Managed Instance Encryption Protectors - Create Or Update

Reference

Service:: SQL Database

API Version:: 2021-11-01

Updates an existing encryption protector.

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/managedInstances/{managedInstanceName}/encryptionProtector/current?api-version=2021-11-01

URI Parameters

Name	In	Required	Type	Description
encryptionProtectorName	path	True	EncryptionProtectorName	The name of the encryption protector to be updated.
managedInstanceName	path	True	string	The name of the managed instance.
resourceGroupName	path	True	string	The name of the resource group that contains the resource. You can obtain this value from the Azure Resource Manager API or the portal.
subscriptionId	path	True	string	The subscription ID that identifies an Azure subscription.
api-version	query	True	string	The API version to use for the request.

Request Body

Name	Required	Type	Description
properties.serverKeyType	True	ServerKeyType	The encryption protector type like 'ServiceManaged', 'AzureKeyVault'.
properties.autoRotationEnabled		boolean	Key auto rotation opt-in flag. Either true or false.
properties.serverKeyName		string	The name of the managed instance key.

Responses

Name	Type	Description
200 OK	ManagedInstanceEncryptionProtector	Successfully updated the encryption protector.
202 Accepted		Accepted
Other Status Codes		* Error Responses: * 400 InvalidKeyName - An invalid value was given for the server key name. 400 InvalidKeyType - The create server key type is not supported. 400 InvalidUpsertKeyType - Service-managed TDE keys are managed by the service. Service-managed TDE keys don't support Create or Update by the user. 400 InvalidKeyUpsertRequest - The create server key request does not exist or has no properties object. 400 InvalidEncryptionProtectorName - The encryption protector key name is not supported. 400 SecurityAdalPrincipalCertExpiredError - The operation could not be completed because the Azure Key Vault principal certificate has expired. 400 AkvHostNotResolvingFromNode - AKV host '{0}' is not resolvable from SQL, on server '{1}'. 400 SecurityInvalidAzureKeyVaultRecoveryLevel - The provided Key Vault uri is not valid. 400 KeyMaterialNotFoundOnRemoteServer - Remote server does not have access to key material used as a TDE protector. 400 AzureKeyVaultRsaKeyNotSupported - The provided key vault uses unsupported RSA Key Size or Key Type. The supported RSA key size is 2048 or 3072 and Key Type is RSA or RSA-HSM. 400 AzureKeyVaultKeyDisabled - The operation could not be completed on the server because the Azure Key Vault key is disabled. 400 AzureKeyVaultInvalidExpirationDate - The operation could not be completed because the Azure Key Vault key expiration date is invalid. 400 SameKeyUriNotFoundOnRemoteServer - Secondary server does not have the key material from the same key vault as the primary server's encryption protector with key auto-rotation enabled. 400 SecurityAzureKeyVaultUrlNullOrEmpty - The operation could not be completed because the Azure Key Vault Uri is null or empty. 400 SameKeyMaterialNotFoundOnRemoteServer - Secondary server does not have the key material of the primary server's encryption protector. 400 PerDatabaseCMKRestoreNotSupported - Database restore is not supported when Database-level CMK is configured in preview. 400 AzureKeyVaultNoServerIdentity - The server identity is not correctly configured. 400 PerDatabaseCMKHSNotSupported - Database-level CMK in preview is not supported for Hyperscale edition. 400 AzureKeyVaultInvalidUri - An invalid response from Azure Key Vault. Please use a valid Azure Key Vault URI. 400 AzureKeyVaultMissingPermissions - The server is missing required permissions on the Azure Key Vault. 400 UmiMissingAkvPermissions - PrimaryUserAssignedIdentityId provided by user does not have access to KeyId provided 400 AkvEndpointNotReachableFromNode - AKV endpoint '{0}' is not reachable from SQL, on server '{1}'. 400 SecurityAzureKeyVaultInvalidKeyName - The operation could not be completed because of an invalid Server Key name. 400 AdalGenericError - The operation could not be completed because an Azure Active Directory error was encountered. 400 AdalServicePrincipalNotFound - The operation could not be completed because an Azure Active Directory library Service Principal not found error was encountered. 400 AzureKeyVaultMalformedVaultUri - The provided Key Vault uri is not valid. 400 SecurityAzureKeyVaultGeoChainError - Creating secondary of secondary (a process known as chaining) is not supported when enabling Transparent Data Encryption using Azure Key Vault (BYOK). 400 PerDatabaseCMKDWNotSupported - Database-level CMK in preview is not supported for Datawarehouse edition. 404 SubscriptionDoesNotHaveServer - The requested server was not found 404 ServerNotInSubscriptionResourceGroup - Specified server does not exist in the specified resource group and subscription. 404 ResourceNotFound - The requested resource was not found. 404 ServerKeyNotFound - The requested server key was not found on the current subscription. 404 OperationIdNotFound - The operation with Id does not exist. 409 EncryptionProtectorChangeInProgress - Cannot update database encryption key protector while protector change is already in progress 409 ServerKeyNameAlreadyExists - The server key already exists on the server. 409 ServerKeyUriAlreadyExists - The server key URI already exists on the server. 409 ServerKeyDoesNotExists - The server key does not exist. 409 AzureKeyVaultKeyNameNotFound - The operation could not be completed because the Azure Key Vault Key name does not exist. 409 AzureKeyVaultKeyInUse - The key is currently being used by the server. 409 OperationCancelled - The operation has been cancelled by user. 409 OperationInterrupted - The operation on the resource could not be completed because it was interrupted by another operation on the same resource. 429 SubscriptionTooManyCreateUpdateRequests - Requests beyond max requests that can be processed by available resources. 429 SubscriptionTooManyRequests - Requests beyond max requests that can be processed by available resources. 500 OperationTimedOut - The operation timed out and automatically rolled back. Please retry the operation. 503 AzureKeyVaultConnectionFailed - The operation could not be completed on the server because attempts to connect to Azure Key Vault have failed 503 AzureKeyVaultGenericConnectionError - The operation could not be completed because an error was encountered when attempting to retrieve Key Vault information . 503 TooManyRequests - Requests beyond max requests that can be processed by available resources.

