2

I am setting up roles as a layer of protection inside of MSSQL. One of the roles will only have the ability to change database encryption keys for TDE on the database server. The server will be using EKM to supply the keys.

I have not been able to find the exact process to exchange the keys with EKM. Since I can't find the process, I can't give the roles the permissions it needs.

Right now, I have granted CONTROL permissions on certificates and asymmetric keys at the database level. I am assuming that this will be necessary.

Does anyone know if there are any server level permissions required to change the database encryption key? I believe that the user will at least need to have access to which keys are located in EKM.

Improve this question

1 Answer 1

Reset to default
1

ALTER DATABASE ENCRYPTION KEY

Requires CONTROL permission on the database and VIEW DEFINITION permission on the certificate or asymmetric key that is used to encrypt the database encryption key.

You must also add view definition according to MSDN.

https://msdn.microsoft.com/en-us/library/bb630389%28v=sql.110%29.aspx

Improve this answer
4
  • This is helpful, but it is pulled straight out of the official docs. I was asking specifically about server level permissions, and both of these permissions are at the database level.
    – Leland B
    Commented Aug 13, 2015 at 14:20
  • GRANT CONTROL SERVER TO [ABC] this is a server level permission which give a lot of power.
    – Julien Vavasseur
    Commented Aug 13, 2015 at 14:38
  • I am trying to give the minimum level of permission necessary to complete the changing of keys.
    – Leland B
    Commented Aug 13, 2015 at 14:40
  • I know. but DENY > GRANT. therefore you can add a bunch of DENY such as DENY VIEW ANY DATABASE TO, DENY VIEW ANY DEFINITION, ALTER ROLE [db_denydatawriter] ADD MEMBER
    – Julien Vavasseur
    Commented Aug 13, 2015 at 14:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.