Upgrading To The Latest Version

Upload Deployment Artifacts

You can download the latest version of the deployment package from https://my.protegrity.com. Navigate to Data Protection > Cloud Protect to download the latest version.

After downloading the deployment package from the Protegrity Portal, go to Azure console. Navigate to the storage account that was previously created to upload deployment artifacts (see: Agent Policy Blob Container).

Upload the following artifacts to the Azure storage container:

• protegrity-protect-<version>.zip
• protegrity-agent-<version>.zip

After upload is complete, note the blob url for each file. Blob URL may be found in the blob properties.

Record Blob URL values below

New Protect Function Blob URL: ___________________

New Log Forwarder Function Blob URL: ___________________

New Agent Function Blob URL: ___________________

Perform the following steps to upgrade the Policy Agent, Protect, and Log Forwarder Functions separately.

Disable Protegrity Agent Function Timer Trigger

App Function Timer Trigger is used to periodically run Protegrity Agent Function to synchronize policy from ESA. The trigger must be disabled temporarily for the time of the upgrade process.

Follow the steps below to disable the Agent Function Timer Trigger.

1. From Azure Console, go to Function App service and select Protegrity Agent Function.

2. Navigate to Overview.

3. The functions list should contain agent function with Trigger type Timer and status Enabled.

4. Click on the three dots in the same row as the agent function. Then select Disable.

Upgrading Policy Agent Function

Upgrade Policy Agent Runtime Package

1. From Azure console, navigate to Function App service and select agent function app. Navigate to Settings > Environment variables.

2. Click on WEBSITE_RUN_FROM_PACKAGE configuration entry.

3. Save existing URL. You may need it to rollback upgrade.

   WEBSITE_RUN_FROM_PACKAGE: _______________

4. Replace URL with New Agent Function Blob URL.

5. Click Apply then select Apply and Confirm to finalize.

6. Using menu on the left, navigate to Overview. Stop the function using Stop button at the top. Then start it again.

7. In the next section the Agent function will be tested to make sure it works as expected.

8. (Optional) If you need to rollback to older version of Agent Function, replace WEBSITE_RUN_FROM_PACKAGE with URL recorded in previous steps.

Disable Agent Policy Deployment and Test Policy Agent Function

Policy agent generates a backup of pulled policy when triggered. The policy will then be deployed to Protect and Log Forwarder functions. Deployment of policies to functions should be disabled during the upgrade process.

Follow the steps below to disable policy deployment:

1. From Azure Console, navigate to Policy Agent Function App

2. Navigate to Settings > Environment variables.

3. set DISABLE_DEPLOY to 1 if it is not already set.

   Note

   This will prevent Agent from overwriting production policy files or their references in deployed functions.

4. Stop/Start the Agent function. It may take a few minutes for the function to start.

Test/Run Policy Agent Function to Generate Latest Policy

Follow the steps below to run the upgraded policy agent to refresh latest backup policy. Record the latest backup policy URL for later upgrade steps.

1. From Azure Console, navigate to the Policy Agent Function App

2. Navigate to the agent Test/Run feature as described in Test Agent Function Installation.

3. Run the policy agent. Verify the agent executed successfully by carefully inspecting the logs.

4. Use the following Azure Blob url from your Policy Agent Function Settings > Environment variables

   AZURE_POLICY_BLOB_URL
   

   Note

   If resources are deployed in gov cloud, use blob.core.usgovcloudapi.net domain

   upgraded_agent_policy_blob_url: _______________________

Upgrading Protect Function

Diagram below illustrates upgrade steps.

• Create Staging Deployment Slot Creating new deployment slot allows updating the function without interruptions to the existing traffic.

• Load Production Policy and Test New Protect Function In Staging

• Finalize Protector upgrade Upgraded Protect Function can now be swapped in to production deployment slot to serve production traffic.

Create Staging Deployment Slot (Protector)

Creating new deployment slot allows updating the function without interruptions to the existing traffic.

1. From Azure console, navigate to Function App service and select the Protect Function App to upgrade. Navigate to Deployments > Deployment Slots.

2. Click Add slot. Specify slot name.

3. Click Add. Wait for the slot to be created.

4. After the slot is added, select Close to close the dialog box.

5. There should be a new slot available in the list of deployment slots. You will use this deployment slot as staging for the upgraded function. After upgrade is done and tested, you will swap staging slot with production slot.

6. Click on the new deployment slot. This will open the newly created replica of Cloud Protect Function.

7. Copy the function URL from the overview window.

   Staging Protect Function URL: ________________

8. Navigate to Identity section under Settings.

9. If your installation utilizes System Assigned Identity:

   1. Select System Assigned tab and switch Status On. Click Save.

   2. This will generate the Object ID for the newly deployed function in the deployment slot.

   3. Add Role Assignments to the identity as described in section Function System-Assigned Managed Identity

      Tip

      Reference production function slot for current permissions.

   4. Use the Object ID to update Key Vault policy to allow function in the deployment slot to use policy encryption key. See Protect Function Key Vault Access Policies for instructions how to update Key Vault policy.

10. If your installation utilizes User Assigned Identity:

    1. Select User Assigned tab

    2. Select Add. Choose the identity in use on the production function, then complete by selecting Add again.

11. Navigate to App Keys section from the menu on the left. Record default key value under Host Keys section.

    Staging Protect Function Default Host Key: ________________

12. Navigate to the staging Function App Settings > Environment variables

13. Click on WEBSITE_RUN_FROM_PACKAGE configuration entry.

14. Replace value with New Protect Function Blob URL.

15. Set EVENTHUB_NAME to the output value recorded in Install Log Forwarder via ARM template for the newly deployed log forwarder.

