Skip to content

Commit c9a63e3

Browse files
BethanyZhouBethanyZhou
authored
[KeyVault] Support MHSM Settings (#22525)
* wip * add update-azkeyvaultsetting and help docs * add example for settings * add change log * add live test * fix * fix
1 parent 4884e69 commit c9a63e3

29 files changed

+1064
-16
lines changed

‎src/KeyVault/KeyVault.Test/KeyVault.Test.csproj

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@
1313
<ItemGroup>
1414
<PackageReference Include="Microsoft.Azure.KeyVault" Version="3.0.1" />
1515
<PackageReference Include="Microsoft.Azure.KeyVault.WebKey" Version="3.0.1" />
16-
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="4.0.0-preview.1" />
1716
</ItemGroup>
1817

1918
<ItemGroup>

‎src/KeyVault/KeyVault.Test/LiveTests/KeyVaultDataPlaneLiveTests/TestNetworkRuleSet.ps1

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
Invoke-LiveTestScenario -Name "Create key vault and specifies network rules" -Description "Create key vault and specifies network rules to allow access to the specified IP address" -ScenarioScript `
2+
{
3+
param ($rg)
4+
5+
$rgName = $rg.ResourceGroupName
6+
$vaultName = New-LiveTestResourceName
7+
$vnName = New-LiveTestResourceName
8+
$vaultLocation = "eastus"
9+
$vnLocation = "westus"
10+
$frontendSubnet = New-AzVirtualNetworkSubnetConfig -Name frontendSubnet -AddressPrefix "110.0.1.0/24" -ServiceEndpoint Microsoft.KeyVault
11+
$virtualNetwork = New-AzVirtualNetwork -Name $vnName -ResourceGroupName $rg.ResourceGroupName -Location $vnLocation -AddressPrefix "110.0.0.0/16" -Subnet $frontendSubnet
12+
$myNetworkResId = $virtualNetwork.Subnets[0].Id
13+
$ruleSet = New-AzKeyVaultNetworkRuleSetObject -DefaultAction Allow -Bypass AzureServices -IpAddressRange "110.0.1.0/24" -VirtualNetworkResourceId $myNetworkResId
14+
$keyvault = New-AzKeyVault -VaultName $vaultName -ResourceGroupName $rgName -Location $vaultLocation -NetworkRuleSet $ruleSet
15+
Assert-AreEqual $keyvault.NetworkAcls.DefaultAction Allow
16+
Assert-AreEqual $keyvault.NetworkAcls.Bypass AzureServices
17+
# Assert-AreEqual $keyvault.NetworkAcls.VirtualNetworkResourceIds $myNetworkResId
18+
19+
}

‎src/KeyVault/KeyVault.Test/LiveTests/ManagedHsmDataPlaneLiveTests/TestSetting.ps1

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
Invoke-LiveTestScenario -Name "Get and update key vault setting in a MSHM" -Description "Get and update a key vault setting in a MSHM" -ScenarioScript `
2+
{
3+
param ($rg)
4+
5+
$rgName = $rg.ResourceGroupName
6+
$hsmName = "bezmhsm" + (New-LiveTestRandomName -Option AllNumbers)
7+
$hsmLocation = 'eastus2euap'
8+
$adminId = (Get-AzADUser -StartsWith Beisi).Id
9+
$hsmObject = New-AzKeyVaultManagedHsm -HsmName $hsmName -ResourceGroupName $rgName -Location $hsmLocation -Administrator $adminId
10+
Start-Sleep 1800
11+
New-AzKeyVaultRoleAssignment -HsmName $hsmName -RoleDefinitionName "Managed HSM Crypto User" -ObjectId $adminId
12+
Export-AzKeyVaultSecurityDomain -Certificates "$PSScriptRoot\sd1.cer", "$PSScriptRoot\sd2.cer", "$PSScriptRoot\sd3.cer" -Quorum 2 -OutputPath $PSScriptRoot/sd.ps.json -Name $hsmName
13+
$setting = $hsmObject | Get-AzKeyVaultSetting -Name "AllowKeyManagementOperationsThroughARM"
14+
$updatedSetting= $setting | Update-AzKeyVaultSetting -Value true -PassThru
15+
Assert-AreEqual $updatedSetting.Value "true"
16+
}

