# coding=utf-8
# *** WARNING: this file was generated by the Pulumi Terraform Bridge (tfgen) Tool. ***
# *** Do not edit by hand unless you're certain you know what you are doing! ***

import warnings
import pulumi
import pulumi.runtime
from typing import Any, Mapping, Optional, Sequence, Union, overload
from .. import _utilities

__all__ = ['ServerTransparentDataEncryptionArgs', 'ServerTransparentDataEncryption']

@pulumi.input_type
class ServerTransparentDataEncryptionArgs:
    def __init__(__self__, *,
                 server_id: pulumi.Input[str],
                 key_vault_key_id: Optional[pulumi.Input[str]] = None):
        """
        The set of arguments for constructing a ServerTransparentDataEncryption resource.
        :param pulumi.Input[str] server_id: Specifies the name of the MS SQL Server.
        :param pulumi.Input[str] key_vault_key_id: To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
        """
        pulumi.set(__self__, "server_id", server_id)
        if key_vault_key_id is not None:
            pulumi.set(__self__, "key_vault_key_id", key_vault_key_id)

    @property
    @pulumi.getter(name="serverId")
    def server_id(self) -> pulumi.Input[str]:
        """
        Specifies the name of the MS SQL Server.
        """
        return pulumi.get(self, "server_id")

    @server_id.setter
    def server_id(self, value: pulumi.Input[str]):
        pulumi.set(self, "server_id", value)

    @property
    @pulumi.getter(name="keyVaultKeyId")
    def key_vault_key_id(self) -> Optional[pulumi.Input[str]]:
        """
        To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
        """
        return pulumi.get(self, "key_vault_key_id")

    @key_vault_key_id.setter
    def key_vault_key_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "key_vault_key_id", value)


@pulumi.input_type
class _ServerTransparentDataEncryptionState:
    def __init__(__self__, *,
                 key_vault_key_id: Optional[pulumi.Input[str]] = None,
                 server_id: Optional[pulumi.Input[str]] = None):
        """
        Input properties used for looking up and filtering ServerTransparentDataEncryption resources.
        :param pulumi.Input[str] key_vault_key_id: To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
        :param pulumi.Input[str] server_id: Specifies the name of the MS SQL Server.
        """
        if key_vault_key_id is not None:
            pulumi.set(__self__, "key_vault_key_id", key_vault_key_id)
        if server_id is not None:
            pulumi.set(__self__, "server_id", server_id)

    @property
    @pulumi.getter(name="keyVaultKeyId")
    def key_vault_key_id(self) -> Optional[pulumi.Input[str]]:
        """
        To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
        """
        return pulumi.get(self, "key_vault_key_id")

    @key_vault_key_id.setter
    def key_vault_key_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "key_vault_key_id", value)

    @property
    @pulumi.getter(name="serverId")
    def server_id(self) -> Optional[pulumi.Input[str]]:
        """
        Specifies the name of the MS SQL Server.
        """
        return pulumi.get(self, "server_id")

    @server_id.setter
    def server_id(self, value: Optional[pulumi.Input[str]]):
        pulumi.set(self, "server_id", value)


class ServerTransparentDataEncryption(pulumi.CustomResource):
    @overload
    def __init__(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 key_vault_key_id: Optional[pulumi.Input[str]] = None,
                 server_id: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        """
        Manages the transparent data encryption configuration for a MSSQL Server

        > **NOTE:** Once transparent data encryption is enabled on a MS SQL instance, it is not possible to remove TDE. You will be able to switch between 'ServiceManaged' and 'CustomerManaged' keys, but will not be able to remove encryption. For safety when this resource is deleted, the TDE mode will automatically be set to 'ServiceManaged'. See `key_vault_uri` for more information on how to specify the key types. As SQL Server only supports a single configuration for encryption settings, this resource will replace the current encryption settings on the server.

        > **Note:** See [documentation](https://docs.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok-overview) for important information on how handle lifecycle management of the keys to prevent data lockout.