Name

Type

Description

200 OK

ManagedInstanceEncryptionProtector

Successfully updated the encryption protector.

202 Accepted

Accepted

Other Status Codes

*** Error Responses: ***

400 InvalidKeyName - An invalid value was given for the server key name.
400 InvalidKeyType - The create server key type is not supported.
400 InvalidUpsertKeyType - Service-managed TDE keys are managed by the service. Service-managed TDE keys don't support Create or Update by the user.
400 InvalidKeyUpsertRequest - The create server key request does not exist or has no properties object.
400 InvalidEncryptionProtectorName - The encryption protector key name is not supported.
400 SecurityAdalPrincipalCertExpiredError - The operation could not be completed because the Azure Key Vault principal certificate has expired.
400 AkvHostNotResolvingFromNode - AKV host '{0}' is not resolvable from SQL, on server '{1}'.
400 SecurityInvalidAzureKeyVaultRecoveryLevel - The provided Key Vault uri is not valid.
400 KeyMaterialNotFoundOnRemoteServer - Remote server does not have access to key material used as a TDE protector.
400 AzureKeyVaultRsaKeyNotSupported - The provided key vault uses unsupported RSA Key Size or Key Type. The supported RSA key size is 2048 or 3072 and Key Type is RSA or RSA-HSM.
400 AzureKeyVaultKeyDisabled - The operation could not be completed on the server because the Azure Key Vault key is disabled.
400 AzureKeyVaultInvalidExpirationDate - The operation could not be completed because the Azure Key Vault key expiration date is invalid.
400 SameKeyUriNotFoundOnRemoteServer - Secondary server does not have the key material from the same key vault as the primary server's encryption protector with key auto-rotation enabled.
400 SecurityAzureKeyVaultUrlNullOrEmpty - The operation could not be completed because the Azure Key Vault Uri is null or empty.
400 SameKeyMaterialNotFoundOnRemoteServer - Secondary server does not have the key material of the primary server's encryption protector.
400 PerDatabaseCMKRestoreNotSupported - Database restore is not supported when Database-level CMK is configured in preview.
400 AzureKeyVaultNoServerIdentity - The server identity is not correctly configured.
400 PerDatabaseCMKHSNotSupported - Database-level CMK in preview is not supported for Hyperscale edition.
400 AzureKeyVaultInvalidUri - An invalid response from Azure Key Vault. Please use a valid Azure Key Vault URI.
400 AzureKeyVaultMissingPermissions - The server is missing required permissions on the Azure Key Vault.
400 UmiMissingAkvPermissions - PrimaryUserAssignedIdentityId provided by user does not have access to KeyId provided
400 AkvEndpointNotReachableFromNode - AKV endpoint '{0}' is not reachable from SQL, on server '{1}'.
400 SecurityAzureKeyVaultInvalidKeyName - The operation could not be completed because of an invalid Server Key name.
400 AdalGenericError - The operation could not be completed because an Azure Active Directory error was encountered.
400 AdalServicePrincipalNotFound - The operation could not be completed because an Azure Active Directory library Service Principal not found error was encountered.
400 AzureKeyVaultMalformedVaultUri - The provided Key Vault uri is not valid.
400 SecurityAzureKeyVaultGeoChainError - Creating secondary of secondary (a process known as chaining) is not supported when enabling Transparent Data Encryption using Azure Key Vault (BYOK).
400 PerDatabaseCMKDWNotSupported - Database-level CMK in preview is not supported for Datawarehouse edition.
404 SubscriptionDoesNotHaveServer - The requested server was not found
