Skip to content

Commit e51b5ff

Browse files
jmegha123VeryEarly
jmegha123
and
VeryEarly
authored
PS Changes for User Managed Identity (#25632)
* PS Changes for User Managed Identity * update changeLog.md * update changeLog.md * Update ChangeLog.md * updating New-AzNetworkWatcherFlowLog.md file --------- Co-authored-by: Yabo Hu <[email protected]>
1 parent 61d8a7b commit e51b5ff

14 files changed

+10554
-717
lines changed

‎src/Network/Network.Test/ScenarioTests/NetworkWatcherAPITests.cs

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,30 @@ public void TestCRUDVnetFlowLog()
162162
TestRunner.RunTestScript("Test-CRUDVnetFlowLog");
163163
}
164164

165+
[Fact]
166+
[Trait(Category.AcceptanceType, Category.LiveOnly)]
167+
[Trait(Category.Owner, NrpTeamAlias.netanalyticsdev)]
168+
public void TestCRUDVnetFlowLogWithManagedIdentity()
169+
{
170+
TestRunner.RunTestScript("Test-CRUDVnetFlowLogWithManagedIdentity");
171+
}
172+
173+
[Fact]
174+
[Trait(Category.AcceptanceType, Category.LiveOnly)]
175+
[Trait(Category.Owner, NrpTeamAlias.netanalyticsdev)]
176+
public void TestCRUDVnetFlowLogWithNoneManagedIdentity()
177+
{
178+
TestRunner.RunTestScript("Test-CRUDVnetFlowLogWithNoneManagedIdentity");
179+
}
180+
181+
[Fact]
182+
[Trait(Category.AcceptanceType, Category.LiveOnly)]
183+
[Trait(Category.Owner, NrpTeamAlias.netanalyticsdev)]
184+
public void TestSetVnetFlowLogWithManagedIdentityFromNoMIInput()
185+
{
186+
TestRunner.RunTestScript("Test-SetVnetFlowLogWithManagedIdentity");
187+
}
188+
165189
[Fact]
166190
[Trait(Category.AcceptanceType, Category.LiveOnly)]
167191
[Trait(Category.Owner, NrpTeamAlias.netanalyticsdev)]

‎src/Network/Network.Test/ScenarioTests/NetworkWatcherAPITests.ps1

Lines changed: 249 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1036,6 +1036,255 @@ function Test-CRUDVnetFlowLog
10361036
}
10371037
}
10381038