‎src/KeyVault/KeyVault.Test/LiveTests/ManagedHsmDataPlaneLiveTests/sd1.cer

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDazCCAlOgAwIBAgIUIUpinRAYmz8hRNFjYhxwI745OiAwDQYJKoZIhvcNAQEL
3+
BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
4+
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMDEwMTkwNjIyMDVaFw0yMTEw
5+
MTkwNjIyMDVaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
6+
HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
7+
AQUAA4IBDwAwggEKAoIBAQDs+KM6KQpgNNhA+ZwIaqV1C2UCOHrcp7IaZv5q9GnV
8+
3vcqXxfzLH10T7H2o4/2VNtIayNuWxV9Kmq6/7MMYL49njecqsoGIIIUmhXr2Mb7
9+
R6i2H6ufUc6w7W/TkSFw+ZhGEDqD2ocJn4FoKGBUY4yppIgBxGk1f/9ehJ1VjQNY
10+
EqrfYjLgO5HL5hZNwwxqm4TUi+ITk+bcQ1412CQuHtfogQLXIoRDOhrcd8q0zCvS
11+
0EXmdm0EU688K1Jc16PW/yTsC+Rxlr7Nx54ItqyQq1fI2au1Hm7dvq3EGDsqWwZ8
12+
flUvOzOSHx+KXHX7Gq+dAVd2ojVcy12wBbMuPApqHpefAgMBAAGjUzBRMB0GA1Ud
13+
DgQWBBQI8DpMP9uV3CeqJUp+Li39skEGpzAfBgNVHSMEGDAWgBQI8DpMP9uV3Ceq
14+
JUp+Li39skEGpzAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCh
15+
2c2R2REuskEc4L/A7FATW7oF7vkfdISUBwmyDjUdVpmJqYWFF58afd4wpj/qkRXa
16+
fbUznmqE7EIbWNjmXscA4uNXLFnPydpYuI7wq2QPkexSOb2isssOoF5E26rYL6UQ
17+
WV3xWVKDr+pNJc92kWm38rK7dMEHodHUOnOVJbwujS82DEYeN/LGFb+tEhJnfYH9
18+
mTvF6qeBiwWvkOhl9/UBBFQ21rEyVHbAE49o3o7a0LuVm6p3l7xMPVbP0QrTLZx7
19+
9XKTo6T/t2B2EV/D68kn9rdRtRJODOcoJD1Rk560Z4jaJocyeFSZ2EdI2UOAXwqN
20+
WM5V+1ufCMHCH6A9YNta
21+
-----END CERTIFICATE-----

‎src/KeyVault/KeyVault.Test/LiveTests/ManagedHsmDataPlaneLiveTests/sd2.cer

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDazCCAlOgAwIBAgIUdhcv4h6Uqh0LhlCrHzMS0HirOzowDQYJKoZIhvcNAQEL
3+
BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
4+
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMDEwMTkwNjIxNDJaFw0yMTEw
5+
MTkwNjIxNDJaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
6+
HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
7+
AQUAA4IBDwAwggEKAoIBAQC9HLiQac3z5yoOtWz3tZzEllri/ngtjLmArEJrBp8F
8+
Lixh//RtrYf3QgYhqiw/KSf0KKjstKpbddM7Vk9MdpGvo7E652Cgxa0grDtE6Tnn
9+
VHbmz+YWt/Uoka5CaXyrf8jmYdOKp10NYG6JKKTb2OZtgBfSADPLFR7h8t0umfAc
10+
w0SUVTNopAonWQ+stypUaW4drwuPhRJvbNtA9l1+XIdLkondaTd7MOrbqRMXa6p1
11+
PDZmwuA/SV9ckJcjt8BR4wJRd0OEFQi/2D+lvzVuhfYh4IjBDwGqI4UwP0TBvu0d
12+
bTYiDULmGT3e+lcaX9S8mR9C9CL38JYyUhnDEw7lNdsRAgMBAAGjUzBRMB0GA1Ud
13+
DgQWBBR75zgU+Tl1ZqmtUKOUwRwPz9vnOTAfBgNVHSMEGDAWgBR75zgU+Tl1Zqmt
14+
UKOUwRwPz9vnOTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQAm
15+
iQcCWThTxFf5hL9MUYv2VoJYXQKyd7Fg99aE1Qq9QjeZtouein99Td5qVp+21ypb
16+
y6KyXELjyf7a8LYl+Odkrx/t9e3onjjFyhEu9HxzlOkXeghJP/r2tFS4cgdkCuzB
17+
Y5itX1VhLgVQAx9vdHCogBdSUAcpPEXD7af8W+EUgMhpfu5pX/JKhpB3GBRKvc5Y
18+
64RAN9GOtjskXzktswpVBN9oQEvH6rHm1VubBHCwURLpgOuBjseqITNDBTZTmHmG
19+
V5M3ia8tTIr84usy/I4vg1AVvtUSdKtn6CmDVcUomxY6I5EoPHaIzwxUQuaJ5PU4
20+
C3HchcURKKyW3KNogqRn
21+
-----END CERTIFICATE-----

