Skip to content

Commit ffedcad

Browse files
bluewwblueww
authored
[Storage] Support Storage Account saspolicy new properties SasExpirationAction (#27908)
1 parent 573e4d9 commit ffedcad

File tree

7 files changed

+2734
-340
lines changed

7 files changed

+2734
-340
lines changed

‎src/Storage/Storage.Management.Test/ScenarioTests/StorageAccountTests.ps1‎

Lines changed: 72 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1692,6 +1692,7 @@ function Test-AzureStorageAccountKeySASPolicy
16921692
{
16931693
# Test
16941694
$stoname = 'sto' + $rgname;
1695+
$stoname2 = 'sto2' + $rgname;
16951696
$stotype = 'Standard_LRS';
16961697
$loc = Get-ProviderLocation ResourceManagement;
16971698
$kind = 'StorageV2'
@@ -1701,7 +1702,7 @@ function Test-AzureStorageAccountKeySASPolicy
17011702
New-AzResourceGroup -Name $rgname -Location $loc;
17021703
Write-Output ("Resource Group created")
17031704

1704-
# new account
1705+
# new account, default SasExpirationAction is Log
17051706
New-AzStorageAccount -ResourceGroupName $rgname -Name $stoname -Location $loc -SkuName $stotype -KeyExpirationPeriodInDay $keyExpirationPeriodInDay -SasExpirationPeriod $sasExpirationPeriod
17061707

17071708
Retry-IfException { $global:sto = Get-AzStorageAccount -ResourceGroupName $rgname -Name $stoname; }
@@ -1711,21 +1712,88 @@ function Test-AzureStorageAccountKeySASPolicy
17111712
Assert-AreEqual $kind $sto.Kind;
17121713
Assert-AreEqual $keyExpirationPeriodInDay $sto.KeyPolicy.KeyExpirationPeriodInDays;
17131714
Assert-AreEqual $sasExpirationPeriod $sto.SasPolicy.SasExpirationPeriod;
1715+
Assert-AreEqual "Log" $sto.SasPolicy.ExpirationAction;
17141716
Assert-NotNull $sto.KeyCreationTime.Key1
17151717
Assert-NotNull $sto.KeyCreationTime.Key2
17161718

1717-
# update account
1719+
# update account, not set SasExpirationAction, should keep orignal value Log
17181720
$keyExpirationPeriodInDay = 3
1719-
$sasExpirationPeriod = "50.00:00:00"
1721+
$sasExpirationPeriod = "50.00:00:12"
17201722
Set-AzStorageAccount -ResourceGroupName $rgname -Name $stoname -KeyExpirationPeriodInDay $keyExpirationPeriodInDay -SasExpirationPeriod $sasExpirationPeriod -EnableHttpsTrafficOnly $true
17211723

17221724
Retry-IfException { $global:sto = Get-AzStorageAccount -ResourceGroupName $rgname -Name $stoname; }
17231725
Assert-AreEqual $keyExpirationPeriodInDay $sto.KeyPolicy.KeyExpirationPeriodInDays;
17241726
Assert-AreEqual $sasExpirationPeriod $sto.SasPolicy.SasExpirationPeriod;
1727+
Assert-AreEqual "Log" $sto.SasPolicy.ExpirationAction;
17251728
Assert-NotNull $sto.KeyCreationTime.Key1
17261729
Assert-NotNull $sto.KeyCreationTime.Key2
17271730

