Database Blob Auditing Policies - Create Or Update

服務:: SQL Database

API 版本:: 2025-01-01

建立或更新資料庫的 blob 稽核政策。

PUT https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/servers/{serverName}/databases/{databaseName}/auditingSettings/default?api-version=2025-01-01

URI 參數

名稱	位於	必要	類型	Description
blobAuditingPolicyName	path	True	BlobAuditingPolicyName	blob 稽核政策的名稱。
databaseName	path	True	string	資料庫的名稱。
resourceGroupName	path	True	string minLength: 1 maxLength: 90	資源群組的名稱。名稱不區分大小寫。
serverName	path	True	string	伺服器的名稱。
subscriptionId	path	True	string (uuid)	目標訂用帳戶的標識碼。此值必須是 UUID。
api-version	query	True	string minLength: 1	用於此作業的 API 版本。

要求本文

名稱	必要	類型	Description
properties.state	True	BlobAuditingPolicyState	指定稽核的狀態。如果狀態為 Enabled，則需要 storageEndpoint 或 isAzureMonitorTargetEnabled。
properties.auditActionsAndGroups		string[]	指定要稽核的 Actions-Groups 和動作。建議使用的一組動作群組是下列組合 - 這會稽核針對資料庫執行的所有查詢和預存程式，以及成功和失敗的登入： BATCH_COMPLETED_GROUP，SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP，FAILED_DATABASE_AUTHENTICATION_GROUP。上述組合也是啟用 Azure 入口網站稽核時預設設定的組合。要稽核的支援動作群組為（注意：僅選擇涵蓋稽核需求的特定群組。使用不必要的群組可能會導致大量稽核記錄）： APPLICATION_ROLE_CHANGE_PASSWORD_GROUP BACKUP_RESTORE_GROUP DATABASE_LOGOUT_GROUP DATABASE_OBJECT_CHANGE_GROUP DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP DATABASE_OBJECT_PERMISSION_CHANGE_GROUP DATABASE_OPERATION_GROUP DATABASE_PERMISSION_CHANGE_GROUP DATABASE_PRINCIPAL_CHANGE_GROUP DATABASE_PRINCIPAL_IMPERSONATION_GROUP DATABASE_ROLE_MEMBER_CHANGE_GROUP FAILED_DATABASE_AUTHENTICATION_GROUP SCHEMA_OBJECT_ACCESS_GROUP SCHEMA_OBJECT_CHANGE_GROUP SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP USER_CHANGE_PASSWORD_GROUP BATCH_STARTED_GROUP BATCH_COMPLETED_GROUP DBCC_GROUP DATABASE_OWNERSHIP_CHANGE_GROUP DATABASE_CHANGE_GROUP LEDGER_OPERATION_GROUP 這些群組涵蓋針對資料庫執行的所有 sql 語句和預存程式，且不應與其他群組搭配使用，因為這會導致重複的稽核記錄。如需詳細資訊，請參閱 Database-Level 稽核動作群組。針對資料庫稽核原則，也可以指定特定動作（請注意，無法為伺服器稽核原則指定動作）。支援的稽核動作包括：選擇、更新、插入、刪除、執行、接收參考定義待稽核動作的一般形式為：{action} 對 {object} 由 {principal} 進行請注意，上述格式 <物件> 可以參考數據表、檢視或預存程式或整個資料庫或架構等物件。針對後者，會分別使用 DATABASE：：{db_name} 和 SCHEMA：：{schema_name} 窗體。例如：在 dbo.myTable 上以公開方式在 SELECT：：在 DATABASE：：由公開上選擇在 SCHEMA：：mySchema 上以公開方式選擇如需詳細資訊，請參閱 Database-Level 稽核動作
properties.isAzureMonitorTargetEnabled		boolean	指定審計事件是否會傳送到 Azure 監視器。若要將事件傳送到 Azure 監視器，請將「State」設為「Enabled」，「IsAzureMonitorTargetEnabled」為 true。使用 REST API 設定稽核時，也應該在資料庫上建立具有 'SQLSecurityAuditEvents' 診斷記錄類別的診斷設定。請注意，針對伺服器層級稽核，您應該使用 'master' 資料庫作為 {databaseName}。診斷設定 URI 格式：PUT `https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Sql/servers/{serverName}/databases/{databaseName}/providers/microsoft.insights/diagnosticSettings/{settingsName}?api-version=2017-05-01-preview` 如需詳細資訊，請參閱診斷設定 REST API 或診斷設定 PowerShell
properties.isManagedIdentityInUse		boolean	指定受控識別是否用來存取 Blob 記憶體
properties.isStorageSecondaryKeyInUse		boolean	指定 storageAccountAccessKey 值是否為記憶體的次要密鑰。
properties.queueDelayMs		integer (int32)	指定可以在強制處理稽核動作之前經過的時間長度 (以毫秒為單位)。預設值為1000 （1秒）。最大值為 2,147,483,647。
properties.retentionDays		integer (int32)	指定要保留在記憶體帳戶稽核記錄中的天數。
properties.storageAccountAccessKey		string (password)	指定稽核記憶體帳戶的標識碼金鑰。如果狀態為 Enabled 且 storageEndpoint 已指定，則未指定 storageAccountAccessKey 會使用 SQL Server 系統指派的受控識別來存取記憶體。使用受控識別驗證的必要條件： Assign SQL Server a system-assigned managed identity in Azure Active Directory （AAD）. 透過在伺服器身份中新增「Storage Blob Data Contributor」RBAC 角色，授予 SQL Server 身份存取權。如需詳細資訊，請參閱使用受控識別驗證對記憶體稽核
properties.storageAccountSubscriptionId		string (uuid)	指定 Blob 記憶體訂用帳戶標識碼。
properties.storageEndpoint		string	指定 Blob 記憶體端點（例如 `https://MyAccount.blob.core.windows.net`）。如果狀態為 Enabled，則需要 storageEndpoint 或 isAzureMonitorTargetEnabled。

