mirror of
https://github.com/awatertrevi/infisical.git
synced 2026-09-22 13:39:35 +00:00
140 lines
5.5 KiB
Plaintext
140 lines
5.5 KiB
Plaintext
---
|
|
title: "Microsoft SQL Server"
|
|
description: "Learn how to automatically rotate Microsoft SQL Server user passwords."
|
|
---
|
|
|
|
The Infisical SQL Server secret rotation allows you to automatically rotate your database users' passwords at a predefined interval.
|
|
|
|
## Prerequisites
|
|
|
|
1. Create two SQL Server logins and database users with the required permissions. We'll refer to them as `user-a` and `user-b`.
|
|
2. Create another SQL Server login with permissions to alter logins for `user-a` and `user-b`. We'll refer to this as the `admin` login.
|
|
|
|
Here's how to set up the prerequisites:
|
|
|
|
```sql
|
|
-- Create the logins (at server level)
|
|
CREATE LOGIN [user-a] WITH PASSWORD = 'ComplexPassword1';
|
|
CREATE LOGIN [user-b] WITH PASSWORD = 'ComplexPassword2';
|
|
|
|
-- Create database users for the logins (in your specific database)
|
|
USE [YourDatabase];
|
|
CREATE USER [user-a] FOR LOGIN [user-a];
|
|
CREATE USER [user-b] FOR LOGIN [user-b];
|
|
|
|
-- Grant necessary permissions to the users
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::dbo TO [user-a];
|
|
GRANT SELECT, INSERT, UPDATE, DELETE ON SCHEMA::dbo TO [user-b];
|
|
|
|
-- Create admin login with permission to alter other logins
|
|
CREATE LOGIN [admin] WITH PASSWORD = 'AdminComplexPassword';
|
|
CREATE USER [admin] FOR LOGIN [admin];
|
|
|
|
-- Grant permission to alter any login
|
|
GRANT ALTER ANY LOGIN TO [admin];
|
|
```
|
|
|
|
To learn more about SQL Server's permission system, please visit this [documentation](https://learn.microsoft.com/en-us/sql/relational-databases/security/authentication-access/getting-started-with-database-engine-permissions).
|
|
|
|
## How it works
|
|
|
|
1. Infisical connects to your database using the provided `admin` login credentials.
|
|
2. A random value is generated and the password for `user-a` is updated with the new value.
|
|
3. The new password is then tested by logging into the database.
|
|
4. If test is successful, it's saved to the output secret mappings so that rest of the system gets the newly rotated value(s).
|
|
5. The process is then repeated for `user-b` on the next rotation.
|
|
6. The cycle repeats until secret rotation is deleted/stopped.
|
|
|
|
## Rotation Configuration
|
|
|
|
<Steps>
|
|
<Step title="Open Secret Rotation Page">
|
|
Head over to Secret Rotation configuration page of your project by clicking on `Secret Rotation` in the left side bar
|
|
</Step>
|
|
<Step title="Click on Microsoft SQL Server card" />
|
|
<Step title="Provide the inputs">
|
|
<ParamField path="Admin Username" type="string" required>
|
|
SQL Server admin username
|
|
</ParamField>
|
|
|
|
<ParamField path="Admin password" type="string" required>
|
|
SQL Server admin password
|
|
</ParamField>
|
|
|
|
<ParamField path="Host" type="string" required>
|
|
SQL Server host url (e.g., your-server.database.windows.net)
|
|
</ParamField>
|
|
|
|
<ParamField path="Port" type="number" required>
|
|
Database port number (default: 1433)
|
|
</ParamField>
|
|
|
|
<ParamField path="Database" type="string" required>
|
|
Database name (default: master)
|
|
</ParamField>
|
|
|
|
<ParamField path="Username1" type="string" required>
|
|
The first login name to rotate - `user-a`
|
|
</ParamField>
|
|
|
|
<ParamField path="Username2" type="string" required>
|
|
The second login name to rotate - `user-b`
|
|
</ParamField>
|
|
|
|
<ParamField path="CA" type="string">
|
|
Optional database certificate to connect with database
|
|
</ParamField>
|
|
|
|
</Step>
|
|
<Step title="Configure the output secret mapping">
|
|
When a secret rotation is successful, the updated values needs to be saved to an existing key(s) in your project.
|
|
|
|
<ParamField path="Environment" type="string" required>
|
|
The environment where the rotated credentials should be mapped to.
|
|
</ParamField>
|
|
|
|
<ParamField path="Secret Path" type="string" required>
|
|
The secret path where the rotated credentials should be mapped to.
|
|
</ParamField>
|
|
|
|
<ParamField path="Interval" type="number" required>
|
|
What interval should the credentials be rotated in days.
|
|
</ParamField>
|
|
|
|
<ParamField path="DB USERNAME" type="string" required>
|
|
Select an existing secret key where the rotated database username value should be saved to.
|
|
</ParamField>
|
|
|
|
<ParamField path="DB PASSWORD" type="string" required>
|
|
Select an existing select key where the rotated database password value should be saved to.
|
|
</ParamField>
|
|
|
|
</Step>
|
|
</Steps>
|
|
|
|
## FAQ
|
|
|
|
<AccordionGroup>
|
|
<Accordion title="Why can't we delete the other user when rotating?">
|
|
When a system has multiple nodes by horizontal scaling, redeployment doesn't happen instantly.
|
|
|
|
This means that when the secrets are rotated, and the redeployment is triggered, the existing system will still be using the old credentials until the change rolls out.
|
|
|
|
To avoid causing failure for them, the old credentials are not removed. Instead, in the next rotation, the previous user's credentials are updated.
|
|
|
|
</Accordion>
|
|
<Accordion title="Why do you need an admin account?">
|
|
The admin account is used by Infisical to update the credentials for `user-a` and `user-b`.
|
|
|
|
You don't need to grant all permissions for your admin account but rather just the permission to alter logins (ALTER ANY LOGIN).
|
|
|
|
</Accordion>
|
|
<Accordion title="How does this work with Azure SQL Database?">
|
|
When using Azure SQL Database, you'll need to:
|
|
|
|
1. Use the full server name as your host (e.g., your-server.database.windows.net)
|
|
2. Ensure your admin account is either the Azure SQL Server admin or an Azure AD account with appropriate permissions
|
|
3. Configure your Azure SQL Server firewall rules to allow connections from Infisical's IP addresses
|
|
</Accordion>
|
|
</AccordionGroup>
|