How to automate the activation of Synapse Workspace

Question

I am following the official documentation for using Customer Managed Key (CMK) for double encryption for Synapse workspace. Now my question is how to automate this step?

I got the part of granting the Synapse workspace access to the key vault and did automate it with terraform. However, there seems to be no way to do the activation part with terrafrom (azurerm module) or api call.

Can someone give me an idea on how to approach this issue.

Answer 1

As I've required this today: Using PowerShell directly, it easily works as following:

Update-AzSynapseWorkspaceKey -WorkspaceName YourWorkspaceName -Activate

=> see https://learn.microsoft.com/en-us/powershell/module/az.synapse/update-azsynapseworkspacekey?view=azps-6.3.0

Therefore the script only needs to be integrated into your terraform template, e.g. using https://www.terraform.io/docs/language/resources/provisioners/local-exec.html.

Of course, in this case, additional steps to authenticate within the Az-Cmdlets of PowerShell to Azure might be required.

added details, to answer question on how to do this in REST-API or Azure CLI

In the end, resource provisioning is all about REST APIs. PowerShell Modules, Azure CLI, Python SDK etc. are only wrappers doing the REST API magic in behind.

And this magic is no secret, but can be investigated:

• "--debug" option in Azure CLI, see https://learn.microsoft.com/en-us/cli/azure/get-started-with-azure-cli
• "$DebugPreference" Variable in PowerShell, see https://learn.microsoft.com/en-us/powershell/azure/troubleshooting?view=azps-6.3.0 This helps to identify the relevant REST APIs, if you want to do it by yourself.

REST API directly:

1. Trigger activation

• HTTP Method: PUT
• Absolute Uri: https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}/keys/default?api-version=2021-05-01
• Body:
  • see docs: https://learn.microsoft.com/en-us/rest/api/synapse/keys/create-or-update#request-body

2. Check Workspace As activation is an async operation, check every few seconds and wait for: properties.encryption.cmk.status == "Consistent" Request:

• HTTP Method: GET
• Absolute Uri: https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Synapse/workspaces/{workspaceName}?api-version=2021-05-01

Azure CLI:

1. az synapse workspace key update: Activate a workspace and change it's state from pending to success state when the workspace is first being provisioned through updating a workspace's key. Switching to another CMK after activating the workspace needs to execute 'az synapse workspace update' instead.
2. az synapse workspace show

Answer 2

There is no way to automate the activation process. We need to do it form portal manually.