回應

名稱	類型	Description
200 OK	DatabaseBlobAuditingPolicy	資源「DatabaseBlobAuditingPolicy」更新操作成功
201 Created	DatabaseBlobAuditingPolicy	資源「DatabaseBlobAuditingPolicy」建立操作成功
Other Status Codes	ErrorResponse	未預期的錯誤回應。

安全性

azure_auth

Azure Active Directory OAuth2 Flow。

類型: oauth2
Flow: implicit
授權 URL: https://login.microsoftonline.com/common/oauth2/authorize

範圍

名稱	Description
user_impersonation	模擬您的用戶帳戶

範例

Create or update a database's azure monitor auditing policy with minimal parameters

Create or update a database's blob auditing policy with all parameters

Create or update a database's blob auditing policy with minimal parameters

Create or update a database's azure monitor auditing policy with minimal parameters

範例要求

PUT https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/blobauditingtest-4799/providers/Microsoft.Sql/servers/blobauditingtest-6440/databases/testdb/auditingSettings/default?api-version=2025-01-01

{
  "properties": {
    "isAzureMonitorTargetEnabled": true,
    "state": "Enabled"
  }
}


import com.azure.resourcemanager.sql.fluent.models.DatabaseBlobAuditingPolicyInner;
import com.azure.resourcemanager.sql.models.BlobAuditingPolicyName;
import com.azure.resourcemanager.sql.models.BlobAuditingPolicyState;

/**
 * Samples for DatabaseBlobAuditingPolicies CreateOrUpdate.
 */
public final class Main {
    /*
     * x-ms-original-file: 2025-01-01/DatabaseAzureMonitorAuditingCreateMin.json
     */
    /**
     * Sample code: Create or update a database's azure monitor auditing policy with minimal parameters.
     * 
     * @param manager Entry point to SqlServerManager.
     */
    public static void createOrUpdateADatabaseSAzureMonitorAuditingPolicyWithMinimalParameters(
        com.azure.resourcemanager.sql.SqlServerManager manager) {
        manager.serviceClient().getDatabaseBlobAuditingPolicies().createOrUpdateWithResponse("blobauditingtest-4799",
            "blobauditingtest-6440", "testdb", BlobAuditingPolicyName.DEFAULT, new DatabaseBlobAuditingPolicyInner()
                .withIsAzureMonitorTargetEnabled(true).withState(BlobAuditingPolicyState.ENABLED),
            com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

from azure.identity import DefaultAzureCredential

from azure.mgmt.sql import SqlManagementClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-sql
# USAGE
    python database_azure_monitor_auditing_create_min.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = SqlManagementClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.database_blob_auditing_policies.create_or_update(
        resource_group_name="blobauditingtest-4799",
        server_name="blobauditingtest-6440",
        database_name="testdb",
        parameters={"properties": {"isAzureMonitorTargetEnabled": True, "state": "Enabled"}},
    )
    print(response)


# x-ms-original-file: 2025-01-01/DatabaseAzureMonitorAuditingCreateMin.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

const { SqlManagementClient } = require("@azure/arm-sql");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to creates or updates a database's blob auditing policy.
 *
 * @summary creates or updates a database's blob auditing policy.
 * x-ms-original-file: 2025-01-01/DatabaseAzureMonitorAuditingCreateMin.json
 */
async function createOrUpdateADatabaseAzureMonitorAuditingPolicyWithMinimalParameters() {
  const credential = new DefaultAzureCredential();
  const subscriptionId = "00000000-1111-2222-3333-444444444444";
  const client = new SqlManagementClient(credential, subscriptionId);
  const result = await client.databaseBlobAuditingPolicies.createOrUpdate(
    "blobauditingtest-4799",
    "blobauditingtest-6440",
    "testdb",
    { isAzureMonitorTargetEnabled: true, state: "Enabled" },
  );
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

using Azure;
using Azure.ResourceManager;
using System;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.Sql.Models;
using Azure.ResourceManager.Sql;