1728-
Remove-AzStorageAccount -Force -ResourceGroupName $rgname -Name $stoname;
1731+
# update account, set SasExpirationAction to Block
1732+
$sasExpirationPeriod = "5.00:00:00"
1733+
Set-AzStorageAccount -ResourceGroupName $rgname -Name $stoname -SasExpirationPeriod $sasExpirationPeriod -SasExpirationAction Block
1734+
1735+
Retry-IfException { $global:sto = Get-AzStorageAccount -ResourceGroupName $rgname -Name $stoname; }
1736+
Assert-AreEqual $sasExpirationPeriod $sto.SasPolicy.SasExpirationPeriod;
1737+
Assert-AreEqual "Block" $sto.SasPolicy.ExpirationAction;
1738+
1739+
# update account, not set SasExpirationAction, should keep orignal value Block
1740+
$sasExpirationPeriod = "3.12:00:00"
1741+
Set-AzStorageAccount -ResourceGroupName $rgname -Name $stoname -SasExpirationPeriod $sasExpirationPeriod
1742+
1743+
Retry-IfException { $global:sto = Get-AzStorageAccount -ResourceGroupName $rgname -Name $stoname; }
1744+
Assert-AreEqual $sasExpirationPeriod $sto.SasPolicy.SasExpirationPeriod;
1745+
Assert-AreEqual "Block" $sto.SasPolicy.ExpirationAction;
1746+
1747+
# update account, set SasExpirationAction to Log
1748+
$sasExpirationPeriod = "4.00:12:00"
1749+
Set-AzStorageAccount -ResourceGroupName $rgname -Name $stoname -SasExpirationPeriod $sasExpirationPeriod -SasExpirationAction Log
1750+
1751+
Retry-IfException { $global:sto = Get-AzStorageAccount -ResourceGroupName $rgname -Name $stoname; }
1752+
Assert-AreEqual $sasExpirationPeriod $sto.SasPolicy.SasExpirationPeriod;
1753+
Assert-AreEqual "Log" $sto.SasPolicy.ExpirationAction;
1754+
1755+
# update account, disable sas policy
1756+
$sasExpirationPeriod = "0.00:00:00"
1757+
Set-AzStorageAccount -ResourceGroupName $rgname -Name $stoname -SasExpirationPeriod $sasExpirationPeriod
1758+
1759+
Retry-IfException { $global:sto = Get-AzStorageAccount -ResourceGroupName $rgname -Name $stoname; }
1760+
Assert-Null $sto.SasPolicy
1761+
1762+
# update account, enable sas policy with Block
1763+
$sasExpirationPeriod = "5.00:00:13"
1764+
Set-AzStorageAccount -ResourceGroupName $rgname -Name $stoname -SasExpirationPeriod $sasExpirationPeriod -SasExpirationAction Block
1765+
1766+
Retry-IfException { $global:sto = Get-AzStorageAccount -ResourceGroupName $rgname -Name $stoname; }
1767+
Assert-AreEqual $sasExpirationPeriod $sto.SasPolicy.SasExpirationPeriod;
1768+
Assert-AreEqual "Block" $sto.SasPolicy.ExpirationAction;
1769+
1770+
# update account, disable sas policy, then enable sas policy with only SasExpirationPeriod, should have default action as log
1771+
$sasExpirationPeriod = "0.00:00:00"
1772+
Set-AzStorageAccount -ResourceGroupName $rgname -Name $stoname -SasExpirationPeriod $sasExpirationPeriod
1773+
1774+
$sasExpirationPeriod = "5.11:12:13"
1775+
Set-AzStorageAccount -ResourceGroupName $rgname -Name $stoname -SasExpirationPeriod $sasExpirationPeriod
1776+
1777+
Retry-IfException { $global:sto = Get-AzStorageAccount -ResourceGroupName $rgname -Name $stoname; }
1778+
Assert-AreEqual $sasExpirationPeriod $sto.SasPolicy.SasExpirationPeriod;
1779+
Assert-AreEqual "Log" $sto.SasPolicy.ExpirationAction;
1780+
1781+
# remove account
1782+
Remove-AzStorageAccount -Force -ResourceGroupName $rgname -Name $stoname;
1783+
1784+
# new account2, with SasExpirationAction Block
1785+
New-AzStorageAccount -ResourceGroupName $rgname -Name $stoname2 -Location $loc -SkuName $stotype -SasExpirationAction Block -SasExpirationPeriod $sasExpirationPeriod
1786+
1787+
Retry-IfException { $global:sto = Get-AzStorageAccount -ResourceGroupName $rgname -Name $stoname2; }
1788+
Assert-AreEqual $stoname2 $sto.StorageAccountName;
1789+
Assert-AreEqual $stotype $sto.Sku.Name;
1790+
Assert-AreEqual $loc.ToLower().Replace(" ", "") $sto.Location;
1791+
Assert-AreEqual $kind $sto.Kind;
1792+
Assert-AreEqual $sasExpirationPeriod $sto.SasPolicy.SasExpirationPeriod;
1793+
Assert-AreEqual "Block" $sto.SasPolicy.ExpirationAction;
1794+
1795+
# remove account 2
1796+
Remove-AzStorageAccount -Force -ResourceGroupName $rgname -Name $stoname2;
17291797
}
17301798
finally
17311799
{