1039+
<#
1040+
.SYNOPSIS
1041+
Test Flow log CRUD API With Managed Identity.
1042+
#>
1043+
function Test-CRUDVnetFlowLogWithManagedIdentity
1044+
{
1045+
# Setup
1046+
$resourceGroupName = Get-NrpResourceGroupName
1047+
$nwName = Get-NrpResourceName
1048+
$nwRgName = Get-NrpResourceGroupName
1049+
$flowLogName = Get-NrpResourceName
1050+
$domainNameLabel = Get-NrpResourceName
1051+
$vnetName = Get-NrpResourceName
1052+
$stoname = Get-NrpResourceName
1053+
$location = Get-ProviderLocation "Microsoft.Network/networkWatchers" "Central US EUAP"
1054+
$identityName = Get-NrpResourceName
1055+
1056+
try
1057+
{
1058+
# Create Resource group
1059+
New-AzResourceGroup -Name $resourceGroupName -Location "$location"
1060+
1061+
# Create the Virtual Network
1062+
$subnet = New-AzVirtualNetworkSubnetConfig -Name "FlowLogSubnet" -AddressPrefix 10.0.0.0/24
1063+
$vnet = New-AzVirtualNetwork -Name $vnetName -ResourceGroupName $resourceGroupName -Location $location -AddressPrefix 10.0.0.0/16 -Subnet $subnet
1064+
$vnet = Get-AzVirtualNetwork -Name $vnetName -ResourceGroupName $resourceGroupName
1065+
1066+
# Create Resource group for Network Watcher
1067+
New-AzResourceGroup -Name $nwRgName -Location "$location"
1068+
1069+
# Get Network Watcher
1070+
$nw = Get-CreateTestNetworkWatcher -location $location -nwName $nwName -nwRgName $nwRgName
1071+
1072+
# Create storage
1073+
$stoname = 'sto' + $stoname
1074+
$stotype = 'Standard_GRS'
1075+
1076+
New-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $stoname -Location $location -Type $stotype;
1077+
$sto = Get-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $stoname;
1078+
1079+
# Create Managed Identity
1080+
$identity = New-AzUserAssignedIdentity -Name $identityName -Location $location -ResourceGroup $resourceGroupName
1081+
1082+
# Create flow log
1083+
$config = New-AzNetworkWatcherFlowLog -NetworkWatcher $nw -Name $flowLogName -TargetResourceId $vnet.Id -StorageId $sto.Id -Enabled $true -UserAssignedIdentity $identity.Id
1084+
1085+
# Validation set operation
1086+
Assert-AreEqual $config.TargetResourceId $vnet.Id
1087+
Assert-AreEqual $config.StorageId $sto.Id
1088+
Assert-AreEqual $config.Enabled $true
1089+
Assert-AreEqual $config.Format.Version 2
1090+
1091+
# Get flow log
1092+
$flowLog = Get-AzNetworkWatcherFlowLog -NetworkWatcher $nw -Name $flowLogName
1093+
1094+
# Get flow log Identity
1095+
$identity01 = $flowLog.Identity
1096+
1097+
# Validation get operation
1098+
Assert-AreEqual $flowLog.TargetResourceId $vnet.Id
1099+
Assert-AreEqual $flowLog.StorageId $sto.Id
1100+
Assert-AreEqual $flowLog.Enabled $true
1101+
Assert-AreEqual $identity01.UserAssignedIdentities.Count 1
1102+
Assert-NotNull $identity01.UserAssignedIdentities.Values[0].PrincipalId
1103+
Assert-NotNull $identity01.UserAssignedIdentities.Values[0].ClientId
1104+
1105+
# Delete flow log
1106+
Remove-AzNetworkWatcherFlowLog -NetworkWatcher $nw -Name $flowLogName
1107+
}
1108+
finally
1109+
{
1110+
# Cleanup
1111+
Clean-ResourceGroup $resourceGroupName
1112+
Clean-ResourceGroup $nwRgName
1113+
}
1114+
}
1115+
1116+
<#
1117+
.SYNOPSIS
1118+
Test Flow log CRUD API With Managed Identity.
1119+
#>
1120+
function Test-CRUDVnetFlowLogWithNoneManagedIdentity
1121+
{
1122+
# Setup
1123+
$resourceGroupName = Get-NrpResourceGroupName
1124+
$nwName = Get-NrpResourceName
1125+
$nwRgName = Get-NrpResourceGroupName