// Generated from example definition: specification/sql/resource-manager/Microsoft.Sql/SQL/stable/2025-01-01/examples/DatabaseAzureMonitorAuditingCreateMin.json
// this example is just showing the usage of "DatabaseBlobAuditingPolicies_CreateOrUpdate" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this SqlDatabaseBlobAuditingPolicyResource created on azure
// for more information of creating SqlDatabaseBlobAuditingPolicyResource, please refer to the document of SqlDatabaseBlobAuditingPolicyResource
string subscriptionId = "00000000-1111-2222-3333-444444444444";
string resourceGroupName = "blobauditingtest-4799";
string serverName = "blobauditingtest-6440";
string databaseName = "testdb";
BlobAuditingPolicyName blobAuditingPolicyName = BlobAuditingPolicyName.Default;
ResourceIdentifier sqlDatabaseBlobAuditingPolicyResourceId = SqlDatabaseBlobAuditingPolicyResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, serverName, databaseName, blobAuditingPolicyName);
SqlDatabaseBlobAuditingPolicyResource sqlDatabaseBlobAuditingPolicy = client.GetSqlDatabaseBlobAuditingPolicyResource(sqlDatabaseBlobAuditingPolicyResourceId);

// invoke the operation
SqlDatabaseBlobAuditingPolicyData data = new SqlDatabaseBlobAuditingPolicyData
{
    IsAzureMonitorTargetEnabled = true,
    State = BlobAuditingPolicyState.Enabled,
};
ArmOperation<SqlDatabaseBlobAuditingPolicyResource> lro = await sqlDatabaseBlobAuditingPolicy.UpdateAsync(WaitUntil.Completed, data);
SqlDatabaseBlobAuditingPolicyResource result = lro.Value;

// the variable result is a resource, you could call other operations on this instance as well
// but just for demo, we get its data from this resource instance
SqlDatabaseBlobAuditingPolicyData resourceData = result.Data;
// for demo we just print out the id
Console.WriteLine($"Succeeded on id: {resourceData.Id}");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

範例回覆

狀態碼:: 200

{
  "name": "default",
  "type": "Microsoft.Sql/servers/databases/auditingSettings",
  "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/blobauditingtest-4799/providers/Microsoft.Sql/servers/blobauditingtest-6440/databases/testdb",
  "kind": "V12",
  "properties": {
    "auditActionsAndGroups": [
      "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
      "FAILED_DATABASE_AUTHENTICATION_GROUP",
      "BATCH_COMPLETED_GROUP"
    ],
    "isAzureMonitorTargetEnabled": true,
    "retentionDays": 0,
    "state": "Enabled",
    "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000"
  }
}

狀態碼:: 201

{
  "name": "default",
  "type": "Microsoft.Sql/servers/databases/auditingSettings",
  "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/blobauditingtest-4799/providers/Microsoft.Sql/servers/blobauditingtest-6440/databases/testdb",
  "kind": "V12",
  "properties": {
    "auditActionsAndGroups": [
      "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
      "FAILED_DATABASE_AUTHENTICATION_GROUP",
      "BATCH_COMPLETED_GROUP"
    ],
    "isAzureMonitorTargetEnabled": true,
    "retentionDays": 0,
    "state": "Enabled",
    "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000"
  }
}

Create or update a database's blob auditing policy with all parameters

範例要求

PUT https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/blobauditingtest-4799/providers/Microsoft.Sql/servers/blobauditingtest-6440/databases/testdb/auditingSettings/default?api-version=2025-01-01

{
  "properties": {
    "auditActionsAndGroups": [
      "DATABASE_LOGOUT_GROUP",
      "DATABASE_ROLE_MEMBER_CHANGE_GROUP",
      "UPDATE on database::TestDatabaseName by public"
    ],
    "isAzureMonitorTargetEnabled": true,
    "isStorageSecondaryKeyInUse": false,
    "queueDelayMs": 4000,
    "retentionDays": 6,
    "state": "Enabled",
    "storageAccountAccessKey": "sdlfkjabc+sdlfkjsdlkfsjdfLDKFTERLKFDFKLjsdfksjdflsdkfD2342309432849328476458/3RSD==",
    "storageAccountSubscriptionId": "00000000-1234-0000-5678-000000000000",
    "storageEndpoint": "https://mystorage.blob.core.windows.net"
  }
}


import com.azure.resourcemanager.sql.fluent.models.DatabaseBlobAuditingPolicyInner;
import com.azure.resourcemanager.sql.models.BlobAuditingPolicyName;
import com.azure.resourcemanager.sql.models.BlobAuditingPolicyState;
import java.util.Arrays;
import java.util.UUID;

