You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: azure-sql/database/always-encrypted-enclaves-enable-sgx.md
+1-1Lines changed: 1 addition & 1 deletion
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,6 +1,6 @@
1
1
---
2
2
title: "Enable Intel SGX for Always Encrypted"
3
-
description: "Learn how to enable Intel SGX for Always Encrypted with secure enclaves in Azure SQL Database by selecting an SGX-enabled hardware generation."
3
+
description: "Learn how to enable Intel SGX for Always Encrypted with secure enclaves in Azure SQL Database by selecting an SGX-enabled hardware."
Copy file name to clipboardExpand all lines: azure-sql/database/always-encrypted-enclaves-getting-started.md
+4-4Lines changed: 4 additions & 4 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.topic: tutorial
9
9
author: jaszymas
10
10
ms.author: jaszymas
11
11
ms.reviwer: vanto
12
-
ms.date: 07/14/2021
12
+
ms.date: 04/06/2022
13
13
---
14
14
# Tutorial: Getting started with Always Encrypted with secure enclaves in Azure SQL Database
15
15
@@ -53,7 +53,7 @@ To continue to interact with the PowerShell Gallery, run the following command b
53
53
54
54
## Step 1: Create and configure a server and a DC-series database
55
55
56
-
In this step, you will create a new Azure SQL Database logical server and a new database using the DC-series hardware generation, required for Always Encrypted with secure enclaves. For more information see [DC-series](service-tiers-sql-database-vcore.md#dc-series).
56
+
In this step, you will create a new Azure SQL Database logical server and a new database using the DC-series hardware, required for Always Encrypted with secure enclaves. For more information see [DC-series](service-tiers-sql-database-vcore.md#dc-series).
57
57
58
58
# [Portal](#tab/azure-portal)
59
59
@@ -72,7 +72,7 @@ In this step, you will create a new Azure SQL Database logical server and a new
72
72
-**Password**: Enter a password that meets requirements, and enter it again in the **Confirm password** field.
73
73
-**Location**: Select a location from the dropdown list.
74
74
> [!IMPORTANT]
75
-
> You need to select a location (an Azure region) that supports both the DC-series hardware generation and Microsoft Azure Attestation. For the list of regions supporting DC-series, see [DC-series availability](service-tiers-sql-database-vcore.md#dc-series). [Here](https://azure.microsoft.com/global-infrastructure/services/?products=azure-attestation) is the regional availability of Microsoft Azure Attestation.
75
+
> You need to select a location (an Azure region) that supports both the DC-series hardware and Microsoft Azure Attestation. For the list of regions supporting DC-series, see [DC-series availability](service-tiers-sql-database-vcore.md#dc-series). [Here](https://azure.microsoft.com/global-infrastructure/services/?products=azure-attestation) is the regional availability of Microsoft Azure Attestation.
76
76
77
77
Select **OK**.
78
78
1. Leave **Want to use SQL elastic pool** set to **No**.
@@ -117,7 +117,7 @@ In this step, you will create a new Azure SQL Database logical server and a new
117
117
1. Create a new resource group.
118
118
119
119
> [!IMPORTANT]
120
-
> You need to create your resource group in a region (location) that supports both the DC-series hardware generation and Microsoft Azure Attestation. For the list of regions supporting DC-series, see [DC-series availability](service-tiers-sql-database-vcore.md#dc-series). [Here](https://azure.microsoft.com/global-infrastructure/services/?products=azure-attestation) is the regional availability of Microsoft Azure Attestation.
120
+
> You need to create your resource group in a region (location) that supports both the DC-series hardware and Microsoft Azure Attestation. For the list of regions supporting DC-series, see [DC-series availability](service-tiers-sql-database-vcore.md#dc-series). [Here](https://azure.microsoft.com/global-infrastructure/services/?products=azure-attestation) is the regional availability of Microsoft Azure Attestation.
121
121
122
122
```powershell
123
123
$resourceGroupName = "<your new resource group name>"
Copy file name to clipboardExpand all lines: azure-sql/database/always-encrypted-enclaves-plan.md
+6-6Lines changed: 6 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -9,7 +9,7 @@ ms.topic: conceptual
9
9
author: jaszymas
10
10
ms.author: jaszymas
11
11
ms.reviwer: vanto
12
-
ms.date: 07/14/2021
12
+
ms.date: 04/06/2022
13
13
---
14
14
15
15
# Plan for Intel SGX enclaves and attestation in Azure SQL Database
@@ -20,17 +20,17 @@ ms.date: 07/14/2021
20
20
21
21
## Plan for Intel SGX in Azure SQL Database
22
22
23
-
Intel SGX is a hardware-based trusted execution environment technology. Intel SGX is available for databases that use the [vCore model](service-tiers-sql-database-vcore.md) and the [DC-series](service-tiers-sql-database-vcore.md?#dc-series) hardware generation. Therefore, to ensure you can use Always Encrypted with secure enclaves in your database, you need to either select the DC-series hardware generation when you create the database, or you can update your existing database to use the DC-series hardware generation.