1126+
$flowLogName = Get-NrpResourceName
1127+
$domainNameLabel = Get-NrpResourceName
1128+
$vnetName = Get-NrpResourceName
1129+
$stoname = Get-NrpResourceName
1130+
$location = Get-ProviderLocation "Microsoft.Network/networkWatchers" "Central US EUAP"
1131+
$identityName = Get-NrpResourceName
1132+
1133+
try
1134+
{
1135+
# Create Resource group
1136+
New-AzResourceGroup -Name $resourceGroupName -Location "$location"
1137+
1138+
# Create the Virtual Network
1139+
$subnet = New-AzVirtualNetworkSubnetConfig -Name "FlowLogSubnet" -AddressPrefix 10.0.0.0/24
1140+
$vnet = New-AzVirtualNetwork -Name $vnetName -ResourceGroupName $resourceGroupName -Location $location -AddressPrefix 10.0.0.0/16 -Subnet $subnet
1141+
$vnet = Get-AzVirtualNetwork -Name $vnetName -ResourceGroupName $resourceGroupName
1142+
1143+
# Create Resource group for Network Watcher
1144+
New-AzResourceGroup -Name $nwRgName -Location "$location"
1145+
1146+
# Get Network Watcher
1147+
$nw = Get-CreateTestNetworkWatcher -location $location -nwName $nwName -nwRgName $nwRgName
1148+
1149+
# Create storage
1150+
$stoname = 'sto' + $stoname
1151+
$stotype = 'Standard_GRS'
1152+
1153+
New-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $stoname -Location $location -Type $stotype;
1154+
$sto = Get-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $stoname;
1155+
1156+
# Create Managed Identity
1157+
$identity = New-AzUserAssignedIdentity -Name $identityName -Location $location -ResourceGroup $resourceGroupName
1158+
1159+
# Create flow log
1160+
$config = New-AzNetworkWatcherFlowLog -NetworkWatcher $nw -Name $flowLogName -TargetResourceId $vnet.Id -StorageId $sto.Id -Enabled $true -UserAssignedIdentity $identity.Id
1161+
1162+
# Validation set operation
1163+
Assert-AreEqual $config.TargetResourceId $vnet.Id
1164+
Assert-AreEqual $config.StorageId $sto.Id
1165+
Assert-AreEqual $config.Enabled $true
1166+
Assert-AreEqual $config.Format.Version 2
1167+
1168+
# Get flow log
1169+
$flowLog = Get-AzNetworkWatcherFlowLog -NetworkWatcher $nw -Name $flowLogName
1170+
1171+
# Get flow log Identity
1172+
$identity01 = $flowLog.Identity
1173+
1174+
# Validation get operation
1175+
Assert-AreEqual $flowLog.TargetResourceId $vnet.Id
1176+
Assert-AreEqual $flowLog.StorageId $sto.Id
1177+
Assert-AreEqual $flowLog.Enabled $true
1178+
Assert-AreEqual $identity01.UserAssignedIdentities.Count 1
1179+
Assert-NotNull $identity01.UserAssignedIdentities.Values[0].PrincipalId
1180+
Assert-NotNull $identity01.UserAssignedIdentities.Values[0].ClientId
1181+
1182+
Set-AzNetworkWatcherFlowLog -InputObject $flowLog -UserAssignedIdentity "None" -Force
1183+
1184+
# Get flow log
1185+
$updatedFlowLog = Get-AzNetworkWatcherFlowLog -NetworkWatcher $nw -Name $flowLogName
1186+
1187+
# Get flow log Identity
1188+
$identity01 = $updatedFlowLog.Identity
1189+
1190+
Assert-AreEqual $identity01.UserAssignedIdentities.Count 0
1191+
Assert-Null $identity01.UserAssignedIdentities.Values[0].PrincipalId
1192+
Assert-Null $identity01.UserAssignedIdentities.Values[0].ClientId
1193+
1194+
# Delete flow log
1195+
Remove-AzNetworkWatcherFlowLog -NetworkWatcher $nw -Name $flowLogName
1196+
}
1197+
finally
1198+
{
1199+
# Cleanup
1200+
Clean-ResourceGroup $resourceGroupName
1201+
Clean-ResourceGroup $nwRgName
1202+
}
1203+
}
1204+
1205+
<#
1206+
.SYNOPSIS
1207+
Test Flow log CRUD API With Managed Identity.