/**
 * Samples for DatabaseBlobAuditingPolicies CreateOrUpdate.
 */
public final class Main {
    /*
     * x-ms-original-file: 2025-01-01/DatabaseBlobAuditingCreateMax.json
     */
    /**
     * Sample code: Create or update a database's blob auditing policy with all parameters.
     * 
     * @param manager Entry point to SqlServerManager.
     */
    public static void createOrUpdateADatabaseSBlobAuditingPolicyWithAllParameters(
        com.azure.resourcemanager.sql.SqlServerManager manager) {
        manager.serviceClient().getDatabaseBlobAuditingPolicies().createOrUpdateWithResponse("blobauditingtest-4799",
            "blobauditingtest-6440", "testdb", BlobAuditingPolicyName.DEFAULT,
            new DatabaseBlobAuditingPolicyInner().withRetentionDays(6)
                .withAuditActionsAndGroups(Arrays.asList("DATABASE_LOGOUT_GROUP", "DATABASE_ROLE_MEMBER_CHANGE_GROUP",
                    "UPDATE on database::TestDatabaseName by public"))
                .withIsStorageSecondaryKeyInUse(false).withIsAzureMonitorTargetEnabled(true).withQueueDelayMs(4000)
                .withState(BlobAuditingPolicyState.ENABLED)
                .withStorageEndpoint("https://mystorage.blob.core.windows.net")
                .withStorageAccountAccessKey("fakeTokenPlaceholder").withStorageAccountSubscriptionId(
                    UUID.fromString("00000000-1234-0000-5678-000000000000")),
            com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

from azure.identity import DefaultAzureCredential

from azure.mgmt.sql import SqlManagementClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-sql
# USAGE
    python database_blob_auditing_create_max.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = SqlManagementClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.database_blob_auditing_policies.create_or_update(
        resource_group_name="blobauditingtest-4799",
        server_name="blobauditingtest-6440",
        database_name="testdb",
        parameters={
            "properties": {
                "auditActionsAndGroups": [
                    "DATABASE_LOGOUT_GROUP",
                    "DATABASE_ROLE_MEMBER_CHANGE_GROUP",
                    "UPDATE on database::TestDatabaseName by public",
                ],
                "isAzureMonitorTargetEnabled": True,
                "isStorageSecondaryKeyInUse": False,
                "queueDelayMs": 4000,
                "retentionDays": 6,
                "state": "Enabled",
                "storageAccountAccessKey": "sdlfkjabc+sdlfkjsdlkfsjdfLDKFTERLKFDFKLjsdfksjdflsdkfD2342309432849328476458/3RSD==",
                "storageAccountSubscriptionId": "00000000-1234-0000-5678-000000000000",
                "storageEndpoint": "https://mystorage.blob.core.windows.net",
            }
        },
    )
    print(response)


# x-ms-original-file: 2025-01-01/DatabaseBlobAuditingCreateMax.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

const { SqlManagementClient } = require("@azure/arm-sql");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to creates or updates a database's blob auditing policy.
 *
 * @summary creates or updates a database's blob auditing policy.
 * x-ms-original-file: 2025-01-01/DatabaseBlobAuditingCreateMax.json
 */
async function createOrUpdateADatabaseBlobAuditingPolicyWithAllParameters() {
  const credential = new DefaultAzureCredential();
  const subscriptionId = "00000000-1111-2222-3333-444444444444";
  const client = new SqlManagementClient(credential, subscriptionId);
  const result = await client.databaseBlobAuditingPolicies.createOrUpdate(
    "blobauditingtest-4799",
    "blobauditingtest-6440",
    "testdb",
    {
      auditActionsAndGroups: [
        "DATABASE_LOGOUT_GROUP",
        "DATABASE_ROLE_MEMBER_CHANGE_GROUP",
        "UPDATE on database::TestDatabaseName by public",
      ],
      isAzureMonitorTargetEnabled: true,
      isStorageSecondaryKeyInUse: false,
      queueDelayMs: 4000,
      retentionDays: 6,
      state: "Enabled",
      storageAccountAccessKey:
        "sdlfkjabc+sdlfkjsdlkfsjdfLDKFTERLKFDFKLjsdfksjdflsdkfD2342309432849328476458/3RSD==",
      storageAccountSubscriptionId: "00000000-1234-0000-5678-000000000000",
      storageEndpoint: "https://mystorage.blob.core.windows.net",
    },
  );
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

using Azure;
using Azure.ResourceManager;
using System;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.Sql.Models;
using Azure.ResourceManager.Sql;

// Generated from example definition: specification/sql/resource-manager/Microsoft.Sql/SQL/stable/2025-01-01/examples/DatabaseBlobAuditingCreateMax.json
// this example is just showing the usage of "DatabaseBlobAuditingPolicies_CreateOrUpdate" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this SqlDatabaseBlobAuditingPolicyResource created on azure
// for more information of creating SqlDatabaseBlobAuditingPolicyResource, please refer to the document of SqlDatabaseBlobAuditingPolicyResource
string subscriptionId = "00000000-1111-2222-3333-444444444444";
string resourceGroupName = "blobauditingtest-4799";
string serverName = "blobauditingtest-6440";
string databaseName = "testdb";
BlobAuditingPolicyName blobAuditingPolicyName = BlobAuditingPolicyName.Default;
ResourceIdentifier sqlDatabaseBlobAuditingPolicyResourceId = SqlDatabaseBlobAuditingPolicyResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, serverName, databaseName, blobAuditingPolicyName);
SqlDatabaseBlobAuditingPolicyResource sqlDatabaseBlobAuditingPolicy = client.GetSqlDatabaseBlobAuditingPolicyResource(sqlDatabaseBlobAuditingPolicyResourceId);

