Azure / Azure/azure-mysql

Cannot create Keyvault key and enable customer-key encryption for MySQL at the same time

Open
#56 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
PHP
Stars
53
Forks
88
PR merge metrics
No merged PRs in 30d

Description

I found if we need to enable the customer key encryption for the MySQL database, the "serverKeyName" must be in this format: "**KeyvaultName_keyName_keyVersion**".
https://github.com/Azure/azure-mysql/blob/d8a26ec05a46079d06d1afaf22e38382e268e102/arm-templates/ExampleWithDataEncryption/template.json#L66-L68

which makes it impossible to create the keyvault key and enable the customer-key encryption at the same within one ARM template, cause we cannot use the ARM function "reference" to reference the key we created and extract the dynamically generated version number. The "reference" function cannot be used in variables definition, resource name and types.

https://github.com/Azure/azure-mysql/blob/d8a26ec05a46079d06d1afaf22e38382e268e102/arm-templates/ExampleWithDataEncryption/template.json#L135-L147

**Questions:
How to create the keyvault key and enable the customer-key encryption at the same time within one ARM template?**

Thanks.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with arm-templates/ExampleWithDataEncryption/template.json, especially lines 66-68 and 135-147, and verify the documented serverKeyName format against ARM reference-function constraints. Done means the repository explains or demonstrates a supported single-template path for creating the Key Vault key and enabling MySQL customer-key encryption, or clearly documents that it is unsupported.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, mysql
Domain
cloud, databases, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.