search

microsoft / go-sqlcmd

The new sqlcmd, CLI for SQL Server and Azure SQL (winget install sqlcmd / sqlcmd create mssql / sqlcmd open ads)
https://learn.microsoft.com/sql/tools/sqlcmd/go-sqlcmd-utility
MIT License
396 stars 63 forks source link

Add support for Secure Enclaves #482

Open aaronhigh-loyal opened 11 months ago

aaronhigh-loyal commented 11 months ago

As the title says, Secure Enclaves with Azure Databases appears to be unsupported at this time. It would be a great benefit to support Secure Enclaves for sqlcmd queries for those of us using this feature.

Consider adding command line args for secure enclaves, attestation protocol, and attestation URL in order to support both hardware/SGX Secure Enclaves and VBS Secure Enclaves. Currently when performing an operation that triggers enclave computations, an error is returned (as expected):

The statement triggers enclave computations, but a column encryption key, needed for the computations, has not been found inside the enclave. Check that: (1) column encryption and enclave computations are enabled on connection, (2) driver is enclave-enabled. For additional reasons see: https://go.microsoft.com/fwlink/?linkid=2086681.
shueybubbles commented 11 months ago

thx for opening the issue. AE with enclaves is on my wish list but we currently don't have any time allocated for it. How do folks like yourself script/automate such queries today? Is there any potential benefit to supporting enclaves without attestation as an initial phase? Proper implementation of the attestation protocol will be by far the biggest chunk of work needed in the driver

aaronhigh-loyal commented 11 months ago

thx for opening the issue. AE with enclaves is on my wish list but we currently don't have any time allocated for it. How do folks like yourself script/automate such queries today? Is there any potential benefit to supporting enclaves without attestation as an initial phase? Proper implementation of the attestation protocol will be by far the biggest chunk of work needed in the driver

Hey @shueybubbles ,

We actually aren't automating enclave computation queries today. This came up recently as part of an automated process I'm attempting to implement (it's not necessarily a showstopper, just a "nice to have" for us, I'm automating mostly non-enclave-required scripting). We're in the process of researching a cutover from hardware/SGX enclaves to VBS so I'm hopeful that we can move away from the attestation as part of that process.