// invoke the operation
SqlDatabaseBlobAuditingPolicyData data = new SqlDatabaseBlobAuditingPolicyData
{
    RetentionDays = 6,
    AuditActionsAndGroups = { "DATABASE_LOGOUT_GROUP", "DATABASE_ROLE_MEMBER_CHANGE_GROUP", "UPDATE on database::TestDatabaseName by public" },
    IsStorageSecondaryKeyInUse = false,
    IsAzureMonitorTargetEnabled = true,
    QueueDelayMs = 4000,
    State = BlobAuditingPolicyState.Enabled,
    StorageEndpoint = "https://mystorage.blob.core.windows.net",
    StorageAccountAccessKey = "sdlfkjabc+sdlfkjsdlkfsjdfLDKFTERLKFDFKLjsdfksjdflsdkfD2342309432849328476458/3RSD==",
    StorageAccountSubscriptionId = Guid.Parse("00000000-1234-0000-5678-000000000000"),
};
ArmOperation<SqlDatabaseBlobAuditingPolicyResource> lro = await sqlDatabaseBlobAuditingPolicy.UpdateAsync(WaitUntil.Completed, data);
SqlDatabaseBlobAuditingPolicyResource result = lro.Value;

// the variable result is a resource, you could call other operations on this instance as well
// but just for demo, we get its data from this resource instance
SqlDatabaseBlobAuditingPolicyData resourceData = result.Data;
// for demo we just print out the id
Console.WriteLine($"Succeeded on id: {resourceData.Id}");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

範例回覆

狀態碼:: 200

{
  "name": "default",
  "type": "Microsoft.Sql/servers/databases/auditingSettings",
  "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/blobauditingtest-4799/providers/Microsoft.Sql/servers/blobauditingtest-6440/databases/testdb",
  "kind": "V12",
  "properties": {
    "auditActionsAndGroups": [
      "DATABASE_LOGOUT_GROUP",
      "DATABASE_ROLE_MEMBER_CHANGE_GROUP",
      "UPDATE on database::TestDatabaseName by public"
    ],
    "isAzureMonitorTargetEnabled": true,
    "isStorageSecondaryKeyInUse": false,
    "queueDelayMs": 4000,
    "retentionDays": 0,
    "state": "Enabled",
    "storageAccountSubscriptionId": "00000000-1234-0000-5678-000000000000",
    "storageEndpoint": "https://mystorage.blob.core.windows.net"
  }
}

狀態碼:: 201

{
  "name": "default",
  "type": "Microsoft.Sql/servers/databases/auditingSettings",
  "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/blobauditingtest-4799/providers/Microsoft.Sql/servers/blobauditingtest-6440/databases/testdb",
  "kind": "V12",
  "properties": {
    "auditActionsAndGroups": [
      "DATABASE_LOGOUT_GROUP",
      "DATABASE_ROLE_MEMBER_CHANGE_GROUP",
      "UPDATE on database::TestDatabaseName by public"
    ],
    "isAzureMonitorTargetEnabled": true,
    "isStorageSecondaryKeyInUse": false,
    "queueDelayMs": 4000,
    "retentionDays": 0,
    "state": "Enabled",
    "storageAccountSubscriptionId": "00000000-1234-0000-5678-000000000000",
    "storageEndpoint": "https://mystorage.blob.core.windows.net"
  }
}

Create or update a database's blob auditing policy with minimal parameters

範例要求

PUT https://management.azure.com/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/blobauditingtest-4799/providers/Microsoft.Sql/servers/blobauditingtest-6440/databases/testdb/auditingSettings/default?api-version=2025-01-01

{
  "properties": {
    "state": "Enabled",
    "storageAccountAccessKey": "sdlfkjabc+sdlfkjsdlkfsjdfLDKFTERLKFDFKLjsdfksjdflsdkfD2342309432849328476458/3RSD==",
    "storageEndpoint": "https://mystorage.blob.core.windows.net"
  }
}


import com.azure.resourcemanager.sql.fluent.models.DatabaseBlobAuditingPolicyInner;
import com.azure.resourcemanager.sql.models.BlobAuditingPolicyName;
import com.azure.resourcemanager.sql.models.BlobAuditingPolicyState;

/**
 * Samples for DatabaseBlobAuditingPolicies CreateOrUpdate.
 */
public final class Main {
    /*
     * x-ms-original-file: 2025-01-01/DatabaseBlobAuditingCreateMin.json
     */
    /**
     * Sample code: Create or update a database's blob auditing policy with minimal parameters.
     * 
     * @param manager Entry point to SqlServerManager.
     */
    public static void createOrUpdateADatabaseSBlobAuditingPolicyWithMinimalParameters(
        com.azure.resourcemanager.sql.SqlServerManager manager) {
        manager.serviceClient().getDatabaseBlobAuditingPolicies().createOrUpdateWithResponse("blobauditingtest-4799",
            "blobauditingtest-6440", "testdb", BlobAuditingPolicyName.DEFAULT,
            new DatabaseBlobAuditingPolicyInner().withState(BlobAuditingPolicyState.ENABLED)
                .withStorageEndpoint("https://mystorage.blob.core.windows.net")
                .withStorageAccountAccessKey("fakeTokenPlaceholder"),
            com.azure.core.util.Context.NONE);
    }
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

from azure.identity import DefaultAzureCredential

from azure.mgmt.sql import SqlManagementClient

"""
# PREREQUISITES
    pip install azure-identity
    pip install azure-mgmt-sql
# USAGE
    python database_blob_auditing_create_min.py

