SQL Server TDE uses a customer-managed key

# Set the SQL Server TDE protector to a Key Vault CMK
resource "azurerm_mssql_server_transparent_data_encryption" "<example_resource_name>" {
  server_id        = "<example_resource_id>"
  key_vault_key_id = "<key_vault_key_id>" # critical: KID of the Key Vault key to use as TDE protector
}

# Ensure TDE is enabled on the database
resource "azurerm_mssql_database" "<example_resource_name>" {
  name      = "<example_resource_name>"
  server_id = "<example_resource_id>"

  transparent_data_encryption_enabled = true # critical: turns on TDE for the database
}

// Add the Key Vault key to the SQL server
resource serverKey 'Microsoft.Sql/servers/keys@2021-11-01' = {
  name: '<example_resource_name>/<example_resource_name>'
  properties: {
    serverKeyType: 'AzureKeyVault' // critical: use a customer-managed key from Azure Key Vault
    uri: 'https://<example_resource_name>.vault.azure.net/keys/<example_resource_name>/<example_resource_id>' // critical: KID of the Key Vault key
  }
}

// Set the server TDE protector to the Key Vault key (CMK)
resource encryptionProtector 'Microsoft.Sql/servers/encryptionProtector@2021-11-01' = {
  name: '<example_resource_name>/current'
  properties: {
    serverKeyType: 'AzureKeyVault' // critical: switches protector from service-managed to CMK
    serverKeyName: '<example_resource_name>' // critical: reference the key added above
  }
}

// Ensure TDE is enabled on the database
resource dbTde 'Microsoft.Sql/servers/databases/transparentDataEncryption@2014-04-01' = {
  name: '<example_resource_name>/<example_resource_name>/current'
  properties: {
    status: 'Enabled' // critical: turns on TDE for the database
  }
}