Skip to content

Commit 77fea8a

Browse files
azure-powershell-botVeryEarly
azure-powershell-bot
and
VeryEarly
authored
Migrate DataProtection from generation to main (#26878)
* Move DataProtection to main * Update ChangeLog.md --------- Co-authored-by: Yabo Hu <[email protected]>
1 parent 9c5828f commit 77fea8a

File tree

108 files changed

+2368
-553
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

108 files changed

+2368
-553
lines changed

‎src/DataProtection/DataProtection.Autorest/Az.DataProtection.format.ps1xml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,9 +96,9 @@
9696
</TableControl>
9797
</View>
9898
<View>
99-
<Name>Microsoft.Azure.PowerShell.Cmdlets.DataProtection.Models.Api40.ErrorDetail</Name>
99+
<Name>Microsoft.Azure.PowerShell.Cmdlets.DataProtection.Models.Api50.ErrorDetail</Name>
100100
<ViewSelectedBy>
101-
<TypeName>Microsoft.Azure.PowerShell.Cmdlets.DataProtection.Models.Api40.ErrorDetail</TypeName>
101+
<TypeName>Microsoft.Azure.PowerShell.Cmdlets.DataProtection.Models.Api50.ErrorDetail</TypeName>
102102
</ViewSelectedBy>
103103
<TableControl>
104104
<TableHeaders>

‎src/DataProtection/DataProtection.Autorest/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ This file contains the configuration for generating My API from the OpenAPI spec
3131
3232
``` yaml
3333
# it's the same options as command line options, just drop the double-dash!
34-
commit: 72f52bc8847a889488da885f40d6871a89e0470b
34+
commit: 4aad50a36767f7c36673f2c7982bb4055dbf5ed4
3535
require:
3636
- $(this-folder)/../../readme.azure.noprofile.md
3737
input-file:

‎src/DataProtection/DataProtection.Autorest/custom/Cmdlets/Platform/BackupInstance/Initialize-AzDataProtectionBackupInstance.ps1

Lines changed: 26 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,16 @@
4242

4343
[Parameter(Mandatory=$false, HelpMessage='Backup configuration for backup. Use this parameter to configure protection for AzureKubernetesService,AzureBlob.')]
4444
[Microsoft.Azure.PowerShell.Cmdlets.DataProtection.Models.Api20240401.IBackupDatasourceParameters]
45-
${BackupConfiguration}
45+
${BackupConfiguration},
46+
47+
[Parameter(Mandatory=$false, HelpMessage='Use system assigned identity')]
48+
[System.Nullable[System.Boolean]]
49+
${UseSystemAssignedIdentity},
50+
51+
[Parameter(Mandatory=$false, HelpMessage='User assigned identity ARM Id')]
52+
[Alias('AssignUserIdentity')]
53+
[System.String]
54+
${UserAssignedIdentityArmId}
4655
)
4756

4857
process {
@@ -96,6 +105,22 @@
96105
$backupInstance.PolicyInfo.PolicyId = $PolicyId
97106
}
98107

108+
$hasUseSystemAssignedIdentity = $PSBoundParameters.Remove("UseSystemAssignedIdentity")
109+
$hasUserAssignedIdentityArmId = $PSBoundParameters.Remove("UserAssignedIdentityArmId")
110+
if ($hasUseSystemAssignedIdentity -or $hasUserAssignedIdentityArmId) {
111+
112+
if ($hasUserAssignedIdentityArmId -and (!$hasUseSystemAssignedIdentity -or $UseSystemAssignedIdentity)) {
113+
throw "UserAssignedIdentityArmId cannot be provided without UseSystemAssignedIdentity and UseSystemAssignedIdentity must be false when UserAssignedIdentityArmId is provided."
114+
}
115+
116+
$backupInstance.IdentityDetail = [Microsoft.Azure.PowerShell.Cmdlets.DataProtection.Models.Api20240401.IdentityDetails]::new()
117+
$backupInstance.IdentityDetail.UseSystemAssignedIdentity = $UseSystemAssignedIdentity
118+
119+
if ($hasUserAssignedIdentityArmId) {
120+
$instance.Property.IdentityDetail.UserAssignedIdentityArmUrl = $UserAssignedIdentityArmId
121+
}
122+
}
123+
99124
# secret store authentication
100125
if($PSBoundParameters.ContainsKey("SecretStoreURI"))
101126
{

‎src/DataProtection/DataProtection.Autorest/custom/Cmdlets/Platform/BackupInstance/Update-AzDataProtectionBackupInstance.ps1

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,15 @@ function Update-AzDataProtectionBackupInstance
2727
[System.String]
2828
${PolicyId},
2929

30+
[Parameter(Mandatory=$false, HelpMessage='Use system assigned identity')]
31+
[System.Nullable[System.Boolean]]
32+
${UseSystemAssignedIdentity},
33+
34+
[Parameter(Mandatory=$false, HelpMessage='User assigned identity ARM Id')]
35+
[Alias('AssignUserIdentity')]
36+
[System.String]
37+
${UserAssignedIdentityArmId},
38+
3039
[Parameter(Mandatory=$false, HelpMessage='List of containers to be backed up inside the VaultStore. Use this parameter for DatasourceType AzureBlob.')]
3140
[System.String[]]
3241
${VaultedBackupContainer},
@@ -98,6 +107,8 @@ function Update-AzDataProtectionBackupInstance
98107
{
99108
$hasPolicyId = $PSBoundParameters.Remove("PolicyId")
100109
$hasVaultedBackupContainer = $PSBoundParameters.Remove("VaultedBackupContainer")
110+
$hasUseSystemAssignedIdentity = $PSBoundParameters.Remove("UseSystemAssignedIdentity")
111+
$hasUserAssignedIdentityArmId = $PSBoundParameters.Remove("UserAssignedIdentityArmId")
101112

102113
$instance = Az.DataProtection\Get-AzDataProtectionBackupInstance @PSBoundParameters
103114

@@ -107,6 +118,20 @@ function Update-AzDataProtectionBackupInstance
107118

108119
$DatasourceType = GetClientDatasourceType -ServiceDatasourceType $instance.Property.DataSourceInfo.Type
109120
# $manifest = LoadManifest -DatasourceType $DatasourceType.ToString()
121+
122+
if ($hasUseSystemAssignedIdentity -or $hasUserAssignedIdentityArmId) {
123+
124+
if ($hasUserAssignedIdentityArmId -and (!$hasUseSystemAssignedIdentity -or $UseSystemAssignedIdentity)) {
125+
throw "UserAssignedIdentityArmId cannot be provided without UseSystemAssignedIdentity and UseSystemAssignedIdentity must be false when UserAssignedIdentityArmId is provided."
126+
}
127+
128+
$instance.Property.IdentityDetail = [Microsoft.Azure.PowerShell.Cmdlets.DataProtection.Models.Api20240401.IdentityDetails]::new()
129+
$instance.Property.IdentityDetail.UseSystemAssignedIdentity = $UseSystemAssignedIdentity
130+
131+
if ($hasUserAssignedIdentityArmId) {
132+
$instance.Property.IdentityDetail.UserAssignedIdentityArmUrl = $UserAssignedIdentityArmId
133+
}
134+
}
110135

111136
if($hasVaultedBackupContainer){
112137

‎src/DataProtection/DataProtection.Autorest/custom/Cmdlets/Platform/Vault/New-AzDataProtectionBackupVault.ps1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@
6767
${Tag},
6868

6969
[Parameter(Mandatory=$false, HelpMessage='Gets or sets the user assigned identities.')]
70-
[Alias('UserAssignedIdentity')]
70+
[Alias('UserAssignedIdentity', 'AssignUserIdentity')]
7171
[System.Collections.Hashtable]
7272
${IdentityUserAssignedIdentity},
7373

‎src/DataProtection/DataProtection.Autorest/custom/Cmdlets/Platform/Vault/Set-AzDataProtectionMSIPermission.ps1

Lines changed: 56 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,32 @@
1-
function Set-AzDataProtectionMSIPermission {
1+
function Get-VaultIdentity {
2+
3+
[Microsoft.Azure.PowerShell.Cmdlets.DataProtection.DoNotExportAttribute()]
4+
param (
5+
[Parameter(Mandatory=$true)]
6+
[System.Object] $vault,
7+
8+
[Parameter(Mandatory=$false)]
9+
[System.String] $UserAssignedIdentityARMId
10+
)
11+
12+
#Determine the vault MSI to be used
13+
$vaultIdentity = $null
14+
if ($UserAssignedIdentityARMId) {
15+
$vaultIdentity = $vault.Identity.UserAssignedIdentity[$UserAssignedIdentityARMId].PrincipalID
16+
Write-Host "Using Vault UAMI with ARMId: $UserAssignedIdentityARMId with Principal ID: $vaultIdentity"
17+
} else {
18+
$vaultIdentity = $vault.Identity.PrincipalId
19+
Write-Host "Using system-assigned identity with Principal ID: $vaultIdentity"
20+
}
21+
22+
if (-not $vaultIdentity) {
23+
throw "Vault identity could not be determined. Please check the UserAssignedIdentityARMId or the vault configuration."
24+
}
25+
26+
return $vaultIdentity
27+
}
28+
29+
function Set-AzDataProtectionMSIPermission {
230
[OutputType('System.Object')]
331
[CmdletBinding(PositionalBinding=$false, SupportsShouldProcess, ConfirmImpact = 'High')]
432
[Microsoft.Azure.PowerShell.Cmdlets.DataProtection.Description('Grants required permissions to the backup vault and other resources for configure backup and restore scenarios')]
@@ -46,7 +74,12 @@
4674

4775
[Parameter(ParameterSetName="SetPermissionsForRestore", Mandatory=$false, HelpMessage='Target storage account ARM Id. Use this parameter for DatasourceType AzureDatabaseForMySQL, AzureDatabaseForPGFlexServer.')]
4876
[System.String]
49-
${StorageAccountARMId}
77+
${StorageAccountARMId},
78+
79+
[Parameter(Mandatory=$false, HelpMessage='User Assigned Identity ARM ID of the backup vault to be used for assigning permissions')]
80+
[Alias('AssignUserIdentity')]
81+
[System.String]
82+
${UserAssignedIdentityARMId}
5083
)
5184

5285
process {
@@ -95,7 +128,8 @@
95128
$manifest = LoadManifest -DatasourceType $DatasourceTypeInternal.ToString()
96129

97130
$vault = Az.DataProtection\Get-AzDataProtectionBackupVault -VaultName $VaultName -ResourceGroupName $VaultResourceGroup -SubscriptionId $subscriptionIdInternal
98-
131+
$vaultIdentity = Get-VaultIdentity -vault $vault -UserAssignedIdentityARMId $UserAssignedIdentityARMId
132+
99133
if(-not $manifest.supportRestoreGrantPermission){
100134
$err = "Set permissions for restore is currently not supported for given DataSourceType"
101135
throw $err
@@ -152,7 +186,7 @@
152186

153187
foreach($Permission in $manifest.snapshotRGPermissions)
154188
{
155-
$AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vault.Identity.PrincipalId
189+
$AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vaultIdentity
156190

157191
# CSR: $SubscriptionName might be different when we add cross subscription restore
158192
$CheckPermission = $AllRoles | Where-Object { ($_.Scope -eq $SnapshotResourceGroupId -or $_.Scope -eq $SubscriptionName) -and $_.RoleDefinitionName -eq $Permission}
@@ -166,7 +200,7 @@
166200
{
167201
$MissingRolesInitially = $true
168202

169-
AssignMissingRoles -ObjectId $vault.Identity.PrincipalId -Permission $Permission -PermissionsScope $PermissionsScope -Resource $SnapshotResourceGroupId -ResourceGroup $SnapshotResourceGroupId -Subscription $SubscriptionName
203+
AssignMissingRoles -ObjectId $vaultIdentity -Permission $Permission -PermissionsScope $PermissionsScope -Resource $SnapshotResourceGroupId -ResourceGroup $SnapshotResourceGroupId -Subscription $SubscriptionName
170204

171205
Write-Host "Assigned $($Permission) permission to the backup vault over snapshot resource group with Id $($SnapshotResourceGroupId)"
172206
}
@@ -176,7 +210,7 @@
176210
foreach($Permission in $manifest.datasourcePermissionsForRestore)
177211
{
178212
# set context to the subscription where ObjectId is present
179-
$AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vault.Identity.PrincipalId
213+
$AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vaultIdentity
180214

181215
$CheckPermission = $AllRoles | Where-Object { ($_.Scope -eq $DataSourceId -or $_.Scope -eq $ResourceRG -or $_.Scope -eq $SubscriptionName) -and $_.RoleDefinitionName -eq $Permission}
182216

@@ -189,7 +223,7 @@
189223
{
190224
$MissingRolesInitially = $true
191225

192-
AssignMissingRoles -ObjectId $vault.Identity.PrincipalId -Permission $Permission -PermissionsScope $PermissionsScope -Resource $DataSourceId -ResourceGroup $ResourceRG -Subscription $SubscriptionName
226+
AssignMissingRoles -ObjectId $vaultIdentity -Permission $Permission -PermissionsScope $PermissionsScope -Resource $DataSourceId -ResourceGroup $ResourceRG -Subscription $SubscriptionName
193227

194228
Write-Host "Assigned $($Permission) permission to the backup vault over DataSource with Id $($DataSourceId)"
195229
}
@@ -198,7 +232,7 @@
198232
foreach($Permission in $manifest.storageAccountPermissionsForRestore)
199233
{
200234
# set context to the subscription where ObjectId is present
201-
$AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vault.Identity.PrincipalId
235+
$AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vaultIdentity
202236

203237
$targetResourceArmId = $restoreRequest.RestoreTargetInfo.TargetDetail.TargetResourceArmId
204238

@@ -237,7 +271,7 @@
237271
{
238272
$MissingRolesInitially = $true
239273

240-
AssignMissingRoles -ObjectId $vault.Identity.PrincipalId -Permission $Permission -PermissionsScope $PermissionsScope -Resource $storageAccId -ResourceGroup $storageAccResourceGroupId -Subscription $storageAccountSubId
274+
AssignMissingRoles -ObjectId $vaultIdentity -Permission $Permission -PermissionsScope $PermissionsScope -Resource $storageAccId -ResourceGroup $storageAccResourceGroupId -Subscription $storageAccountSubId
241275

242276
Write-Host "Assigned $($Permission) permission to the backup vault over storage account with Id $($storageAccId)"
243277
}
@@ -255,8 +289,9 @@
255289
$subscriptionId = $ResourceArray[2]
256290

257291
$vault = Az.DataProtection\Get-AzDataProtectionBackupVault -VaultName $VaultName -ResourceGroupName $VaultResourceGroup -SubscriptionId $ResourceArray[2]
258-
259-
$AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vault.Identity.PrincipalId
292+
$vaultIdentity = Get-VaultIdentity -vault $vault -UserAssignedIdentityARMId $UserAssignedIdentityARMId
293+
294+
$AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vaultIdentity
260295

261296
# If more DataSourceTypes support this then we can make it manifest driven
262297
if($DatasourceType -eq "AzureDatabaseForPostgreSQL")
@@ -341,11 +376,11 @@
341376
$KeyVault = Get-AzKeyVault -VaultName $KeyvaultName
342377
$KeyVaultAccessPolicies = $KeyVault.AccessPolicies
343378

344-
$KeyVaultAccessPolicy = $KeyVaultAccessPolicies | Where-Object {$_.ObjectID -eq $vault.Identity.PrincipalId}
379+
$KeyVaultAccessPolicy = $KeyVaultAccessPolicies | Where-Object {$_.ObjectID -eq $vaultIdentity}
345380

346381
if($KeyVaultAccessPolicy -eq $null)
347382
{
348-
Set-AzKeyVaultAccessPolicy -VaultName $KeyvaultName -ObjectId $vault.Identity.PrincipalId -PermissionsToSecrets Get,List -Confirm:$False
383+
Set-AzKeyVaultAccessPolicy -VaultName $KeyvaultName -ObjectId $vaultIdentity -PermissionsToSecrets Get,List -Confirm:$False
349384
break
350385
}
351386

@@ -355,7 +390,7 @@
355390
[String[]]$FinalKeyvaultAccessPolicyPermissions = $KeyvaultAccessPolicyPermissions
356391
$FinalKeyvaultAccessPolicyPermissions = $FinalKeyvaultAccessPolicyPermissions | select -uniq
357392

358-
Set-AzKeyVaultAccessPolicy -VaultName $KeyvaultName -ObjectId $vault.Identity.PrincipalId -PermissionsToSecrets $FinalKeyvaultAccessPolicyPermissions -Confirm:$False
393+
Set-AzKeyVaultAccessPolicy -VaultName $KeyvaultName -ObjectId $vaultIdentity -PermissionsToSecrets $FinalKeyvaultAccessPolicyPermissions -Confirm:$False
359394
}
360395
catch{
361396
$err = $_
@@ -376,7 +411,7 @@
376411
{
377412
$MissingRolesInitially = $true
378413

379-