    Before run the sample, please set the values of the client ID, tenant ID and client secret
    of the AAD application as environment variables: AZURE_CLIENT_ID, AZURE_TENANT_ID,
    AZURE_CLIENT_SECRET. For more info about how to get the value, please see:
    https://docs.microsoft.com/azure/active-directory/develop/howto-create-service-principal-portal
"""


def main():
    client = SqlManagementClient(
        credential=DefaultAzureCredential(),
        subscription_id="SUBSCRIPTION_ID",
    )

    response = client.database_blob_auditing_policies.create_or_update(
        resource_group_name="blobauditingtest-4799",
        server_name="blobauditingtest-6440",
        database_name="testdb",
        parameters={
            "properties": {
                "state": "Enabled",
                "storageAccountAccessKey": "sdlfkjabc+sdlfkjsdlkfsjdfLDKFTERLKFDFKLjsdfksjdflsdkfD2342309432849328476458/3RSD==",
                "storageEndpoint": "https://mystorage.blob.core.windows.net",
            }
        },
    )
    print(response)


# x-ms-original-file: 2025-01-01/DatabaseBlobAuditingCreateMin.json
if __name__ == "__main__":
    main()

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

const { SqlManagementClient } = require("@azure/arm-sql");
const { DefaultAzureCredential } = require("@azure/identity");

/**
 * This sample demonstrates how to creates or updates a database's blob auditing policy.
 *
 * @summary creates or updates a database's blob auditing policy.
 * x-ms-original-file: 2025-01-01/DatabaseBlobAuditingCreateMin.json
 */
async function createOrUpdateADatabaseBlobAuditingPolicyWithMinimalParameters() {
  const credential = new DefaultAzureCredential();
  const subscriptionId = "00000000-1111-2222-3333-444444444444";
  const client = new SqlManagementClient(credential, subscriptionId);
  const result = await client.databaseBlobAuditingPolicies.createOrUpdate(
    "blobauditingtest-4799",
    "blobauditingtest-6440",
    "testdb",
    {
      state: "Enabled",
      storageAccountAccessKey:
        "sdlfkjabc+sdlfkjsdlkfsjdfLDKFTERLKFDFKLjsdfksjdflsdkfD2342309432849328476458/3RSD==",
      storageEndpoint: "https://mystorage.blob.core.windows.net",
    },
  );
  console.log(result);
}

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

using Azure;
using Azure.ResourceManager;
using System;
using System.Threading.Tasks;
using Azure.Core;
using Azure.Identity;
using Azure.ResourceManager.Sql.Models;
using Azure.ResourceManager.Sql;

// Generated from example definition: specification/sql/resource-manager/Microsoft.Sql/SQL/stable/2025-01-01/examples/DatabaseBlobAuditingCreateMin.json
// this example is just showing the usage of "DatabaseBlobAuditingPolicies_CreateOrUpdate" operation, for the dependent resources, they will have to be created separately.

// get your azure access token, for more details of how Azure SDK get your access token, please refer to https://learn.microsoft.com/en-us/dotnet/azure/sdk/authentication?tabs=command-line
TokenCredential cred = new DefaultAzureCredential();
// authenticate your client
ArmClient client = new ArmClient(cred);

// this example assumes you already have this SqlDatabaseBlobAuditingPolicyResource created on azure
// for more information of creating SqlDatabaseBlobAuditingPolicyResource, please refer to the document of SqlDatabaseBlobAuditingPolicyResource
string subscriptionId = "00000000-1111-2222-3333-444444444444";
string resourceGroupName = "blobauditingtest-4799";
string serverName = "blobauditingtest-6440";
string databaseName = "testdb";
BlobAuditingPolicyName blobAuditingPolicyName = BlobAuditingPolicyName.Default;
ResourceIdentifier sqlDatabaseBlobAuditingPolicyResourceId = SqlDatabaseBlobAuditingPolicyResource.CreateResourceIdentifier(subscriptionId, resourceGroupName, serverName, databaseName, blobAuditingPolicyName);
SqlDatabaseBlobAuditingPolicyResource sqlDatabaseBlobAuditingPolicy = client.GetSqlDatabaseBlobAuditingPolicyResource(sqlDatabaseBlobAuditingPolicyResourceId);