16. Set EventHub__fullyQualifiedNamespace to the output value recorded in Install Log Forwarder via ARM template.

17. Click Apply, then Apply to finalize.

Load Production Policy and Test New Protect Function In Staging

1. Navigate to the new staging Protect function Settings > Environment variables

2. Set AZURE_POLICY_BLOB_URL environment variable to the upgraded_agent_policy_blob_url value recorded in previous steps.

3. Start/Stop the protect function.

4. Test New Protect Function in staging. You can use curl command below, replacing Staging Protect Function URL and Staging Protect Function Default Host Key with values recorded in previous section.

• Snowflake
• Cloud API

curl -X POST "<Staging Protect Function URL>/api/Protect" -k \
-H 'sf-custom-X-Protegrity-HCoP-Rules: {"jsonpaths":[{"op_type":"unprotect","data_element":"alpha"}]}' \
-H 'sf-context-current-user: test' \
-H 'sf-external-function-current-query-id: test-id' \
-H 'x-functions-key: <Staging Protect Function Default Host Key>' \
-H 'Content-Type: application/json' \
-d '{
  "data": [
    ["0", "UtfVk UHgcD!"]
  ]
}'

curl -X POST "<Protect Function URL>/api/v1/protect" -k \
-H 'x-functions-key: <Protect Function app key>' \
-H 'Content-Type: application/json' \
-d '{
  "data": ["test"],
  "user": "test",
  "data_element": "test"
}'

Finalize Protector upgrade

Upgraded Protect Function can now be swapped in to production deployment slot to serve production traffic.

1. Go to your main Protect Function.

2. Select deployment slots.

3. Select Swap.

4. Select staging Protect Function slot as source and production Function as target.

5. Click swap and wait until the functions are swapped.

6. If you need to rollback swap the application slots again.

Upgrading Log Forwarder Function

Disable Log Forwarder Event Hub Trigger

Disabling the Event Hub trigger will prevent audit log delivery during the upgrade process. This reduces the chance for any duplicate or lost audit logs. Later steps will indicate when this trigger may be re-enabled.

Follow the steps below to disable the Event Hub trigger:

1. From Azure Console, go to Function App service and select Protegrity Log Forwarder Function.

2. Navigate to Overview.

3. The functions list should contain AuditLogForwarder function with Trigger type Event Hub and Status Enabled.

4. Click on the three dots in the same row as the AuditLogForwarder function. Then select Disable.

Create Staging Deployment Slot (Log Forwarder)

Creating new deployment slot allows updating the function such that it may easily be rolled back. Log Forwarder Function will be disabled during the upgrade process. Logs generated during this time will be processed once Log Forwarder is re-enabled

1. From Azure console, navigate to Function App service and select the Log Forwarder Function App to upgrade. Navigate to Deployments > Deployment Slots.

2. Click Add slot. Specify slot name.

3. Click Add. Wait for the slot to be created.

4. After the slot is added, select Close to close the dialog box.

5. There should be a new slot available in the list of deployment slots. You will use this deployment slot as staging for the upgraded function. After upgrade is done, you will swap staging slot with production slot.

6. Click on the new deployment slot. This will open the newly created replica of Log Forwarder Function.

7. Navigate to the staging Function App environment variable settings Settings > Environment variables

8. Click on WEBSITE_RUN_FROM_PACKAGE configuration entry.

9. Replace value with New Log Forwarder Function Blob URL. Click Apply.

10. Click on AZURE_POLICY_BLOB_URL configuration entry.

11. Replace value with upgraded_agent_policy_blob_url. Click Apply.

12. Click Apply and Confirm to push the configuration changes.

Finalize Log Forwarder Upgrade

Upgraded Log Forwarder Function will be swapped into production deployment slot to serve production traffic and re-enabled,

• Swap Upgraded Function Slot to Production

• Re-Enable Log Forwarder Function Trigger

Swap Upgraded Function Slot to Production

1. Go to your main Log Forwarder Function.

2. Select deployment slots.

3. Select Swap.

4. Select staging Log Forwarder Function slot as source and current Function as target.

5. Click Start Swap and wait until the functions are swapped.

6. If you need to rollback, swap the application slots again.

Re-Enable Log Forwarder Function Trigger

1. Go to your main Log Forwarder Function.

2. Navigate to environment variable settings Settings > Environment variables

3. Click on AzureWebJobs.AuditLogForwarder.Disabled configuration entry.

4. Replace value with false. Click Apply then Apply and Confirm to finalize.

Re-enable Policy Agent Deployment Setting

Skip this step if changes were not made to the DISABLE_DEPLOY setting in previous upgrade steps

1. Navigate to Agent function Settings > Environment variables

2. Set DISABLE_DEPLOY to 0.

3. apply changes and restart the Agent Function App

Enable Protegrity Agent Function Timer Trigger

If the Agent Function Timer Trigger was disabled at the beginning of the upgrade process, you must re-enabled it. Follow the steps below to enable Policy Agent Timer Trigger.

1. Navigate back to Protegrity Agent Function.

2. Select Overview.

3. Click on the three dots in the same row as the agent function in the list of functions. Then select Enable.