‎src/KeyVault/KeyVault.Test/LiveTests/ManagedHsmDataPlaneLiveTests/sd3.cer

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
-----BEGIN CERTIFICATE-----
2+
MIIDazCCAlOgAwIBAgIUFLLPncJi3vW3IxmcFJ94d8EdyKQwDQYJKoZIhvcNAQEL
3+
BQAwRTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
4+
GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDAeFw0yMDEwMTkwNjIxNTRaFw0yMTEw
5+
MTkwNjIxNTRaMEUxCzAJBgNVBAYTAkFVMRMwEQYDVQQIDApTb21lLVN0YXRlMSEw
6+
HwYDVQQKDBhJbnRlcm5ldCBXaWRnaXRzIFB0eSBMdGQwggEiMA0GCSqGSIb3DQEB
7+
AQUAA4IBDwAwggEKAoIBAQCd7IwTwmgOM1UrCHQlxMROCQwr99FShBjWlJepYGFr
8+
JeaY8Cskm4b0odX0SYAXLH4hlmpMhRejf1MJPzBO/k7qUl+iqylbm00e+3HKlINa
9+
ga+1BsM0FN37Ek0UWLv39uxd/O0ys8tnheBXR/2V/dBoenk16n1RVaMkojodcdb4
10+
tvW64t+PgRWEmvj+yUcCSA/ty1KHjb+119gUbxuDHR3AkUlm2RWzzdBCS5HLJXN3
11+
VJqvAclEFC76KALIiHA/tGbI5QKofdYEidruRKmWhuuNv/V/CztXZfg1fPlc5sej
12+
CXG1Sd2CUASo7yWuxP4Li8i6wj3UarR+43CYOtnCULv1AgMBAAGjUzBRMB0GA1Ud
13+
DgQWBBSnQt/wdFqeVMTKt2eoVOcvz5+nLTAfBgNVHSMEGDAWgBSnQt/wdFqeVMTK
14+
t2eoVOcvz5+nLTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQBH
15+
o3AcBaOV2sUe2LxcDiesGwP1BKC0u0gPxJ5CxiM/RfihuvuxmS5OwXBWfc/nwZ5t
16+
4rhYFQRlV9zt0X8tYbIaj6LtTgj18EFe7J4rsZVE4fmj+VSBYqLijcc0zkahYMNJ
17+
Hkh/dZG2S3bJGmZzupn4DhrhD577bAA2N88Gzf0rLnqpgK9pOFdJooZQbHm9Fs7M
18+
Gp9r4TJIdy9ocO6s3a62CRyiry0v6fJkcG5m3LRGxm3a5tkMWsIDdX4+hVOtfPrd
19+
ZExKEt73/wDsHPmNG/RouNIU8mYe+jXK6y1V4xH3xAuwVMK7jDAH0/D7AwM4eCtV
20+
YwxuRqXxRoG6oB1K0FCO
21+
-----END CERTIFICATE-----

‎src/KeyVault/KeyVault.Test/LiveTests/TestLiveScenarios.ps1

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -206,3 +206,6 @@ Invoke-LiveTestScenario -Name "Backup and restore key vault secret" -Description
206206
Assert-AreEqual $vaultName2 $actual.VaultName
207207
Assert-AreEqual $secretName $actual.Name
208208
}
209+
210+
& "$PSScriptRoot\KeyVaultDataPlaneLiveTests\TestNetworkRuleSet.ps1"
211+
# & "$PSScriptRoot\ManagedHsmDataPlaneLiveTests\TestSetting.ps1"

‎src/KeyVault/KeyVault/Az.KeyVault.psd1

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -131,7 +131,8 @@ CmdletsToExport = 'Add-AzKeyVaultCertificate', 'Update-AzKeyVaultCertificate',
131131
'Undo-AzKeyVaultManagedStorageAccountRemoval',
132132
'Add-AzKeyVaultNetworkRule', 'Update-AzKeyVaultNetworkRuleSet',
133133
'Remove-AzKeyVaultNetworkRule', 'Export-AzKeyVaultSecurityDomain',
134-
'Import-AzKeyVaultSecurityDomain'
134+
'Import-AzKeyVaultSecurityDomain',
135+
'Get-AzKeyVaultSetting', 'Update-AzKeyVaultSetting'
135136