404 ServerNotInSubscriptionResourceGroup - Specified server does not exist in the specified resource group and subscription.
404 ResourceNotFound - The requested resource was not found.
404 ServerKeyNotFound - The requested server key was not found on the current subscription.
404 OperationIdNotFound - The operation with Id does not exist.
409 EncryptionProtectorChangeInProgress - Cannot update database encryption key protector while protector change is already in progress
409 ServerKeyNameAlreadyExists - The server key already exists on the server.
409 ServerKeyUriAlreadyExists - The server key URI already exists on the server.
409 ServerKeyDoesNotExists - The server key does not exist.
409 AzureKeyVaultKeyNameNotFound - The operation could not be completed because the Azure Key Vault Key name does not exist.
409 AzureKeyVaultKeyInUse - The key is currently being used by the server.
409 OperationCancelled - The operation has been cancelled by user.
409 OperationInterrupted - The operation on the resource could not be completed because it was interrupted by another operation on the same resource.
429 SubscriptionTooManyCreateUpdateRequests - Requests beyond max requests that can be processed by available resources.
429 SubscriptionTooManyRequests - Requests beyond max requests that can be processed by available resources.
500 OperationTimedOut - The operation timed out and automatically rolled back. Please retry the operation.
503 AzureKeyVaultConnectionFailed - The operation could not be completed on the server because attempts to connect to Azure Key Vault have failed
503 AzureKeyVaultGenericConnectionError - The operation could not be completed because an error was encountered when attempting to retrieve Key Vault information .
503 TooManyRequests - Requests beyond max requests that can be processed by available resources.

Examples

Update the encryption protector to key vault

Update the encryption protector to service managed

Update the encryption protector to key vault

PUT https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/sqlcrudtest-7398/providers/Microsoft.Sql/managedInstances/sqlcrudtest-4645/encryptionProtector/current?api-version=2021-11-01

{
  "properties": {
    "serverKeyType": "AzureKeyVault",
    "serverKeyName": "someVault_someKey_01234567890123456789012345678901",
    "autoRotationEnabled": false
  }
}


import com.azure.resourcemanager.sql.fluent.models.ManagedInstanceEncryptionProtectorInner;
import com.azure.resourcemanager.sql.models.EncryptionProtectorName;
import com.azure.resourcemanager.sql.models.ServerKeyType;

/**
 * Samples for ManagedInstanceEncryptionProtectors CreateOrUpdate.
 */
public final class Main {
    /*
     * x-ms-original-file: specification/sql/resource-manager/Microsoft.Sql/stable/2021-11-01/examples/
     * ManagedInstanceEncryptionProtectorCreateOrUpdateKeyVault.json
     */
    /**
     * Sample code: Update the encryption protector to key vault.
     * 
     * @param azure The entry point for accessing resource management APIs in Azure.
     */
    public static void updateTheEncryptionProtectorToKeyVault(com.azure.resourcemanager.AzureResourceManager azure) {
        azure.sqlServers().manager().serviceClient().getManagedInstanceEncryptionProtectors().createOrUpdate(
            "sqlcrudtest-7398", "sqlcrudtest-4645", EncryptionProtectorName.CURRENT,
            new ManagedInstanceEncryptionProtectorInner().withServerKeyName("fakeTokenPlaceholder")
                .withServerKeyType(ServerKeyType.AZURE_KEY_VAULT).withAutoRotationEnabled(false),
            com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:: 200

