CREATE MASTER KEY#
Accepted for SQL Server compatibility. In Querona this statement is a no-op: it is parsed so that scripts
which open with CREATE MASTER KEY run unchanged, but it is not an encryption root and is not required
before creating a database scoped credential. This is a deliberate divergence from SQL Server, where a database
master key is a prerequisite that encrypts the credential secret; in Querona, secrets are protected by the
engine’s secret store instead.
Syntax#
Arguments#
ENCRYPTION BY PASSWORD = ‘password‘
Optional, and accepted only for compatibility. The password is redacted and discarded — it is not stored and protects nothing. The password-less form (the Azure SQL Database syntax) is also accepted.
Remarks#
No master key object is created or persisted. ALTER MASTER KEY, OPEN/CLOSE MASTER KEY and
BACKUP MASTER KEY are not supported.
Permissions#
Requires the connection-management permission (CreateConnection) on the server.
Examples#
CREATE MASTER KEY ENCRYPTION BY PASSWORD = 'Str0ng!Passphrase';
CREATE DATABASE SCOPED CREDENTIAL AppCred WITH IDENTITY = 'u', SECRET = 'p';