1208+
#>
1209+
function Test-SetVnetFlowLogWithManagedIdentity
1210+
{
1211+
# Setup
1212+
$resourceGroupName = Get-NrpResourceGroupName
1213+
$nwName = Get-NrpResourceName
1214+
$nwRgName = Get-NrpResourceGroupName
1215+
$flowLogName = Get-NrpResourceName
1216+
$domainNameLabel = Get-NrpResourceName
1217+
$vnetName = Get-NrpResourceName
1218+
$stoname = Get-NrpResourceName
1219+
$location = Get-ProviderLocation "Microsoft.Network/networkWatchers" "Central US EUAP"
1220+
$identityName = Get-NrpResourceName
1221+
1222+
try
1223+
{
1224+
# Create Resource group
1225+
New-AzResourceGroup -Name $resourceGroupName -Location "$location"
1226+
1227+
# Create the Virtual Network
1228+
$subnet = New-AzVirtualNetworkSubnetConfig -Name "FlowLogSubnet" -AddressPrefix 10.0.0.0/24
1229+
$vnet = New-AzVirtualNetwork -Name $vnetName -ResourceGroupName $resourceGroupName -Location $location -AddressPrefix 10.0.0.0/16 -Subnet $subnet
1230+
$vnet = Get-AzVirtualNetwork -Name $vnetName -ResourceGroupName $resourceGroupName
1231+
1232+
# Create Resource group for Network Watcher
1233+
New-AzResourceGroup -Name $nwRgName -Location "$location"
1234+
1235+
# Get Network Watcher
1236+
$nw = Get-CreateTestNetworkWatcher -location $location -nwName $nwName -nwRgName $nwRgName
1237+
1238+
# Create storage
1239+
$stoname = 'sto' + $stoname
1240+
$stotype = 'Standard_GRS'
1241+
1242+
New-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $stoname -Location $location -Type $stotype;
1243+
$sto = Get-AzStorageAccount -ResourceGroupName $resourceGroupName -Name $stoname;
1244+
1245+
# Create flow log
1246+
$config = New-AzNetworkWatcherFlowLog -NetworkWatcher $nw -Name $flowLogName -TargetResourceId $vnet.Id -StorageId $sto.Id -Enabled $true
1247+
1248+
# Validation set operation
1249+
Assert-AreEqual $config.TargetResourceId $vnet.Id
1250+
Assert-AreEqual $config.StorageId $sto.Id
1251+
Assert-AreEqual $config.Enabled $true
1252+
Assert-AreEqual $config.Format.Version 2
1253+
1254+
# Get flow log
1255+
$flowLog = Get-AzNetworkWatcherFlowLog -NetworkWatcher $nw -Name $flowLogName
1256+
1257+
# Create Managed Identity
1258+
$identity = New-AzUserAssignedIdentity -Name $identityName -Location $location -ResourceGroup $resourceGroupName
1259+
1260+
# Set flow log with Managed Identity
1261+
Set-AzNetworkWatcherFlowLog -InputObject $flowLog -UserAssignedIdentity $identity.id -Force
1262+
1263+
# Get updated flowLog
1264+
$updatedFlowLog = Get-AzNetworkWatcherFlowLog -NetworkWatcher $nw -Name $flowLogName
1265+
1266+
# Get updated flow log Identity
1267+
$identity01 = $updatedFlowLog.Identity
1268+
1269+
# Validation get operation
1270+
Assert-AreEqual $updatedFlowLog.TargetResourceId $vnet.Id
1271+
Assert-AreEqual $updatedFlowLog.StorageId $sto.Id
1272+
Assert-AreEqual $updatedFlowLog.Enabled $true
1273+
Assert-AreEqual $identity01.UserAssignedIdentities.Count 1
1274+
Assert-NotNull $identity01.UserAssignedIdentities.Values[0].PrincipalId
1275+
Assert-NotNull $identity01.UserAssignedIdentities.Values[0].ClientId
1276+
1277+
# Delete flow log
1278+
Remove-AzNetworkWatcherFlowLog -NetworkWatcher $nw -Name $flowLogName
1279+
}
1280+
finally
1281+
{
1282+
# Cleanup
1283+
Clean-ResourceGroup $resourceGroupName
1284+
Clean-ResourceGroup $nwRgName
1285+
}
1286+
}
1287+
10391288
<#
10401289
.SYNOPSIS
10411290
Test Flow log CRUD API.