{
  "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/sqlcrudtest-7398/providers/Microsoft.Sql/managedInstances/sqlcrudtest-4645/encryptionProtector/current",
  "name": "current",
  "type": "Microsoft.Sql/managedInstances/encryptionProtector",
  "kind": "azurekeyvault",
  "properties": {
    "serverKeyName": "someVault_someKey_01234567890123456789012345678901",
    "serverKeyType": "AzureKeyVault",
    "autoRotationEnabled": false
  }
}

Status code:: 202

Update the encryption protector to service managed

Sample request

HTTP
Java

PUT https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/sqlcrudtest-7398/providers/Microsoft.Sql/managedInstances/sqlcrudtest-4645/encryptionProtector/current?api-version=2021-11-01

{
  "properties": {
    "serverKeyType": "ServiceManaged",
    "serverKeyName": "ServiceManaged"
  }
}


import com.azure.resourcemanager.sql.fluent.models.ManagedInstanceEncryptionProtectorInner;
import com.azure.resourcemanager.sql.models.EncryptionProtectorName;
import com.azure.resourcemanager.sql.models.ServerKeyType;

/**
 * Samples for ManagedInstanceEncryptionProtectors CreateOrUpdate.
 */
public final class Main {
    /*
     * x-ms-original-file: specification/sql/resource-manager/Microsoft.Sql/stable/2021-11-01/examples/
     * ManagedInstanceEncryptionProtectorCreateOrUpdateServiceManaged.json
     */
    /**
     * Sample code: Update the encryption protector to service managed.
     * 
     * @param azure The entry point for accessing resource management APIs in Azure.
     */
    public static void
        updateTheEncryptionProtectorToServiceManaged(com.azure.resourcemanager.AzureResourceManager azure) {
        azure.sqlServers().manager().serviceClient().getManagedInstanceEncryptionProtectors().createOrUpdate(
            "sqlcrudtest-7398", "sqlcrudtest-4645", EncryptionProtectorName.CURRENT,
            new ManagedInstanceEncryptionProtectorInner().withServerKeyName("fakeTokenPlaceholder")
                .withServerKeyType(ServerKeyType.SERVICE_MANAGED),
            com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

Sample response

Status code:: 200

{
  "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/sqlcrudtest-7398/providers/Microsoft.Sql/managedInstances/sqlcrudtest-4645/encryptionProtector/current",
  "name": "current",
  "type": "Microsoft.Sql/managedInstances/encryptionProtector",
  "kind": "servicemanaged",
  "properties": {
    "serverKeyName": "ServiceManaged",
    "serverKeyType": "ServiceManaged"
  }
}

Status code:: 202

Definitions

Name	Description
EncryptionProtectorName	The name of the encryption protector to be updated.
ManagedInstanceEncryptionProtector	The managed instance encryption protector.
ServerKeyType	The encryption protector type like 'ServiceManaged', 'AzureKeyVault'.

EncryptionProtectorName

The name of the encryption protector to be updated.

Name	Type	Description
current	string

ManagedInstanceEncryptionProtector

The managed instance encryption protector.

Name	Type	Description
id	string	Resource ID.
kind	string	Kind of encryption protector. This is metadata used for the Azure portal experience.
name	string	Resource name.
properties.autoRotationEnabled	boolean	Key auto rotation opt-in flag. Either true or false.
properties.serverKeyName	string	The name of the managed instance key.
properties.serverKeyType	ServerKeyType	The encryption protector type like 'ServiceManaged', 'AzureKeyVault'.
properties.thumbprint	string	Thumbprint of the server key.
properties.uri	string	The URI of the server key.
type	string	Resource type.

ServerKeyType

The encryption protector type like 'ServiceManaged', 'AzureKeyVault'.

Name	Type	Description
AzureKeyVault	string
ServiceManaged	string

Share via

Managed Instance Encryption Protectors - Create Or Update

URI Parameters

Request Body

Responses

Examples

Update the encryption protector to key vault

Sample request

Sample response

Update the encryption protector to service managed

Sample request

Sample response

Definitions

EncryptionProtectorName

ManagedInstanceEncryptionProtector

ServerKeyType

Additional resources