136137
# Variables to export from this module
137138
# VariablesToExport = @()

‎src/KeyVault/KeyVault/ChangeLog.md

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,11 @@
1818
- Additional information about change #1
1919
-->
2020
## Upcoming Release
21+
* Supported Setting for Managed HSM: Added `Get-AzKeyVaultSetting` and `Update-AzKeyVaultSetting`.
2122
* Updated Azure.Core to 1.34.0.
2223

2324
## Version 4.10.2
24-
* Bug Fix: Removed depulicated IpRules from `NetworkRuleSet` and `MhsmNetworkRuleSet`. [#22472]
25+
* Bug Fix: Removed duplicated IpRules from `NetworkRuleSet` and `MhsmNetworkRuleSet`. [#22472]
2526

2627
## Version 4.10.1
2728
* Removed maximum number for `IpAddressRange` and `VirtualNetworkResourceId` in `*-AzKeyVaultNetworkRuleSet*` from client side. [#22137]

‎src/KeyVault/KeyVault/Commands/Setting/GetAzKeyVaultSetting.cs

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
using Microsoft.Azure.Commands.KeyVault.Models;
2+
using Microsoft.Azure.Commands.ResourceManager.Common.ArgumentCompleters;
3+
using Microsoft.Azure.Management.Internal.Resources.Utilities.Models;
4+
5+
using System;
6+
using System.Collections.Generic;
7+
using System.Management.Automation;
8+
using System.Text;
9+
10+
namespace Microsoft.Azure.Commands.KeyVault.Commands.Setting
11+
{
12+
[Cmdlet("Get", ResourceManager.Common.AzureRMConstants.AzurePrefix + "KeyVaultSetting", DefaultParameterSetName = GetSettingViaFlattenParameters)]
13+
[OutputType(typeof(PSKeyVaultSetting))]
14+
public class GetAzKeyVaultSetting: KeyVaultCmdletBase
15+
{
16+
#region Parameter Set Names
17+
private const string GetSettingViaFlattenParameters = "GetSettingViaFlattenParameters";
18+
private const string GetSettingViaHsmObject = "GetSettingViaHsmObject";
19+
private const string GetSettingViaHsmId = "GetSettingViaHsmId";
20+
#endregion
21+
22+
#region Input Parameter Definitions
23+
24+
[Parameter(Mandatory = true,
25+
Position = 0,
26+
ParameterSetName = GetSettingViaFlattenParameters,
27+
HelpMessage = "Name of the HSM.")]
28+
[ResourceNameCompleter("Microsoft.KeyVault/managedHSMs", "FakeResourceGroupName")]
29+
[ValidateNotNullOrEmpty]
30+
public string HsmName;
31+
32+
[Parameter(Mandatory = true,
33+
Position = 0,
34+
ParameterSetName = GetSettingViaHsmObject,
35+
ValueFromPipeline = true,
36+
HelpMessage = "Hsm Object.")]
37+
[ValidateNotNullOrEmpty]
38+
public PSManagedHsm HsmObject;
39+
40+
[Parameter(Mandatory = true,
41+
Position = 0,
42+
ParameterSetName = GetSettingViaHsmId,
43+
HelpMessage = "Hsm Resource Id.")]
44+
[ValidateNotNullOrEmpty]
45+
public string HsmId;
46+
47+
[Parameter(Mandatory = false,
48+
Position = 1,
49+
HelpMessage = "Name of the setting.")]
50+
public string Name;
51+
52+
#endregion
53+
54+
public override void ExecuteCmdlet()
55+
{
56+
NormalizeParameterSets();
57+
58+
if (string.IsNullOrEmpty(Name))
59+
{
60+
WriteObject(this.Track2DataClient.GetManagedHsmSettings(HsmName), true);
61+
}
62+
else
63+
{
64+
WriteObject(this.Track2DataClient.GetManagedHsmSetting(HsmName, Name));
65+
}
66+
}
67+
68+
private void NormalizeParameterSets()
69+
{
70+
switch (ParameterSetName)
71+
{
72+
case GetSettingViaHsmId:
73+
var parsedResourceId = new ResourceIdentifier(HsmId);
74+
HsmName = parsedResourceId.ResourceName;
75+
break;
76+
case GetSettingViaHsmObject:
77+
HsmName = HsmObject.VaultName;
78+
break;
79+
}
80+
}
81+
}
82+
}

0 commit comments

Comments
 (0)