// invoke the operation
SqlDatabaseBlobAuditingPolicyData data = new SqlDatabaseBlobAuditingPolicyData
{
    State = BlobAuditingPolicyState.Enabled,
    StorageEndpoint = "https://mystorage.blob.core.windows.net",
    StorageAccountAccessKey = "sdlfkjabc+sdlfkjsdlkfsjdfLDKFTERLKFDFKLjsdfksjdflsdkfD2342309432849328476458/3RSD==",
};
ArmOperation<SqlDatabaseBlobAuditingPolicyResource> lro = await sqlDatabaseBlobAuditingPolicy.UpdateAsync(WaitUntil.Completed, data);
SqlDatabaseBlobAuditingPolicyResource result = lro.Value;

// the variable result is a resource, you could call other operations on this instance as well
// but just for demo, we get its data from this resource instance
SqlDatabaseBlobAuditingPolicyData resourceData = result.Data;
// for demo we just print out the id
Console.WriteLine($"Succeeded on id: {resourceData.Id}");

To use the Azure SDK library in your project, see this documentation. To provide feedback on this code sample, open a GitHub issue

範例回覆

狀態碼:: 200

{
  "name": "default",
  "type": "Microsoft.Sql/servers/databases/auditingSettings",
  "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/blobauditingtest-4799/providers/Microsoft.Sql/servers/blobauditingtest-6440/databases/testdb",
  "kind": "V12",
  "properties": {
    "auditActionsAndGroups": [
      "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
      "FAILED_DATABASE_AUTHENTICATION_GROUP",
      "BATCH_COMPLETED_GROUP"
    ],
    "isAzureMonitorTargetEnabled": false,
    "isStorageSecondaryKeyInUse": false,
    "retentionDays": 0,
    "state": "Enabled",
    "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000",
    "storageEndpoint": "https://mystorage.blob.core.windows.net"
  }
}

狀態碼:: 201

{
  "name": "default",
  "type": "Microsoft.Sql/servers/databases/auditingSettings",
  "id": "/subscriptions/00000000-1111-2222-3333-444444444444/resourceGroups/blobauditingtest-4799/providers/Microsoft.Sql/servers/blobauditingtest-6440/databases/testdb",
  "kind": "V12",
  "properties": {
    "auditActionsAndGroups": [
      "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP",
      "FAILED_DATABASE_AUTHENTICATION_GROUP",
      "BATCH_COMPLETED_GROUP"
    ],
    "isAzureMonitorTargetEnabled": false,
    "isStorageSecondaryKeyInUse": false,
    "retentionDays": 0,
    "state": "Enabled",
    "storageAccountSubscriptionId": "00000000-0000-0000-0000-000000000000",
    "storageEndpoint": "https://mystorage.blob.core.windows.net"
  }
}

定義

名稱	Description
BlobAuditingPolicyName	blob 稽核政策的名稱。
BlobAuditingPolicyState	指定稽核的狀態。如果狀態為 Enabled，則需要 storageEndpoint 或 isAzureMonitorTargetEnabled。
createdByType	建立資源的身分識別類型。
DatabaseBlobAuditingPolicy	資料庫 Blob 稽核原則。
ErrorAdditionalInfo	資源管理錯誤附加資訊。
ErrorDetail	錯誤詳細資料。
ErrorResponse	錯誤回應
systemData	與建立和上次修改資源相關的元數據。