‎src/Storage/Storage.Management.Test/SessionRecords/Microsoft.Azure.Commands.Management.Storage.Test.ScenarioTests.StorageAccountTests/TestAzureStorageAccountKeySASPolicy.json‎

Lines changed: 2523 additions & 294 deletions
Large diffs are not rendered by default.

‎src/Storage/Storage.Management/ChangeLog.md‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,9 @@
1818
- Additional information about change #1
1919
-->
2020
## Upcoming Release
21+
* Supported set SasExpirationAction as Log or Block, together with SasExpirationPeriod
22+
- `New-AzStorageAccount`
23+
- `Set-AzStorageAccount`
2124

2225
## Version 9.0.0
2326
* Removed MD5 from blob and file upload in some scenarios

‎src/Storage/Storage.Management/StorageAccount/NewAzureStorageAccount.cs‎

Lines changed: 29 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -466,6 +466,12 @@ public TimeSpan SasExpirationPeriod
466466
}
467467
private TimeSpan? sasExpirationPeriod = null;
468468

469+
[Parameter(Mandatory = false, HelpMessage = "The action to be performed when SasExpirationPeriod is violated. The 'Log' action can be used for audit purposes and the 'Block' action can be used to block and deny the usage of SAS tokens that do not adhere to the sas policy expiration period. The default value is 'Log'.")]
470+
[PSArgumentCompleter("Log", "Block")]
471+
[PSDefaultValue(Help = "Log", Value = StorageModels.ExpirationAction.Log)]
472+
[ValidateNotNullOrEmpty]
473+
public string SasExpirationAction { get; set; }
474+
469475
[Parameter(Mandatory = false, HelpMessage = "The Key expiration period of this account, it is accurate to days.")]
470476
public int KeyExpirationPeriodInDay
471477
{
@@ -863,10 +869,31 @@ public override void ExecuteCmdlet()
863869
Name = this.EdgeZone
864870
};
865871
}
866-
if (sasExpirationPeriod != null)
872+
if (sasExpirationPeriod != null || SasExpirationAction != null)
867873
{
868-
createParameters.SasPolicy = new SasPolicy(sasExpirationPeriod.Value.ToString(@"d\.hh\:mm\:ss"), "Log");
874+
if (sasExpirationPeriod == null && SasExpirationAction != null)
875+
{
876+
throw new ArgumentException("-SasExpirationAction can only be specified together with -SasExpirationPeriod.", "SasExpirationAction");
877+
}
878+
// Set the default action to Log to be aligned as before PSH release.
879+
if (SasExpirationAction == null)
880+
{
881+
SasExpirationAction = "Log";
882+
}
883+
else
884+
{
885+
if (String.Equals(SasExpirationAction, ExpirationAction.Log, StringComparison.OrdinalIgnoreCase))
886+
{
887+
SasExpirationAction = ExpirationAction.Log;
888+
}
889+
else if (String.Equals(SasExpirationAction, ExpirationAction.Block, StringComparison.OrdinalIgnoreCase))
890+
{
891+
SasExpirationAction = ExpirationAction.Block;
892+
}
893+
}
894+
createParameters.SasPolicy = new SasPolicy(sasExpirationPeriod.Value.ToString(@"d\.hh\:mm\:ss"), SasExpirationAction);
869895
}
896+
870897
if (keyExpirationPeriodInDay != null)
871898
{
872899
createParameters.KeyPolicy = new KeyPolicy(keyExpirationPeriodInDay.Value);

‎src/Storage/Storage.Management/StorageAccount/SetAzureStorageAccount.cs‎

Lines changed: 31 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -470,6 +470,12 @@ public TimeSpan SasExpirationPeriod
470470
}
471471
private TimeSpan? sasExpirationPeriod = null;
472472