23
+
Intel SGX is a hardware-based trusted execution environment technology. Intel SGX is available for databases that use the [vCore model](service-tiers-sql-database-vcore.md) and the [DC-series](service-tiers-sql-database-vcore.md?#dc-series) hardware. Therefore, to ensure you can use Always Encrypted with secure enclaves in your database, you need to either select the DC-series hardware when you create the database, or you can update your existing database to use the DC-series hardware.
24
24
25
25
> [!NOTE]
26
-
> Intel SGX is not available in hardware generations other than DC-series. For example, Intel SGX is not available for Gen5 hardware, and it is not available for databases using the [DTU model](service-tiers-dtu.md).
26
+
> Intel SGX is not available in hardware other than DC-series. For example, Intel SGX is not available for Gen5 hardware, and it is not available for databases using the [DTU model](service-tiers-dtu.md).
27
27
28
28
> [!IMPORTANT]
29
-
> Before you configure the DC-series hardware generation for your database, check the regional availability of DC-series and make sure you understand its performance limitations. For details, see [DC-series](service-tiers-sql-database-vcore.md#dc-series).
29
+
> Before you configure the DC-series hardware for your database, check the regional availability of DC-series and make sure you understand its performance limitations. For details, see [DC-series](service-tiers-sql-database-vcore.md#dc-series).
30
30
31
31
## Plan for attestation in Azure SQL Database
32
32
33
-
[Microsoft Azure Attestation](../../attestation/overview.md) is a solution for attesting Trusted Execution Environments (TEEs), including Intel SGX enclaves in Azure SQL databases using the DC-series hardware generation.
33
+
[Microsoft Azure Attestation](../../attestation/overview.md) is a solution for attesting Trusted Execution Environments (TEEs), including Intel SGX enclaves in Azure SQL databases using the DC-series hardware.
34
34
35
35
To use Azure Attestation for attesting Intel SGX enclaves in Azure SQL Database, you need to create an [attestation provider](../../attestation/basic-concepts.md#attestation-provider) and configure it with the Microsoft-provided attestation policy. See [Configure attestation for Always Encrypted using Azure Attestation](always-encrypted-enclaves-configure-attestation.md)
36
36
@@ -39,7 +39,7 @@ To use Azure Attestation for attesting Intel SGX enclaves in Azure SQL Database,
39
39
Configuring your environment to support Intel SGX enclaves and attestation for Always Encrypted in Azure SQL Database involves setting up components of different types: Microsoft Azure Attestation, Azure SQL Database, and applications that trigger enclave attestation. Configuring components of each type is performed by users assuming one of the below distinct roles:
40
40
41
41
- Attestation administrator - creates an attestation provider in Microsoft Azure Attestation, authors the attestation policy, grants Azure SQL logical server access to the attestation provider, and shares the attestation URL that points to the policy to application administrators.
42
-
- Azure SQL Database administrator - enables SGX enclaves in databases by selecting the DC-series hardware generation, and provides the attestation administrator with the identity of the Azure SQL logical server that needs to access the attestation provider.
42
+
- Azure SQL Database administrator - enables SGX enclaves in databases by selecting the DC-series hardware, and provides the attestation administrator with the identity of the Azure SQL logical server that needs to access the attestation provider.
43
43
- Application administrator - configures applications with the attestation URL obtained from the attestation administrator.
44
44
45
45
In production environments (handling real sensitive data), it is important your organization adheres to role separation when configuring attestation, where each distinct role is assumed by different people. In particular, if the goal of deploying Always Encrypted in your organization is to reduce the attack surface area by ensuring Azure SQL Database administrators cannot access sensitive data, Azure SQL Database administrators should not control attestation policies.
> We recommend that customers avoid setting MAXDOP to 0 even if it does not appear to cause problems currently.
73
73
74
-
Excessive parallelism becomes most problematic when there are more concurrent requests than can be supported by the CPU and worker thread resources provided by the service objective. Avoid MAXDOP 0 to reduce the risk of potential future problems due to excessive parallelism if a database is scaled up, or if future hardware generations in Azure SQL Database provide more cores for the same database service objective.
74
+
Excessive parallelism becomes most problematic when there are more concurrent requests than can be supported by the CPU and worker thread resources provided by the service objective. Avoid MAXDOP 0 to reduce the risk of potential future problems due to excessive parallelism if a database is scaled up, or if future hardware configurations in Azure SQL Database provide more cores for the same database service objective.
Microsoft periodically refreshes hardware to optimize the customer experience. During these refreshes, Azure adds gateways built on newer hardware generations, migrates traffic to them, and eventually decommissions gateways built on older hardware in some regions.
17
+
Microsoft periodically refreshes hardware to optimize the customer experience. During these refreshes, Azure adds gateways built on newer hardware, migrates traffic to them, and eventually decommissions gateways built on older hardware in some regions.
