// *** WARNING: this file was generated by pulumi-java-gen. ***
// *** Do not edit by hand unless you're certain you know what you are doing! ***

package com.pulumi.azure.mssql;

import com.pulumi.core.Output;
import com.pulumi.core.annotations.Import;
import java.lang.Boolean;
import java.lang.String;
import java.util.Objects;
import java.util.Optional;
import javax.annotation.Nullable;


public final class ServerTransparentDataEncryptionArgs extends com.pulumi.resources.ResourceArgs {

    public static final ServerTransparentDataEncryptionArgs Empty = new ServerTransparentDataEncryptionArgs();

    /**
     * When enabled, the server will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the server will be automatically rotated to the latest key version within 60 minutes.
     * 
     */
    @Import(name="autoRotationEnabled")
    private @Nullable Output<Boolean> autoRotationEnabled;

    /**
     * @return When enabled, the server will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the server will be automatically rotated to the latest key version within 60 minutes.
     * 
     */
    public Optional<Output<Boolean>> autoRotationEnabled() {
        return Optional.ofNullable(this.autoRotationEnabled);
    }

    /**
     * To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
     * 
     * &gt; **NOTE:** In order to use customer managed keys, the identity of the MSSQL server must have the following permissions on the key vault: &#39;get&#39;, &#39;wrapKey&#39; and &#39;unwrapKey&#39;
     * 
     * &gt; **NOTE:** If `server_id` denotes a secondary server deployed for disaster recovery purposes, then the `key_vault_key_id` should be the same key used for the primary server&#39;s transparent data encryption. Both primary and secondary servers should be encrypted with same key material.
     * 
     */
    @Import(name="keyVaultKeyId")
    private @Nullable Output<String> keyVaultKeyId;

    /**
     * @return To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
     * 
     * &gt; **NOTE:** In order to use customer managed keys, the identity of the MSSQL server must have the following permissions on the key vault: &#39;get&#39;, &#39;wrapKey&#39; and &#39;unwrapKey&#39;
     * 
     * &gt; **NOTE:** If `server_id` denotes a secondary server deployed for disaster recovery purposes, then the `key_vault_key_id` should be the same key used for the primary server&#39;s transparent data encryption. Both primary and secondary servers should be encrypted with same key material.
     * 
     */
    public Optional<Output<String>> keyVaultKeyId() {
        return Optional.ofNullable(this.keyVaultKeyId);
    }

    /**
     * Specifies the name of the MS SQL Server. Changing this forces a new resource to be created.
     * 
     */
    @Import(name="serverId", required=true)
    private Output<String> serverId;

    /**
     * @return Specifies the name of the MS SQL Server. Changing this forces a new resource to be created.
     * 
     */
    public Output<String> serverId() {
        return this.serverId;
    }

    private ServerTransparentDataEncryptionArgs() {}

    private ServerTransparentDataEncryptionArgs(ServerTransparentDataEncryptionArgs $) {
        this.autoRotationEnabled = $.autoRotationEnabled;
        this.keyVaultKeyId = $.keyVaultKeyId;
        this.serverId = $.serverId;
    }

    public static Builder builder() {
        return new Builder();
    }
    public static Builder builder(ServerTransparentDataEncryptionArgs defaults) {
        return new Builder(defaults);
    }

    public static final class Builder {
        private ServerTransparentDataEncryptionArgs $;

        public Builder() {
            $ = new ServerTransparentDataEncryptionArgs();
        }

        public Builder(ServerTransparentDataEncryptionArgs defaults) {
            $ = new ServerTransparentDataEncryptionArgs(Objects.requireNonNull(defaults));
        }

        /**
         * @param autoRotationEnabled When enabled, the server will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the server will be automatically rotated to the latest key version within 60 minutes.
         * 
         * @return builder
         * 
         */
        public Builder autoRotationEnabled(@Nullable Output<Boolean> autoRotationEnabled) {
            $.autoRotationEnabled = autoRotationEnabled;
            return this;
        }

        /**
         * @param autoRotationEnabled When enabled, the server will continuously check the key vault for any new versions of the key being used as the TDE protector. If a new version of the key is detected, the TDE protector on the server will be automatically rotated to the latest key version within 60 minutes.
         * 
         * @return builder
         * 
         */
        public Builder autoRotationEnabled(Boolean autoRotationEnabled) {
            return autoRotationEnabled(Output.of(autoRotationEnabled));
        }

        /**
         * @param keyVaultKeyId To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
         * 
         * &gt; **NOTE:** In order to use customer managed keys, the identity of the MSSQL server must have the following permissions on the key vault: &#39;get&#39;, &#39;wrapKey&#39; and &#39;unwrapKey&#39;
         * 
         * &gt; **NOTE:** If `server_id` denotes a secondary server deployed for disaster recovery purposes, then the `key_vault_key_id` should be the same key used for the primary server&#39;s transparent data encryption. Both primary and secondary servers should be encrypted with same key material.
         * 
         * @return builder
         * 
         */
        public Builder keyVaultKeyId(@Nullable Output<String> keyVaultKeyId) {
            $.keyVaultKeyId = keyVaultKeyId;
            return this;
        }

        /**
         * @param keyVaultKeyId To use customer managed keys from Azure Key Vault, provide the AKV Key ID. To use service managed keys, omit this field.
         * 
         * &gt; **NOTE:** In order to use customer managed keys, the identity of the MSSQL server must have the following permissions on the key vault: &#39;get&#39;, &#39;wrapKey&#39; and &#39;unwrapKey&#39;
         * 
         * &gt; **NOTE:** If `server_id` denotes a secondary server deployed for disaster recovery purposes, then the `key_vault_key_id` should be the same key used for the primary server&#39;s transparent data encryption. Both primary and secondary servers should be encrypted with same key material.
         * 
         * @return builder
         * 
         */
        public Builder keyVaultKeyId(String keyVaultKeyId) {
            return keyVaultKeyId(Output.of(keyVaultKeyId));
        }

        /**
         * @param serverId Specifies the name of the MS SQL Server. Changing this forces a new resource to be created.
         * 
         * @return builder
         * 
         */
        public Builder serverId(Output<String> serverId) {
            $.serverId = serverId;
            return this;
        }

        /**
         * @param serverId Specifies the name of the MS SQL Server. Changing this forces a new resource to be created.
         * 
         * @return builder
         * 
         */
        public Builder serverId(String serverId) {
            return serverId(Output.of(serverId));
        }

        public ServerTransparentDataEncryptionArgs build() {
            $.serverId = Objects.requireNonNull($.serverId, "expected parameter 'serverId' to be non-null");
            return $;
        }
    }

}