        ## Example Usage
        ### With Service Managed Key

        ```python
        import pulumi
        import pulumi_azure as azure

        example_resource_group = azure.core.ResourceGroup("exampleResourceGroup", location="EastUs")
        example_server = azure.mssql.Server("exampleServer",
            resource_group_name=example_resource_group.name,
            location=example_resource_group.location,
            version="12.0",
            administrator_login="missadministrator",
            administrator_login_password="thisIsKat11",
            minimum_tls_version="1.2",
            azuread_administrator=azure.mssql.ServerAzureadAdministratorArgs(
                login_username="AzureAD Admin",
                object_id="00000000-0000-0000-0000-000000000000",
            ),
            extended_auditing_policy=azure.mssql.ServerExtendedAuditingPolicyArgs(
                storage_endpoint=azurerm_storage_account["example"]["primary_blob_endpoint"],
                storage_account_access_key=azurerm_storage_account["example"]["primary_access_key"],
                storage_account_access_key_is_secondary=True,
                retention_in_days=6,
            ),
            tags={
                "environment": "production",
            })
        example_server_transparent_data_encryption = azure.mssql.ServerTransparentDataEncryption("exampleServerTransparentDataEncryption", server_id=example_server.id)
        ```

        ## Import

        SQL Server Transparent Data Encryption can be imported using the resource id, e.g.

        ```sh
         $ pulumi import azure:mssql/serverTransparentDataEncryption:ServerTransparentDataEncryption example /subscriptions/12345678-1234-9876-4563-123456789012/resourceGroups/group1/providers/Microsoft.Sql/servers/server1/encryptionProtector/current
        ```

        :param str resource_name: The name of the resource.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[str] key_vault_key_id: To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
        :param pulumi.Input[str] server_id: Specifies the name of the MS SQL Server.
        """
        ...
    @overload
    def __init__(__self__,
                 resource_name: str,
                 args: ServerTransparentDataEncryptionArgs,
                 opts: Optional[pulumi.ResourceOptions] = None):
        """
        Manages the transparent data encryption configuration for a MSSQL Server

        > **NOTE:** Once transparent data encryption is enabled on a MS SQL instance, it is not possible to remove TDE. You will be able to switch between 'ServiceManaged' and 'CustomerManaged' keys, but will not be able to remove encryption. For safety when this resource is deleted, the TDE mode will automatically be set to 'ServiceManaged'. See `key_vault_uri` for more information on how to specify the key types. As SQL Server only supports a single configuration for encryption settings, this resource will replace the current encryption settings on the server.

        > **Note:** See [documentation](https://docs.microsoft.com/en-us/azure/azure-sql/database/transparent-data-encryption-byok-overview) for important information on how handle lifecycle management of the keys to prevent data lockout.

        ## Example Usage
        ### With Service Managed Key

        ```python
        import pulumi
        import pulumi_azure as azure

        example_resource_group = azure.core.ResourceGroup("exampleResourceGroup", location="EastUs")
        example_server = azure.mssql.Server("exampleServer",
            resource_group_name=example_resource_group.name,
            location=example_resource_group.location,
            version="12.0",
            administrator_login="missadministrator",
            administrator_login_password="thisIsKat11",
            minimum_tls_version="1.2",
            azuread_administrator=azure.mssql.ServerAzureadAdministratorArgs(
                login_username="AzureAD Admin",
                object_id="00000000-0000-0000-0000-000000000000",
            ),
            extended_auditing_policy=azure.mssql.ServerExtendedAuditingPolicyArgs(
                storage_endpoint=azurerm_storage_account["example"]["primary_blob_endpoint"],
                storage_account_access_key=azurerm_storage_account["example"]["primary_access_key"],
                storage_account_access_key_is_secondary=True,
                retention_in_days=6,
            ),
            tags={
                "environment": "production",
            })
        example_server_transparent_data_encryption = azure.mssql.ServerTransparentDataEncryption("exampleServerTransparentDataEncryption", server_id=example_server.id)
        ```

        ## Import

        SQL Server Transparent Data Encryption can be imported using the resource id, e.g.