BlobAuditingPolicyName

列舉型別

blob 稽核政策的名稱。

值	Description
default	預設

BlobAuditingPolicyState

列舉型別

指定稽核的狀態。如果狀態為 Enabled，則需要 storageEndpoint 或 isAzureMonitorTargetEnabled。

值	Description
Enabled	已啟用
Disabled	Disabled

createdByType

列舉型別

建立資源的身分識別類型。

值	Description
User
Application
ManagedIdentity
Key

DatabaseBlobAuditingPolicy

Object

資料庫 Blob 稽核原則。

名稱	類型	Description
id	string (arm-id)	資源的完整資源標識碼。例如，“/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}”
kind	string	資源種類。
name	string	資源的名稱
properties.auditActionsAndGroups	string[]	指定要稽核的 Actions-Groups 和動作。建議使用的一組動作群組是下列組合 - 這會稽核針對資料庫執行的所有查詢和預存程式，以及成功和失敗的登入： BATCH_COMPLETED_GROUP，SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP，FAILED_DATABASE_AUTHENTICATION_GROUP。上述組合也是啟用 Azure 入口網站稽核時預設設定的組合。要稽核的支援動作群組為（注意：僅選擇涵蓋稽核需求的特定群組。使用不必要的群組可能會導致大量稽核記錄）： APPLICATION_ROLE_CHANGE_PASSWORD_GROUP BACKUP_RESTORE_GROUP DATABASE_LOGOUT_GROUP DATABASE_OBJECT_CHANGE_GROUP DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP DATABASE_OBJECT_PERMISSION_CHANGE_GROUP DATABASE_OPERATION_GROUP DATABASE_PERMISSION_CHANGE_GROUP DATABASE_PRINCIPAL_CHANGE_GROUP DATABASE_PRINCIPAL_IMPERSONATION_GROUP DATABASE_ROLE_MEMBER_CHANGE_GROUP FAILED_DATABASE_AUTHENTICATION_GROUP SCHEMA_OBJECT_ACCESS_GROUP SCHEMA_OBJECT_CHANGE_GROUP SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP USER_CHANGE_PASSWORD_GROUP BATCH_STARTED_GROUP BATCH_COMPLETED_GROUP DBCC_GROUP DATABASE_OWNERSHIP_CHANGE_GROUP DATABASE_CHANGE_GROUP LEDGER_OPERATION_GROUP 這些群組涵蓋針對資料庫執行的所有 sql 語句和預存程式，且不應與其他群組搭配使用，因為這會導致重複的稽核記錄。如需詳細資訊，請參閱 Database-Level 稽核動作群組。針對資料庫稽核原則，也可以指定特定動作（請注意，無法為伺服器稽核原則指定動作）。支援的稽核動作包括：選擇、更新、插入、刪除、執行、接收參考定義待稽核動作的一般形式為：{action} 對 {object} 由 {principal} 進行請注意，上述格式 <物件> 可以參考數據表、檢視或預存程式或整個資料庫或架構等物件。針對後者，會分別使用 DATABASE：：{db_name} 和 SCHEMA：：{schema_name} 窗體。例如：在 dbo.myTable 上以公開方式在 SELECT：：在 DATABASE：：由公開上選擇在 SCHEMA：：mySchema 上以公開方式選擇如需詳細資訊，請參閱 Database-Level 稽核動作
properties.isAzureMonitorTargetEnabled	boolean	指定審計事件是否會傳送到 Azure 監視器。若要將事件傳送到 Azure 監視器，請將「State」設為「Enabled」，「IsAzureMonitorTargetEnabled」為 true。使用 REST API 設定稽核時，也應該在資料庫上建立具有 'SQLSecurityAuditEvents' 診斷記錄類別的診斷設定。請注意，針對伺服器層級稽核，您應該使用 'master' 資料庫作為 {databaseName}。診斷設定 URI 格式：PUT `https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroup}/providers/Microsoft.Sql/servers/{serverName}/databases/{databaseName}/providers/microsoft.insights/diagnosticSettings/{settingsName}?api-version=2017-05-01-preview` 如需詳細資訊，請參閱診斷設定 REST API 或診斷設定 PowerShell
properties.isManagedIdentityInUse	boolean	指定受控識別是否用來存取 Blob 記憶體
properties.isStorageSecondaryKeyInUse	boolean	指定 storageAccountAccessKey 值是否為記憶體的次要密鑰。
properties.queueDelayMs	integer (int32)	指定可以在強制處理稽核動作之前經過的時間長度 (以毫秒為單位)。預設值為1000 （1秒）。最大值為 2,147,483,647。
properties.retentionDays	integer (int32)	指定要保留在記憶體帳戶稽核記錄中的天數。
properties.state	BlobAuditingPolicyState	指定稽核的狀態。如果狀態為 Enabled，則需要 storageEndpoint 或 isAzureMonitorTargetEnabled。
properties.storageAccountAccessKey	string (password)	指定稽核記憶體帳戶的標識碼金鑰。如果狀態為 Enabled 且 storageEndpoint 已指定，則未指定 storageAccountAccessKey 會使用 SQL Server 系統指派的受控識別來存取記憶體。使用受控識別驗證的必要條件： Assign SQL Server a system-assigned managed identity in Azure Active Directory （AAD）. 透過在伺服器身份中新增「Storage Blob Data Contributor」RBAC 角色，授予 SQL Server 身份存取權。如需詳細資訊，請參閱使用受控識別驗證對記憶體稽核
properties.storageAccountSubscriptionId	string (uuid)	指定 Blob 記憶體訂用帳戶標識碼。
properties.storageEndpoint	string	指定 Blob 記憶體端點（例如 `https://MyAccount.blob.core.windows.net`）。如果狀態為 Enabled，則需要 storageEndpoint 或 isAzureMonitorTargetEnabled。
systemData	systemData	Azure Resource Manager 包含 createdBy 與 modifiedBy 資訊的元資料。
type	string	資源的類型。例如：「Microsoft。運算/虛擬機器」或「Microsoft」。儲存/儲存帳號」

ErrorAdditionalInfo

Object

資源管理錯誤附加資訊。

名稱	類型	Description
info	object	附加資訊。
type	string	其他資訊類型。

ErrorDetail

Object

錯誤詳細資料。

名稱	類型	Description
additionalInfo	ErrorAdditionalInfo[]	錯誤附加資訊。
code	string	錯誤碼。
details	ErrorDetail[]	錯誤詳情
message	string	錯誤訊息。
target	string	錯誤目標。

ErrorResponse

Object

錯誤回應

名稱	類型	Description
error	ErrorDetail	錯誤物件。

systemData

Object

與建立和上次修改資源相關的元數據。

名稱	類型	Description
createdAt	string (date-time)	資源建立的時間戳（UTC）。
createdBy	string	建立資源的身分識別。
createdByType	createdByType	建立資源的身分識別類型。
lastModifiedAt	string (date-time)	資源上次修改的時間戳記（UTC）
lastModifiedBy	string	上次修改資源的身分識別。
lastModifiedByType	createdByType	上次修改資源的身分識別類型。