2021-11-17 13:46:07 +00:00
|
|
|
---
|
|
|
|
|
layout: docs
|
|
|
|
|
page_title: Vault EKM provider for SQL Server
|
|
|
|
|
description: >-
|
|
|
|
|
The Vault EKM module for Microsoft SQL Server allows Vault to act as a provider for TDE.
|
|
|
|
|
---
|
|
|
|
|
|
|
|
|
|
# Vault EKM provider for SQL Server
|
|
|
|
|
|
|
|
|
|
-> **Note**: This feature requires [Vault Enterprise](https://www.hashicorp.com/products/vault/)
|
|
|
|
|
with the Advanced Data Protection Key Management module.
|
|
|
|
|
|
|
|
|
|
Microsoft SQL Server supports [Transparent Data Encryption][tde] (TDE). The
|
|
|
|
|
Database Encryption Keys (DEK) can be protected by asymmetric Key Encryption
|
|
|
|
|
Keys (KEK) managed by Vault's [Transit][transit] secret engine using SQL Server's
|
|
|
|
|
[Extensible Key Management][tde] (EKM).
|
|
|
|
|
|
|
|
|
|
[tde]: https://docs.microsoft.com/en-us/sql/relational-databases/security/encryption/transparent-data-encryption?view=sql-server-ver15
|
|
|
|
|
[ekm]: https://docs.microsoft.com/sql/relational-databases/security/encryption/extensible-key-management-ekm?view=sql-server-ver15
|
2023-01-26 00:12:15 +00:00
|
|
|
[transit]: /vault/docs/secrets/transit
|
2021-11-17 13:46:07 +00:00
|
|
|
|
|
|
|
|
|
2023-01-26 00:12:15 +00:00
|
|
|
See [installation](/vault/docs/platform/mssql/installation) and [configuration](/vault/docs/platform/mssql/configuration)
|
2022-06-06 10:28:48 +00:00
|
|
|
for help getting started with the Vault EKM provider for SQL Server.
|
2021-11-17 13:46:07 +00:00
|
|
|
|
|
|
|
|
## Features
|
|
|
|
|
|
|
|
|
|
The following features are supported by the Vault EKM provider:
|
|
|
|
|
|
|
|
|
|
* Management of KEK with Transit secret engine using `rsa-2048` key cipher
|
|
|
|
|
* AppRole auth
|