        ```sh
         $ pulumi import azure:mssql/serverTransparentDataEncryption:ServerTransparentDataEncryption example /subscriptions/12345678-1234-9876-4563-123456789012/resourceGroups/group1/providers/Microsoft.Sql/servers/server1/encryptionProtector/current
        ```

        :param str resource_name: The name of the resource.
        :param ServerTransparentDataEncryptionArgs args: The arguments to use to populate this resource's properties.
        :param pulumi.ResourceOptions opts: Options for the resource.
        """
        ...
    def __init__(__self__, resource_name: str, *args, **kwargs):
        resource_args, opts = _utilities.get_resource_args_opts(ServerTransparentDataEncryptionArgs, pulumi.ResourceOptions, *args, **kwargs)
        if resource_args is not None:
            __self__._internal_init(resource_name, opts, **resource_args.__dict__)
        else:
            __self__._internal_init(resource_name, *args, **kwargs)

    def _internal_init(__self__,
                 resource_name: str,
                 opts: Optional[pulumi.ResourceOptions] = None,
                 key_vault_key_id: Optional[pulumi.Input[str]] = None,
                 server_id: Optional[pulumi.Input[str]] = None,
                 __props__=None):
        if opts is None:
            opts = pulumi.ResourceOptions()
        if not isinstance(opts, pulumi.ResourceOptions):
            raise TypeError('Expected resource options to be a ResourceOptions instance')
        if opts.version is None:
            opts.version = _utilities.get_version()
        if opts.id is None:
            if __props__ is not None:
                raise TypeError('__props__ is only valid when passed in combination with a valid opts.id to get an existing resource')
            __props__ = ServerTransparentDataEncryptionArgs.__new__(ServerTransparentDataEncryptionArgs)

            __props__.__dict__["key_vault_key_id"] = key_vault_key_id
            if server_id is None and not opts.urn:
                raise TypeError("Missing required property 'server_id'")
            __props__.__dict__["server_id"] = server_id
        super(ServerTransparentDataEncryption, __self__).__init__(
            'azure:mssql/serverTransparentDataEncryption:ServerTransparentDataEncryption',
            resource_name,
            __props__,
            opts)

    @staticmethod
    def get(resource_name: str,
            id: pulumi.Input[str],
            opts: Optional[pulumi.ResourceOptions] = None,
            key_vault_key_id: Optional[pulumi.Input[str]] = None,
            server_id: Optional[pulumi.Input[str]] = None) -> 'ServerTransparentDataEncryption':
        """
        Get an existing ServerTransparentDataEncryption resource's state with the given name, id, and optional extra
        properties used to qualify the lookup.

        :param str resource_name: The unique name of the resulting resource.
        :param pulumi.Input[str] id: The unique provider ID of the resource to lookup.
        :param pulumi.ResourceOptions opts: Options for the resource.
        :param pulumi.Input[str] key_vault_key_id: To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
        :param pulumi.Input[str] server_id: Specifies the name of the MS SQL Server.
        """
        opts = pulumi.ResourceOptions.merge(opts, pulumi.ResourceOptions(id=id))

        __props__ = _ServerTransparentDataEncryptionState.__new__(_ServerTransparentDataEncryptionState)

        __props__.__dict__["key_vault_key_id"] = key_vault_key_id
        __props__.__dict__["server_id"] = server_id
        return ServerTransparentDataEncryption(resource_name, opts=opts, __props__=__props__)

    @property
    @pulumi.getter(name="keyVaultKeyId")
    def key_vault_key_id(self) -> pulumi.Output[Optional[str]]:
        """
        To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
        """
        return pulumi.get(self, "key_vault_key_id")

    @property
    @pulumi.getter(name="serverId")
    def server_id(self) -> pulumi.Output[str]:
        """
        Specifies the name of the MS SQL Server.
        """
        return pulumi.get(self, "server_id")

