Installing the Vault EKM Provider
Prerequisites
- Vault Enterprise server 1.9+ with a license for the Advanced Data Protection Key Management module
- Microsoft SQL Server for Windows (SQL Server for Linux does not support EKM)
- An authenticated Vault client
To check your Vault version and license, you can run:
The list of features should include "Key Management Transparent Data Encryption".
Installing the Vault EKM provider
Configuring Vault
The EKM provider requires AppRole auth and the Transit secret engine to be setup on the Vault server. The steps below can be used to configure Vault ready for the EKM provider to use it.
Note: The first release of the Vault EKM provider does not support custom mount paths or namespaces for the AppRole and Transit engines.
Note: rsa-2048 is currently the only supported key type.
Set up AppRole auth:
Retrieve the AppRole ID and secret ID for use later when configuring SQL Server:
Enable the transit secret engine and create a key:
Create a policy for the Vault EKM provider to use. The following policy has the minimum required permissions:
Configuring SQL Server
The remaining steps are all run on the database server.
Install the EKM provider on the server
Download and run the latest Vault EKM provider installer from releases.hashicorp.com
Enter your Vault server's address when prompted and complete the installer
Configure the EKM provider using SQL
Open Microsoft SQL Server Management Studio, and run the queries below to complete installation.
Enable the EKM feature and create a cryptographic provider using the folder you just installed the EKM provider into.
Next, create credentials for an admin to use EKM with your AppRole role and secret ID from above:
You can now create an asymmetric key using the transit key set up earlier:
Create another login from the new asymmetric key:
Finally, you can enable TDE and protect the database encryption key with the asymmetric key managed by Vault's Transit secret engine:
Check the status of database encryption using the following queries: