Skip to content

Commit bb7824c

Browse files
grizzlytheodoreNickcandy
grizzlytheodore
and
Nickcandy
authored
Compute Security Posture (#26246)
* update swagger reference with Swagger breaking change update and customization to resolve breaking change * syntax fix * New-AzVmssConfig, New-AzVmss, Update-AzVmss * undo change in customiztion * update * add test * remove updates to Update-AzVmss * md files * update test and sanitize password --------- Co-authored-by: NanxiangLiu <[email protected]>
1 parent 5f8a35f commit bb7824c

File tree

10 files changed

+3690
-12
lines changed

10 files changed

+3690
-12
lines changed

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineScaleSetTests.cs

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -437,5 +437,12 @@ public void TestResiliencyPolicyVMSS()
437437
{
438438
TestRunner.RunTestScript("Test-ResiliencyPolicyVMSS");
439439
}
440+
441+
[Fact]
442+
[Trait(Category.AcceptanceType, Category.CheckIn)]
443+
public void TestSecurityPostureFeature()
444+
{
445+
TestRunner.RunTestScript("Test-SecurityPostureFeature");
446+
}
440447
}
441448
}

‎src/Compute/Compute.Test/ScenarioTests/VirtualMachineScaleSetTests.ps1

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5516,3 +5516,50 @@ function Test-ResiliencyPolicyVMSS
55165516
Clean-ResourceGroup $rgname
55175517
}
55185518
}
5519+
5520+
5521+
<#
5522+
.SYNOPSIS
5523+
Test Security Posture Feature
5524+
#>
5525+
function Test-SecurityPostureFeature
5526+
{
5527+
# Setup
5528+
$rgname = Get-ComputeTestResourceName;
5529+
$loc = Get-ComputeVMLocation;
5530+
5531+
try
5532+
{
5533+
# Common
5534+
New-AzResourceGroup -Name $rgname -Location $loc -Force;
5535+
5536+
$vmssName = 'vmss' + $rgname;
5537+
$domainNameLabel1 = "d1" + $rgname;
5538+
5539+
$adminUsername = Get-ComputeTestResourceName;
5540+
$password = Get-PasswordForVM;
5541+
$adminPassword = $password | ConvertTo-SecureString -AsPlainText -Force;
5542+
$cred = New-Object System.Management.Automation.PSCredential ($adminUsername, $adminPassword);
5543+
5544+
$SecurityPostureId = "/CommunityGalleries/SecurityPosturesBVTGallery/securityPostures/VMSSUniformWindows/versions/latest"
5545+
5546+
# create vmss with security posture settings
5547+
$vmss = New-AzVmss -ResourceGroupName $rgname -Location eastus2euap -Credential $cred -VMScaleSetName $vmssName -DomainNameLabel $domainNameLabel1 -SecurityPostureId $SecurityPostureId -SecurityPostureExcludeExtension "SecurityPostureSecurityAgent"
5548+
5549+
# verify
5550+
Assert-AreEqual $vmss.VirtualMAchineProfile.SecurityPostureReference.Id $SecurityPostureId
5551+
Assert-AreEqual $vmss.virtualMachineProfile.SecurityPostureReference.ExcludeExtensions.count 1
5552+
5553+
# Test New-AzVmssConfig
5554+
$vmssConfig = New-AzVmssConfig -SecurityPostureId $SecurityPostureId -SecurityPostureExcludeExtension "SecurityPostureSecurityAgent"
5555+
5556+
# Verify
5557+
Assert-AreEqual $vmssConfig.VirtualMAchineProfile.SecurityPostureReference.Id $SecurityPostureId
5558+
Assert-AreEqual $vmssConfig.virtualMachineProfile.SecurityPostureReference.ExcludeExtensions.count 1
5559+
}
5560+
finally
5561+
{
5562+
# Cleanup
5563+
Clean-ResourceGroup $rgname;
5564+
}
5565+
}

‎src/Compute/Compute.Test/SessionRecords/Microsoft.Azure.Commands.Compute.Test.ScenarioTests.VirtualMachineScaleSetTests/TestSecurityPostureFeature.json

Lines changed: 3491 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Compute/Compute/ChangeLog.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
2121
-->
2222
## Upcoming Release
23+
* Added optional parameters `-SecurityPostureId` and `-SecurityPostureExcludeExtension` to cmdlets `New-AzVmss` and `New-AzVmssConfig`.
2324
* Updated image aliases to be up-to-date in the azure-powershell\src\Compute\Strategies\ComputeRp\Images.json file.
2425
* Upgraded Azure.Core to 1.44.1.
2526

‎src/Compute/Compute/Generated/VirtualMachineScaleSet/Config/NewAzureRmVmssConfigCommand.cs

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -348,6 +348,18 @@ public partial class NewAzureRmVmssConfigCommand : Microsoft.Azure.Commands.Reso
348348
Mandatory = false)]
349349
public bool? EnableSecureBoot { get; set; } = null;
350350

351+
[Parameter(
352+
Mandatory = false,
353+
ValueFromPipelineByPropertyName = true,
354+
HelpMessage = "The security posture reference id in the form of /CommunityGalleries/{communityGalleryName}/securityPostures/{securityPostureName}/versions/{major.minor.patch}|latest")]
355+
public string SecurityPostureId { get; set; }
356+
357+
[Parameter(
358+
Mandatory = false,
359+
ValueFromPipelineByPropertyName = true,
360+
HelpMessage = "List of virtual machine extensions to exclude when applying the security posture.")]
361+
public string[] SecurityPostureExcludeExtension { get; set; }
362+
351363
[Parameter(
352364
Mandatory = false,
353365
ValueFromPipelineByPropertyName = true)]
@@ -995,6 +1007,31 @@ private void Run()
9951007
vVirtualMachineProfile.ScheduledEventsProfile.OsImageNotificationProfile.NotBeforeTimeout = this.OSImageScheduledEventNotBeforeTimeoutInMinutes;
9961008
}
9971009

1010+
if (this.IsParameterBound(c => c.SecurityPostureId))
1011+
{
1012+
if (vVirtualMachineProfile == null)
1013+
{
1014+
vVirtualMachineProfile = new PSVirtualMachineScaleSetVMProfile();
1015+
}
1016+
if (vVirtualMachineProfile.SecurityPostureReference == null)
1017+
{
1018+
vVirtualMachineProfile.SecurityPostureReference = new SecurityPostureReference();
1019+
}
1020+
vVirtualMachineProfile.SecurityPostureReference.Id = this.SecurityPostureId;
1021+
}
1022+
1023+
if (this.IsParameterBound(c => c.SecurityPostureExcludeExtension))
1024+
{
1025+
if (vVirtualMachineProfile == null)
1026+
{
1027+
vVirtualMachineProfile = new PSVirtualMachineScaleSetVMProfile();
1028+
}
1029+
if (vVirtualMachineProfile.SecurityPostureReference == null)
1030+
{
1031+
vVirtualMachineProfile.SecurityPostureReference = new SecurityPostureReference();
1032+
}
1033+
vVirtualMachineProfile.SecurityPostureReference.ExcludeExtensions = this.SecurityPostureExcludeExtension;
1034+
}
9981035

9991036
var vVirtualMachineScaleSet = new PSVirtualMachineScaleSet
10001037
{

‎src/Compute/Compute/Manual/PSVirtualMachineScaleSetVMProfile.cs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,7 @@ public class PSVirtualMachineScaleSetVMProfile
3939
public CapacityReservationProfile CapacityReservation { get; set; }
4040
public string UserData { get; set; }
4141
public PSApplicationProfile ApplicationProfile { get; set; }
42+
public SecurityPostureReference SecurityPostureReference { get; set; }
4243
public System.DateTime? TimeCreated { get; private set; }
4344
}
4445
}

‎src/Compute/Compute/Manual/VirtualMachineScaleSetCreateOrUpdateMethod.cs

Lines changed: 20 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -256,6 +256,20 @@ public partial class NewAzureRmVmss : ComputeAutomationBaseCmdlet
256256
Mandatory = false)]
257257
public bool? EnableSecureBoot { get; set; } = null;
258258

259+
[Parameter(
260+
Mandatory = false,
261+
ParameterSetName = SimpleParameterSet,
262+
ValueFromPipelineByPropertyName = true,
263+
HelpMessage = "The security posture reference id in the form of /CommunityGalleries/{communityGalleryName}/securityPostures/{securityPostureName}/versions/{major.minor.patch}|latest")]
264+
public string SecurityPostureId { get; set; }
265+
266+
[Parameter(
267+
Mandatory = false,
268+
ParameterSetName = SimpleParameterSet,
269+
ValueFromPipelineByPropertyName = true,
270+
HelpMessage = "List of virtual machine extensions to exclude when applying the security posture.")]
271+
public string[] SecurityPostureExcludeExtension { get; set; }
272+
259273
[Parameter(
260274
Mandatory = false,
261275
ParameterSetName = SimpleParameterSet,
@@ -497,7 +511,9 @@ private async Task<ResourceConfig<VirtualMachineScaleSet>> SimpleParameterSetNor
497511
skuProfileVmSize: skuProfileVmSizes,
498512
skuProfileAllocationStrategy: _cmdlet.SkuProfileAllocationStrategy,
499513
ifMatch: _cmdlet.IfMatch,
500-
ifNoneMatch: _cmdlet.IfNoneMatch
514+
ifNoneMatch: _cmdlet.IfNoneMatch,
515+
securityPostureId: _cmdlet.SecurityPostureId,
516+
securityPostureExcludeExtension: _cmdlet.SecurityPostureExcludeExtension
501517
);
502518
}
503519

@@ -666,7 +682,9 @@ private async Task<ResourceConfig<VirtualMachineScaleSet>> SimpleParameterSetOrc
666682
skuProfileAllocationStrategy: _cmdlet.SkuProfileAllocationStrategy,
667683
auxAuthHeader: auxAuthHeader,
668684
ifMatch: _cmdlet.IfMatch,
669-
ifNoneMatch: _cmdlet.IfNoneMatch
685+
ifNoneMatch: _cmdlet.IfNoneMatch,
686+
securityPostureId: _cmdlet.SecurityPostureId,
687+
securityPostureExcludeExtension: _cmdlet.SecurityPostureExcludeExtension
670688
);
671689
}
672690
}

‎src/Compute/Compute/Strategies/ComputeRp/VirtualMachineScaleSetStrategy.cs

Lines changed: 18 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -80,7 +80,9 @@ internal static ResourceConfig<VirtualMachineScaleSet> CreateVirtualMachineScale
8080
SkuProfileVMSize[] skuProfileVmSize = null,
8181
string skuProfileAllocationStrategy = null,
8282
string ifMatch = null,
83-
string ifNoneMatch = null
83+
string ifNoneMatch = null,
84+
string securityPostureId = null,
85+
string[] securityPostureExcludeExtension = null
8486
)
8587
=> Strategy.CreateResourceConfig(
8688
resourceGroup: resourceGroup,
@@ -178,7 +180,12 @@ internal static ResourceConfig<VirtualMachineScaleSet> CreateVirtualMachineScale
178180
{
179181
CapacityReservationGroup = new Microsoft.Azure.Management.Compute.Models.SubResource(capacityReservationId)
180182
},
181-
UserData = userData
183+
UserData = userData,
184+
SecurityPostureReference = (securityPostureId != null || securityPostureExcludeExtension != null) ? new SecurityPostureReference
185+
{
186+
Id = securityPostureId,
187+
ExcludeExtensions = securityPostureExcludeExtension
188+
} : null
182189
},
183190
ProximityPlacementGroup = proximityPlacementGroup(engine),
184191
HostGroup = hostGroup(engine),
@@ -241,7 +248,9 @@ internal static ResourceConfig<VirtualMachineScaleSet> CreateVirtualMachineScale
241248
SkuProfileVMSize[] skuProfileVmSize = null,
242249
string skuProfileAllocationStrategy = null,
243250
string ifMatch = null,
244-
string ifNoneMatch = null
251+
string ifNoneMatch = null,
252+
string securityPostureId = null,
253+
string[] securityPostureExcludeExtension = null
245254
)
246255
=> Strategy.CreateResourceConfig(
247256
resourceGroup: resourceGroup,
@@ -321,7 +330,12 @@ internal static ResourceConfig<VirtualMachineScaleSet> CreateVirtualMachineScale
321330
CapacityReservation = (capacityReservationId == null) ? null : new CapacityReservationProfile
322331
{
323332
CapacityReservationGroup = new Microsoft.Azure.Management.Compute.Models.SubResource(capacityReservationId)
324-
}
333+
},
334+
SecurityPostureReference = (securityPostureId != null || securityPostureExcludeExtension != null) ? new SecurityPostureReference
335+
{
336+
Id = securityPostureId,
337+
ExcludeExtensions = securityPostureExcludeExtension
338+
} : null
325339
},
326340
ProximityPlacementGroup = proximityPlacementGroup(engine),
327341
HostGroup = hostGroup(engine),

‎src/Compute/Compute/help/New-AzVmss.md

Lines changed: 32 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,8 @@ New-AzVmss [[-ResourceGroupName] <String>] [-VMScaleSetName] <String> [-AsJob] [
3737
[-SkipExtensionsOnOverprovisionedVMs] [-EncryptionAtHost] [-PlatformFaultDomainCount <Int32>]
3838
[-OrchestrationMode <String>] [-CapacityReservationGroupId <String>] [-ImageReferenceId <String>]
3939
[-DiskControllerType <String>] [-SharedGalleryImageId <String>] [-SecurityType <String>]
40-
[-EnableVtpm <Boolean>] [-EnableSecureBoot <Boolean>] [-SkuProfileVmSize <String[]>]
40+
[-EnableVtpm <Boolean>] [-EnableSecureBoot <Boolean>] [-SecurityPostureId <String>]
41+
[-SecurityPostureExcludeExtension <String[]>] [-SkuProfileVmSize <String[]>]
4142
[-SkuProfileAllocationStrategy <String>] [-DefaultProfile <IAzureContextContainer>] [-SinglePlacementGroup]
4243
[-WhatIf] [-Confirm] [<CommonParameters>]
4344
```
@@ -859,6 +860,36 @@ Accept pipeline input: False
859860
Accept wildcard characters: False
860861
```
861862
863+
### -SecurityPostureExcludeExtension
864+
List of virtual machine extensions to exclude when applying the security posture.
865+
866+
```yaml
867+
Type: System.String[]
868+
Parameter Sets: SimpleParameterSet
869+
Aliases:
870+
871+
Required: False
872+
Position: Named
873+
Default value: None
874+
Accept pipeline input: True (ByPropertyName)
875+
Accept wildcard characters: False
876+
```
877+
878+
### -SecurityPostureId
879+
The security posture reference id in the form of /CommunityGalleries/{communityGalleryName}/securityPostures/{securityPostureName}/versions/{major.minor.patch}|latest
880+
881+
```yaml
882+
Type: System.String
883+
Parameter Sets: SimpleParameterSet
884+
Aliases:
885+
886+
Required: False
887+
Position: Named
888+
Default value: None
889+
Accept pipeline input: True (ByPropertyName)
890+
Accept wildcard characters: False
891+
```
892+
862893
### -SecurityType
863894
Specifies the SecurityType of the virtual machine. It has to be set to any specified value to enable UefiSettings. UefiSettings will not be enabled unless this property is set.
864895

‎src/Compute/Compute/help/New-AzVmssConfig.md

Lines changed: 36 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,9 @@ New-AzVmssConfig [[-Overprovision] <Boolean>] [[-Location] <String>] [-EdgeZone
3232
[-BaseRegularPriorityCount <Int32>] [-RegularPriorityPercentage <Int32>] [-ImageReferenceId <String>]
3333
[-SharedGalleryImageId <String>] [-OSImageScheduledEventEnabled]
3434
[-OSImageScheduledEventNotBeforeTimeoutInMinutes <String>] [-SecurityType <String>] [-EnableVtpm <Boolean>]
35-
[-EnableSecureBoot <Boolean>] [-SkuProfileVmSize <String[]>] [-SkuProfileAllocationStrategy <String>]
36-
[-EnableResilientVMCreate] [-EnableResilientVMDelete] [-DefaultProfile <IAzureContextContainer>]
35+
[-EnableSecureBoot <Boolean>] [-SecurityPostureId <String>] [-SecurityPostureExcludeExtension <String[]>]
36+
[-SkuProfileVmSize <String[]>] [-SkuProfileAllocationStrategy <String>] [-EnableResilientVMCreate]
37+
[-EnableResilientVMDelete] [-DefaultProfile <IAzureContextContainer>]
3738
[-WhatIf] [-Confirm] [<CommonParameters>]
3839
```
3940

@@ -56,9 +57,9 @@ New-AzVmssConfig [[-Overprovision] <Boolean>] [[-Location] <String>] [-EdgeZone
5657
[-AutomaticRepairAction <String>] [-BaseRegularPriorityCount <Int32>] [-RegularPriorityPercentage <Int32>]
5758
[-ImageReferenceId <String>] [-SharedGalleryImageId <String>] [-OSImageScheduledEventEnabled]
5859
[-OSImageScheduledEventNotBeforeTimeoutInMinutes <String>] [-SecurityType <String>] [-EnableVtpm <Boolean>]
59-
[-EnableSecureBoot <Boolean>] [-SkuProfileVmSize <String[]>] [-SkuProfileAllocationStrategy <String>]
60-
[-EnableResilientVMCreate] [-EnableResilientVMDelete] [-DefaultProfile <IAzureContextContainer>]
61-
[-WhatIf] [-Confirm] [<CommonParameters>]
60+
[-EnableSecureBoot <Boolean>] [-SecurityPostureId <String>] [-SecurityPostureExcludeExtension <String[]>]
61+
[-SkuProfileVmSize <String[]>] [-SkuProfileAllocationStrategy <String>] [-EnableResilientVMCreate]
62+
[-EnableResilientVMDelete] [-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
6263
```
6364

6465
## DESCRIPTION
@@ -866,6 +867,36 @@ Accept pipeline input: True (ByPropertyName)
866867
Accept wildcard characters: False
867868
```
868869
870+
### -SecurityPostureExcludeExtension
871+
List of virtual machine extensions to exclude when applying the security posture.
872+
873+
```yaml
874+
Type: System.String[]
875+
Parameter Sets: (All)
876+
Aliases:
877+
878+
Required: False
879+
Position: Named
880+
Default value: None
881+
Accept pipeline input: True (ByPropertyName)
882+
Accept wildcard characters: False
883+
```
884+
885+
### -SecurityPostureId
886+
The security posture reference id in the form of /CommunityGalleries/{communityGalleryName}/securityPostures/{securityPostureName}/versions/{major.minor.patch}|latest
887+
888+
```yaml
889+
Type: System.String
890+
Parameter Sets: (All)
891+
Aliases:
892+
893+
Required: False
894+
Position: Named
895+
Default value: None
896+
Accept pipeline input: True (ByPropertyName)
897+
Accept wildcard characters: False
898+
```
899+
869900
### -SecurityType
870901
Specifies the SecurityType of the virtual machine. It has to be set to any specified value to enable UefiSettings. Default: UefiSettings will not be enabled unless this property is set.
871902

0 commit comments

Comments
 (0)