18
18
19
19
20
20
To avoid service disruptions during refreshes, allow the communication with SQL Gateway IP subnet ranges for the region. Review [SQL Gateway IP subnet ranges](connectivity-architecture.md#gateway-ip-addresses) and include the ranges for your region.
Copy file name to clipboardExpand all lines: azure-sql/database/quota-increase-request.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -105,11 +105,11 @@ If your subscription needs access in a particular region, select the **Region ac
105
105
106
106
### Request enabling specific hardware in a region
107
107
108
-
If a hardware generation you want to use is not available in your region, you may request it using the following steps. For more information on hardware generations and regional availability, see [Hardware generations for SQL Database](./service-tiers-sql-database-vcore.md#hardware-configuration) or [Hardware generations for SQL Managed Instance](../managed-instance/service-tiers-managed-instance-vcore.md#hardware-configurations).
108
+
If the hardware you want to use is not available in your region, you may request it using the following steps. For more information on hardware regional availability, see [Hardware configurations for SQL Database](./service-tiers-sql-database-vcore.md#hardware-configuration) or [Hardware configurations for SQL Managed Instance](../managed-instance/service-tiers-managed-instance-vcore.md#hardware-configurations).
109
109
110
110
1. Select the **Other quota request** quota type.
111
111
112
-
1. In the **Description** field, state your request, including the name of the hardware generation and the name of the region you need it in.
112
+
1. In the **Description** field, state your request, including the name of the hardware and the name of the region you need it in.
113
113
114
114

@@ -34,7 +34,7 @@ For more information about how enterprise customers and Pay-As-You-Go customers
34
34
35
35
## Determine correct size before purchase
36
36
37
-
The size of reservation should be based on the total amount of compute used by the existing or soon-to-be-deployed database or managed instance within a specific region and using the same performance tier and hardware generation.
37
+
The size of reservation should be based on the total amount of compute used by the existing or soon-to-be-deployed database or managed instance within a specific region and using the same performance tier and hardware configuration.
38
38
39
39
For example, let's suppose that you are running one general purpose, Gen5 – 16 vCore elastic pool and two business critical Gen5 – 4 vCore single databases. Further, let's supposed that you plan to deploy within the next month an additional general purpose Gen5 – 16 vCore elastic pool and one business critical Gen5 – 32 vCore elastic pool. Also, let's suppose that you know that you will need these resources for at least 1 year. In this case, you should purchase a 32 (2x16) vCores 1-year reservation for single database/elastic pool general purpose - Gen5 and a 40 (2x4 + 32) vCore 1-year reservation for single database/elastic pool business critical - Gen5.
@@ -197,7 +197,7 @@ If using [customer managed transparent data encryption](transparent-data-encrypt
197
197
198
198
Creating a new database or moving an existing database into a serverless compute tier follows the same pattern as creating a new database in provisioned compute tier and involves the following two steps.
199
199
200
-
1. Specify the service objective. The service objective prescribes the service tier, hardware generation, and max vCores. For service objective options, see [serverless resource limits](resource-limits-vcore-single-databases.md#general-purpose---serverless-compute---gen5)
200
+
1. Specify the service objective. The service objective prescribes the service tier, hardware configuration, and max vCores. For service objective options, see [serverless resource limits](resource-limits-vcore-single-databases.md#general-purpose---serverless-compute---gen5)
201
201
202
202
203
203
2. Optionally, specify the min vCores and auto-pause delay to change their default values. The following table shows the available values for these parameters.
Copy file name to clipboardExpand all lines: azure-sql/database/service-tiers-sql-database-vcore.md
+2-2Lines changed: 2 additions & 2 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -30,7 +30,7 @@ This article reviews the [vCore purchasing model](service-tiers-vcore.md) for [A
30
30
The vCore purchasing model used by Azure SQL Database provides several benefits over the DTU purchasing model:
31
31
32
32
- Higher compute, memory, I/O, and storage limits.
33
-
-Control over the hardware generation to better match compute and memory requirements of the workload.
33
+
-A degree of control over hardware to better match compute and memory requirements of the workload.
34
34
- Pricing discounts for [Azure Hybrid Benefit (AHB)](../azure-hybrid-benefit.md).
35
35
- Greater transparency in the hardware details that power the compute, that facilitates planning for migrations from on-premises deployments.
36
36
-[Reserved instance pricing](reserved-capacity-overview.md) is only available for vCore purchasing model.
@@ -125,7 +125,7 @@ To create databases or elastic pools on DC-series hardware, the subscription mus
125
125
126
126
You can select hardware configuration for a database or elastic pool in SQL Database at the time of creation. You can also change hardware configuration of an existing database or elastic pool.
127
127
128
-
**To select a hardware generation when creating a SQL Database or pool**
128
+
**To select a hardware configuration when creating a SQL Database or pool**
129
129
130
130
For detailed information, see [Create a SQL Database](single-database-create-quickstart.md).
0 commit comments