AssignMissingRoles -ObjectId $vault.Identity.PrincipalId -Permission $Permission -PermissionsScope $PermissionsScope -Resource $KeyVaultId -ResourceGroup $KeyvaultRG -Subscription $KeyvaultSubscriptionName
414+
AssignMissingRoles -ObjectId $vaultIdentity -Permission $Permission -PermissionsScope $PermissionsScope -Resource $KeyVaultId -ResourceGroup $KeyvaultRG -Subscription $KeyvaultSubscriptionName
380415

381416
Write-Host "Assigned $($Permission) permission to the backup vault over key vault with Id $($KeyVaultId)"
382417
}
@@ -435,7 +470,7 @@
435470
$SnapshotResourceGroupId = $BackupInstance.Property.PolicyInfo.PolicyParameter.DataStoreParametersList[0].ResourceGroupId
436471

437472
# CSR: $SubscriptionName might be different when we add cross subscription restore
438-
$AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vault.Identity.PrincipalId
473+
$AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vaultIdentity
439474
$CheckPermission = $AllRoles | Where-Object { ($_.Scope -eq $SnapshotResourceGroupId -or $_.Scope -eq $SubscriptionName) -and $_.RoleDefinitionName -eq $Permission}
440475

441476
if($CheckPermission -ne $null)
@@ -447,15 +482,15 @@
447482
{
448483
$MissingRolesInitially = $true
449484

450-
AssignMissingRoles -ObjectId $vault.Identity.PrincipalId -Permission $Permission -PermissionsScope $PermissionsScope -Resource $SnapshotResourceGroupId -ResourceGroup $SnapshotResourceGroupId -Subscription $SubscriptionName
485+
AssignMissingRoles -ObjectId $vaultIdentity -Permission $Permission -PermissionsScope $PermissionsScope -Resource $SnapshotResourceGroupId -ResourceGroup $SnapshotResourceGroupId -Subscription $SubscriptionName
451486

452487
Write-Host "Assigned $($Permission) permission to the backup vault over snapshot resource group with Id $($SnapshotResourceGroupId)"
453488
}
454489
}
455490

456491
foreach($Permission in $manifest.datasourcePermissions)
457492
{
458-
$AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vault.Identity.PrincipalId
493+
$AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vaultIdentity
459494
$CheckPermission = $AllRoles | Where-Object { ($_.Scope -eq $DataSourceId -or $_.Scope -eq $ResourceRG -or $_.Scope -eq $SubscriptionName) -and $_.RoleDefinitionName -eq $Permission}
460495

461496
if($CheckPermission -ne $null)
@@ -467,15 +502,15 @@
467502
{
468503
$MissingRolesInitially = $true
469504

470-
AssignMissingRoles -ObjectId $vault.Identity.PrincipalId -Permission $Permission -PermissionsScope $PermissionsScope -Resource $DataSourceId -ResourceGroup $ResourceRG -Subscription $SubscriptionName
505+
AssignMissingRoles -ObjectId $vaultIdentity -Permission $Permission -PermissionsScope $PermissionsScope -Resource $DataSourceId -ResourceGroup $ResourceRG -Subscription $SubscriptionName
471506

472507
Write-Host "Assigned $($Permission) permission to the backup vault over DataSource with Id $($DataSourceId)"
473508
}
474509
}
475510

476511
foreach($Permission in $manifest.datasourceRGPermissions)
477512
{
478-
$AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vault.Identity.PrincipalId
513+
$AllRoles = Az.Resources\Get-AzRoleAssignment -ObjectId $vaultIdentity
479514
$CheckPermission = $AllRoles | Where-Object { ($_.Scope -eq $ResourceRG -or $_.Scope -eq $SubscriptionName) -and $_.RoleDefinitionName -eq $Permission}
480515

481516
if($CheckPermission -ne $null)
@@ -493,7 +528,7 @@
493528
$DatasourceRGScope = "ResourceGroup"
494529
}
495530

496-
AssignMissingRoles -ObjectId $vault.Identity.PrincipalId -Permission $Permission -PermissionsScope $DatasourceRGScope -Resource $DataSourceId -ResourceGroup $ResourceRG -Subscription $SubscriptionName
531+
AssignMissingRoles -ObjectId $vaultIdentity -Permission $Permission -PermissionsScope $DatasourceRGScope -Resource $DataSourceId -ResourceGroup $ResourceRG -Subscription $SubscriptionName
497532

498533
Write-Host "Assigned $($Permission) permission to the backup vault over DataSource resource group with name $($ResourceRG)"
499534
}

‎src/DataProtection/DataProtection.Autorest/custom/Cmdlets/Platform/Vault/Update-AzDataProtectionBackupVault.ps1

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -55,7 +55,7 @@
5555
${Tag},
5656

5757
[Parameter(ParameterSetName="UpdateExpanded",Mandatory=$false, HelpMessage='Gets or sets the user assigned identities.')]
58-
[Alias('UserAssignedIdentity')]
58+
[Alias('UserAssignedIdentity', 'AssignUserIdentity')]
5959
[System.Collections.Hashtable]
6060
${IdentityUserAssignedIdentity},
6161

0 commit comments

Comments
 (0)