473+
[Parameter(Mandatory = false, HelpMessage = "The action to be performed when SasExpirationPeriod is violated. The 'Log' action can be used for audit purposes and the 'Block' action can be used to block and deny the usage of SAS tokens that do not adhere to the sas policy expiration period.")]
474+
[PSArgumentCompleter("Log", "Block")]
475+
[ValidateNotNullOrEmpty]
476+
public string SasExpirationAction { get; set; }
477+
478+
473479
[Parameter(Mandatory = false, HelpMessage = "The Key expiration period of this account, it is accurate to days.")]
474480
public int KeyExpirationPeriodInDay
475481
{
@@ -883,10 +889,33 @@ public override void ExecuteCmdlet()
883889
{
884890
updateParameters.AllowSharedKeyAccess = allowSharedKeyAccess;
885891
}
886-
if (sasExpirationPeriod != null)
892+
if (sasExpirationPeriod != null || SasExpirationAction != null)
887893
{
888-
updateParameters.SasPolicy = new SasPolicy(sasExpirationPeriod.Value.ToString(@"d\.hh\:mm\:ss"), "Log");
894+
if (sasExpirationPeriod == null && SasExpirationAction != null)
895+
{
896+
throw new ArgumentException("-SasExpirationAction can only be specified together with -SasExpirationPeriod.", "SasExpirationAction");
897+
}
898+
// If user not set action, and the account not already has the action value, Set the default action to Log to be aligned as before PSH release.
899+
if (SasExpirationAction == null)
900+
{
901+
SasExpirationAction = (this.OriginStorageAccountProperties.SasPolicy != null && this.OriginStorageAccountProperties.SasPolicy.ExpirationAction != null)
902+
? this.OriginStorageAccountProperties.SasPolicy.ExpirationAction
903+
: ExpirationAction.Log;
904+
}
905+
else
906+
{
907+
if (String.Equals(SasExpirationAction, ExpirationAction.Log, StringComparison.OrdinalIgnoreCase))
908+
{
909+
SasExpirationAction = ExpirationAction.Log;
910+
}
911+
else if (String.Equals(SasExpirationAction, ExpirationAction.Block, StringComparison.OrdinalIgnoreCase))
912+
{
913+
SasExpirationAction = ExpirationAction.Block;
914+
}
915+
}
916+
updateParameters.SasPolicy = new SasPolicy(sasExpirationPeriod.Value.ToString(@"d\.hh\:mm\:ss"), SasExpirationAction);
889917
}
918+
890919
if (keyExpirationPeriodInDay != null)
891920
{
892921
updateParameters.KeyPolicy = new KeyPolicy(keyExpirationPeriodInDay.Value);