‎src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.NetworkWatcherAPITests/TestCRUDVnetFlowLogWithManagedIdentity.json

Lines changed: 2617 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.NetworkWatcherAPITests/TestCRUDVnetFlowLogWithNoneManagedIdentity.json

Lines changed: 3049 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.NetworkWatcherAPITests/TestSetVnetFlowLogWithManagedIdentityFromNoMIInput.json

Lines changed: 3238 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Network/Network/ChangeLog.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
--->
2020

2121
## Upcoming Release
22+
* Added support of `UserAssignedIdentityId` Property in `New-AzNetworkWatcherFlowLog` and `Set-AzNetworkWatcherFlowLog` commands
2223

2324
## Version 7.8.0
2425
* Added new cmdlets to support Save & Commit (AzureFirewallPolicy draft)

‎src/Network/Network/Models/PSFlowLogResource.cs

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,9 @@ public class PSFlowLogResource : PSTopLevelResource
3434
[Ps1Xml(Target = ViewControl.Table)]
3535
public bool? Enabled { get; set; }
3636

37+
[Ps1Xml(Target = ViewControl.Table)]
38+
public PSManagedServiceIdentity Identity { get; set; }
39+
3740
public PSRetentionPolicyParameters RetentionPolicy { get; set; }
3841

3942
public PSFlowLogFormatParameters Format { get; set; }
@@ -52,6 +55,12 @@ public string FormatText
5255
get { return JsonConvert.SerializeObject(this.Format, Formatting.Indented, new JsonSerializerSettings() { NullValueHandling = NullValueHandling.Ignore }); }
5356
}
5457

58+
[JsonIgnore]
59+
public string IdentityText
60+
{
61+
get { return JsonConvert.SerializeObject(Identity, Formatting.Indented, new JsonSerializerSettings() { NullValueHandling = NullValueHandling.Ignore }); }
62+
}
63+
5564
[JsonIgnore]
5665
public string FlowAnalyticsConfigurationText
5766
{

‎src/Network/Network/NetworkWatcher/FlowLog/FlowLogBaseCmdlet.cs

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,7 @@ public bool IsFlowLogPresent(string resourceGroupName, string name, string flowL
4949

5050
public bool IsValidResourceId(ResourceIdentifier id, string expectedResourceType, bool validateParent = false, string expectedParentType = null)
5151
{
52-
if (id == null || string.IsNullOrEmpty(id.ResourceName) || string.IsNullOrEmpty(id.ResourceGroupName) || string.IsNullOrEmpty(id.Subscription)
52+
if (id == null || string.IsNullOrEmpty(id.ResourceName) || string.IsNullOrEmpty(id.ResourceGroupName) || string.IsNullOrEmpty(id.Subscription)
5353
|| !string.Equals(id.ResourceType, expectedResourceType, StringComparison.OrdinalIgnoreCase))
5454
{
5555
return false;
@@ -73,7 +73,7 @@ public bool IsValidResourceId(ResourceIdentifier id, string expectedResourceType
7373
}
7474

7575
public void ValidateFlowLogParameters(string targetResourceId, string storageId, int? formatVersion, string formatType,
76-
bool enableTrafficAnalytics, string trafficAnalyticsWorkspaceId, int? trafficAnalyticsInterval, int? retentionPolicyDays)
76+
bool enableTrafficAnalytics, string trafficAnalyticsWorkspaceId, int? trafficAnalyticsInterval, int? retentionPolicyDays, string userAssignedIdentityId)
7777
{
7878
ResourceIdentifier targetResourceInfo = new ResourceIdentifier(targetResourceId);
7979
if (!this.IsValidResourceId(targetResourceInfo, "Microsoft.Network/networkSecurityGroups") &&
@@ -95,7 +95,7 @@ public void ValidateFlowLogParameters(string targetResourceId, string storageId,
9595
throw new PSArgumentException(Properties.Resources.InvalidFlowLogFormatVersion);
9696
}
9797

98-
if (!string.IsNullOrEmpty(formatType) && !string.Equals(formatType, "JSON", StringComparison.OrdinalIgnoreCase))
98+
if (!string.IsNullOrEmpty(formatType) && (!string.Equals(formatType, "JSON", StringComparison.OrdinalIgnoreCase) && !string.Equals(formatType, "FlowLogJSON", StringComparison.OrdinalIgnoreCase)))
9999
{
100100
throw new PSArgumentException(Properties.Resources.InvalidFlowLogFormatVersion);
101101
}
@@ -123,6 +123,15 @@ public void ValidateFlowLogParameters(string targetResourceId, string storageId,
123123
{
124124
throw new PSArgumentException(Properties.Resources.InvalidTrafficAnalyticsInterval);
125125
}
126+
127+
if (userAssignedIdentityId != null && !string.Equals(userAssignedIdentityId, "none", StringComparison.OrdinalIgnoreCase))
128+
{
129+
ResourceIdentifier userAssignedIdentityInfo = new ResourceIdentifier(userAssignedIdentityId);
130+
if (!this.IsValidResourceId(userAssignedIdentityInfo, "Microsoft.ManagedIdentity/userAssignedIdentities"))
131+
{
132+
throw new PSArgumentException(Properties.Resources.InvalidUserAssignedManagedIdentity);
133+
}
134+
}
126135
}
127136
}
128137
}

0 commit comments

Comments
 (0)