input<ID>, state?: ManagedInstanceTransparentDataEncryptionState, opts?: CustomResourceOptions): ManagedInstanceTransparentDataEncryption@staticmethod
def get(resource_name: str,
id: str,
opts: Optional[ResourceOptions] = None,
auto_rotation_enabled: Optional[bool] = None,
key_vault_key_id: Optional[str] = None,
managed_instance_id: Optional[str] = None) -> ManagedInstanceTransparentDataEncryptionfunc GetManagedInstanceTransparentDataEncryption(ctx *Context, name string, id IDInput, state *ManagedInstanceTransparentDataEncryptionState, opts ...ResourceOption) (*ManagedInstanceTransparentDataEncryption, error)public static ManagedInstanceTransparentDataEncryption Get(string name, Input<string> id, ManagedInstanceTransparentDataEncryptionState? state, CustomResourceOptions? opts = null)public static ManagedInstanceTransparentDataEncryption get(String name, Output<String> id, ManagedInstanceTransparentDataEncryptionState state, CustomResourceOptions options)Resource lookup is not supported in YAML- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- resource_name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- name
- The unique name of the resulting resource.
- id
- The unique provider ID of the resource to lookup.
- state
- Any extra arguments used during the lookup.
- opts
- A bag of options that control this resource's behavior.
- Auto
Rotation boolEnabled - When enabled, the SQL Managed Instance will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the SQL Managed Instance will be automatically rotated to the latest key version within 60 minutes.
- Key
Vault stringKey Id - To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
- Managed
Instance stringId - Specifies the name of the MS SQL Managed Instance. Changing this forces a new resource to be created.
- Auto
Rotation boolEnabled - When enabled, the SQL Managed Instance will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the SQL Managed Instance will be automatically rotated to the latest key version within 60 minutes.
- Key
Vault stringKey Id - To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
- Managed
Instance stringId - Specifies the name of the MS SQL Managed Instance. Changing this forces a new resource to be created.
- auto
Rotation BooleanEnabled - When enabled, the SQL Managed Instance will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the SQL Managed Instance will be automatically rotated to the latest key version within 60 minutes.
- key
Vault StringKey Id - To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
- managed
Instance StringId - Specifies the name of the MS SQL Managed Instance. Changing this forces a new resource to be created.
- auto
Rotation booleanEnabled - When enabled, the SQL Managed Instance will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the SQL Managed Instance will be automatically rotated to the latest key version within 60 minutes.
- key
Vault stringKey Id - To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
- managed
Instance stringId - Specifies the name of the MS SQL Managed Instance. Changing this forces a new resource to be created.
- auto_
rotation_ boolenabled - When enabled, the SQL Managed Instance will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the SQL Managed Instance will be automatically rotated to the latest key version within 60 minutes.
- key_
vault_ strkey_ id - To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
- managed_
instance_ strid - Specifies the name of the MS SQL Managed Instance. Changing this forces a new resource to be created.
- auto
Rotation BooleanEnabled - When enabled, the SQL Managed Instance will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the SQL Managed Instance will be automatically rotated to the latest key version within 60 minutes.
- key
Vault StringKey Id - To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
- managed
Instance StringId - Specifies the name of the MS SQL Managed Instance. Changing this forces a new resource to be created.
Import
SQL Managed Instance Transparent Data Encryption can be imported using the resource id, e.g.
$ pulumi import azure:mssql/managedInstanceTransparentDataEncryption:ManagedInstanceTransparentDataEncryption example /subscriptions/12345678-1234-9876-4563-123456789012/resourceGroups/group1/providers/Microsoft.Sql/managedInstances/instance1/encryptionProtector/current
To learn more about importing existing cloud resources, see Importing resources.
Package Details
- Repository
- Azure Classic pulumi/pulumi-azure
- License
- Apache-2.0
- Notes
- This Pulumi package is based on the
azurermTerraform Provider.