‎src/Storage/Storage.Management/help/New-AzStorageAccount.md‎

Lines changed: 40 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -24,12 +24,12 @@ New-AzStorageAccount [-ResourceGroupName] <String> [-Name] <String> [-SkuName] <
2424
[-EnableAzureActiveDirectoryDomainServicesForFile <Boolean>] [-EnableLargeFileShare]
2525
[-PublishMicrosoftEndpoint <Boolean>] [-PublishInternetEndpoint <Boolean>] [-AsJob]
2626
[-EncryptionKeyTypeForTable <String>] [-EncryptionKeyTypeForQueue <String>] [-RequireInfrastructureEncryption]
27-
[-SasExpirationPeriod <TimeSpan>] [-KeyExpirationPeriodInDay <Int32>] [-AllowBlobPublicAccess <Boolean>]
28-
[-MinimumTlsVersion <String>] [-AllowSharedKeyAccess <Boolean>] [-EnableNfsV3 <Boolean>]
29-
[-AllowCrossTenantReplication <Boolean>] [-DefaultSharePermission <String>] [-EdgeZone <String>]
30-
[-PublicNetworkAccess <String>] [-EnableAccountLevelImmutability] [-ImmutabilityPeriod <Int32>]
31-
[-ImmutabilityPolicyState <String>] [-AllowedCopyScope <String>] [-DnsEndpointType <String>]
32-
[-DefaultProfile <IAzureContextContainer>] [-RoutingChoice <String>]
27+
[-SasExpirationPeriod <TimeSpan>] [-SasExpirationAction <String>] [-KeyExpirationPeriodInDay <Int32>]
28+
[-AllowBlobPublicAccess <Boolean>] [-MinimumTlsVersion <String>] [-AllowSharedKeyAccess <Boolean>]
29+
[-EnableNfsV3 <Boolean>] [-AllowCrossTenantReplication <Boolean>] [-DefaultSharePermission <String>]
30+
[-EdgeZone <String>] [-PublicNetworkAccess <String>] [-EnableAccountLevelImmutability]
31+
[-ImmutabilityPeriod <Int32>] [-ImmutabilityPolicyState <String>] [-AllowedCopyScope <String>]
32+
[-DnsEndpointType <String>] [-DefaultProfile <IAzureContextContainer>] [-RoutingChoice <String>]
3333
[<CommonParameters>]
3434
```
3535

@@ -45,12 +45,12 @@ New-AzStorageAccount [-ResourceGroupName] <String> [-Name] <String> [-SkuName] <
4545
-EnableAzureActiveDirectoryKerberosForFile <Boolean> [-ActiveDirectoryDomainName <String>]
4646
[-ActiveDirectoryDomainGuid <String>] [-AsJob] [-EncryptionKeyTypeForTable <String>]
4747
[-EncryptionKeyTypeForQueue <String>] [-RequireInfrastructureEncryption] [-SasExpirationPeriod <TimeSpan>]
48-
[-KeyExpirationPeriodInDay <Int32>] [-AllowBlobPublicAccess <Boolean>] [-MinimumTlsVersion <String>]
49-
[-AllowSharedKeyAccess <Boolean>] [-EnableNfsV3 <Boolean>] [-AllowCrossTenantReplication <Boolean>]
50-
[-DefaultSharePermission <String>] [-EdgeZone <String>] [-PublicNetworkAccess <String>]
51-
[-EnableAccountLevelImmutability] [-ImmutabilityPeriod <Int32>] [-ImmutabilityPolicyState <String>]
52-
[-AllowedCopyScope <String>] [-DnsEndpointType <String>] [-DefaultProfile <IAzureContextContainer>]
53-
[-RoutingChoice <String>] [<CommonParameters>]
48+
[-SasExpirationAction <String>] [-KeyExpirationPeriodInDay <Int32>] [-AllowBlobPublicAccess <Boolean>]
49+
[-MinimumTlsVersion <String>] [-AllowSharedKeyAccess <Boolean>] [-EnableNfsV3 <Boolean>]
50+
[-AllowCrossTenantReplication <Boolean>] [-DefaultSharePermission <String>] [-EdgeZone <String>]
51+
[-PublicNetworkAccess <String>] [-EnableAccountLevelImmutability] [-ImmutabilityPeriod <Int32>]
52+
[-ImmutabilityPolicyState <String>] [-AllowedCopyScope <String>] [-DnsEndpointType <String>]
53+
[-DefaultProfile <IAzureContextContainer>] [-RoutingChoice <String>] [<CommonParameters>]
5454
```
5555

5656
### ActiveDirectoryDomainServicesForFile
@@ -68,12 +68,12 @@ New-AzStorageAccount [-ResourceGroupName] <String> [-Name] <String> [-SkuName] <
6868
[-ActiveDirectoryAzureStorageSid <String>] [-ActiveDirectorySamAccountName <String>]
6969
[-ActiveDirectoryAccountType <String>] [-AsJob] [-EncryptionKeyTypeForTable <String>]
7070
[-EncryptionKeyTypeForQueue <String>] [-RequireInfrastructureEncryption] [-SasExpirationPeriod <TimeSpan>]
71-
[-KeyExpirationPeriodInDay <Int32>] [-AllowBlobPublicAccess <Boolean>] [-MinimumTlsVersion <String>]
72-
[-AllowSharedKeyAccess <Boolean>] [-EnableNfsV3 <Boolean>] [-AllowCrossTenantReplication <Boolean>]
73-
[-DefaultSharePermission <String>] [-EdgeZone <String>] [-PublicNetworkAccess <String>]
74-
[-EnableAccountLevelImmutability] [-ImmutabilityPeriod <Int32>] [-ImmutabilityPolicyState <String>]
75-
[-AllowedCopyScope <String>] [-DnsEndpointType <String>] [-DefaultProfile <IAzureContextContainer>]
76-
[-RoutingChoice <String>] [<CommonParameters>]
71+
[-SasExpirationAction <String>] [-KeyExpirationPeriodInDay <Int32>] [-AllowBlobPublicAccess <Boolean>]
72+
[-MinimumTlsVersion <String>] [-AllowSharedKeyAccess <Boolean>] [-EnableNfsV3 <Boolean>]
73+
[-AllowCrossTenantReplication <Boolean>] [-DefaultSharePermission <String>] [-EdgeZone <String>]
74+
[-PublicNetworkAccess <String>] [-EnableAccountLevelImmutability] [-ImmutabilityPeriod <Int32>]
75+
[-ImmutabilityPolicyState <String>] [-AllowedCopyScope <String>] [-DnsEndpointType <String>]
76+
[-DefaultProfile <IAzureContextContainer>] [-RoutingChoice <String>] [<CommonParameters>]
7777
```
7878

7979
## DESCRIPTION
@@ -239,21 +239,24 @@ False
239239

240240
This command creates a Storage account with EdgeZone as "microsoftlosangeles1" and AllowCrossTenantReplication as false, then show the created account related properties.
241241

242-
### Example 12: Create a Storage account with KeyExpirationPeriod and SasExpirationPeriod
242+
### Example 12: Create a Storage account with KeyExpirationPeriod and SasExpirationPeriod with SasExpirationAction
243243
<!-- Skip: Output cannot be splitted from code -->
244244

245245

246246
```powershell
247-
$account = New-AzStorageAccount -ResourceGroupName "myresourcegroup" -Name "mystorageaccount" -SkuName Premium_LRS -Location eastus -KeyExpirationPeriodInDay 5 -SasExpirationPeriod "1.12:05:06"
247+
$account = New-AzStorageAccount -ResourceGroupName "myresourcegroup" -Name "mystorageaccount" -SkuName Premium_LRS -Location eastus -KeyExpirationPeriodInDay 5 -SasExpirationPeriod "1.12:05:06" -SasExpirationAction Block
248248
249249
$account.KeyPolicy.KeyExpirationPeriodInDays
250250
5
251251
252252
$account.SasPolicy.SasExpirationPeriod
253-
1.12:05:06
253+
254+
SasExpirationPeriod ExpirationAction
255+
------------------- ----------------
256+
1.12:05:06 Block
254257
```
255258

256-
This command creates a Storage account with KeyExpirationPeriod and SasExpirationPeriod, then show the created account related properties.
259+
This command creates a Storage account with KeyExpirationPeriod and SasExpirationPeriod with SasExpirationAction, then show the created account related properties.
257260

258261
### Example 12: Create a Storage account with Keyvault encryption (access Keyvault with user assigned identity)
259262
<!-- Skip: Output cannot be splitted from code -->
@@ -1196,6 +1199,21 @@ Accept pipeline input: False
11961199
Accept wildcard characters: False
11971200
```
11981201
1202+
### -SasExpirationAction
1203+
The action to be performed when SasExpirationPeriod is violated. The 'Log' action can be used for audit purposes and the 'Block' action can be used to block and deny the usage of SAS tokens that do not adhere to the sas policy expiration period. The default value is 'Log'.
1204+
1205+
```yaml
1206+
Type: System.String
1207+
Parameter Sets: (All)
1208+
Aliases:
1209+
1210+
Required: False
1211+
Position: Named
1212+
Default value: None
1213+
Accept pipeline input: False
1214+
Accept wildcard characters: False
1215+
```
1216+
11991217
### -SasExpirationPeriod
12001218
The SAS expiration period of this account, it is a timespan and accurate to seconds.
12011219

0 commit comments

Comments
 (0)