Skip to content

Commit 9b58185

Browse files
author
David Curwin
committed
Soft Delete for AFS
1 parent 5ba4b12 commit 9b58185

7 files changed

+428
-1
lines changed

articles/backup/backup-azure-security-feature-cloud.md

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,11 @@ Concerns about security issues, like malware, ransomware, and intrusion, are inc
1010

1111
One such feature is soft delete. With soft delete, even if a malicious actor deletes a backup (or backup data is accidentally deleted), the backup data is retained for 14 additional days, allowing the recovery of that backup item with no data loss. The additional 14 days retention of backup data in the "soft delete" state don't incur any cost to the customer.
1212

13-
[Soft delete protection for Azure virtual machines](soft-delete-virtual-machines.md) and [Soft delete for SQL server in Azure VM and soft delete for SAP HANA in Azure VM workloads](soft-delete-sql-saphana-in-azure-vm.md) are available to everyone.
13+
Soft delete protection is available for these services:
14+
15+
- [Soft delete for Azure virtual machines](soft-delete-virtual-machines.md)
16+
- [Soft delete for SQL server in Azure VM and soft delete for SAP HANA in Azure VM workloads](soft-delete-sql-saphana-in-azure-vm.md)
17+
- [Soft delete for Azure file shares](soft-delete-afs.md)
1418

1519
This flow chart shows the different steps and states of a backup item when Soft Delete is enabled:
1620

articles/backup/powershell-backup-samples.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,3 +13,5 @@ The following table links to PowerShell script samples that use Azure Backup to
1313
|---|---|
1414
| [Back up an encrypted virtual machine to Azure](./scripts/backup-powershell-sample-backup-encrypted-vm.md) | Back up all data on the encrypted virtual machine.|
1515
| [Find Registered Storage Account](./scripts/backup-powershell-script-find-recovery-services-vault.md) | Find the recovery services vault where the storage account is registered |
16+
| [Disable Soft delete for File Shares in a Storage Account](./scripts/disable-soft-delete-for-file-shares.md) | Disable Soft delete for File Shares in a Storage Account|
17+
| [Undelete accidentally deleted File share](./scripts/backup-powershell-script-undelete-file-share.md) | Undelete accidentally deleted File share |
Lines changed: 207 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,207 @@
1+
---
2+
title: PowerShell Script - Undelete a deleted File share
3+
description: Learn how to use an Azure PowerShell script to undelete an accidentally deleted File share.
4+
ms.topic: sample
5+
ms.date: 02/02/2020
6+
---
7+
8+
# Powershell script to undelete an accidentally deleted File share
9+
10+
This script helps you to undelete a file share, if you deleted it accidentally. The soft delete security feature for file shares provides you the option of undeleting a file share within the 14 days retention period, allowing recovery of all your file share contents, snapshots, and recovery points. To learn more about soft delete, visit this [link](../soft-delete-afs.md).
11+
12+
## Sample script
13+
14+
```powershell
15+
#Import-Module Az.Storage -MinimumVersion 1.7.0 -Scope Local
16+
Param(
17+
[Parameter(Mandatory=$True)][System.String] $ResourceGroupName,
18+
[Parameter(Mandatory=$True)][System.String] $StorageAccountName,
19+
[Parameter(Mandatory=$True)][System.String] $FileShareName,
20+
[Parameter(Mandatory=$True)][System.String] $SubscriptionId,
21+
[Parameter(Mandatory=$False)][System.Boolean] $ListOption,
22+
[Parameter(Mandatory=$False)][System.String] $DeletedShareVersion
23+
)
24+
25+
Function Restore-DeletedFileShare
26+
{
27+
Param(
28+
[Parameter(Mandatory=$True)][Microsoft.WindowsAzure.Commands.Common.Storage.LazyAzureStorageContext] $Context,
29+
[Parameter(Mandatory=$True)][System.String] $FileShareName,
30+
[Parameter(Mandatory=$False)][System.String] $DeletedShareVersion
31+
)
32+
33+
if ([string]::IsNullOrWhiteSpace($FileShareName))
34+
{
35+
Write-Error "Please specify the required input parameter: FileShareName" -ErrorAction Stop
36+
}
37+
38+
$FileShareName = $FileShareName.ToLowerInvariant()
39+
40+
Write-Verbose "Restoring a file share with the name: $FileShareName" -Verbose
41+
42+
43+
Write-Information -MessageData "Started: Creating SASToken to List File Shares" -InformationAction Continue
44+
45+
$listToken = New-AzStorageAccountSASToken -Context $Context -Service File -ResourceType Service -Permission "l" -Protocol HttpsOrHttp -StartTime (Get-Date).AddHours(-1) -ExpiryTime (Get-Date).AddHours(1)
46+
47+
Write-Information -MessageData "Completed: Creating SASToken to List File Shares" -InformationAction Continue
48+
49+
Write-Information -MessageData "Started: Listing File Shares to find the deleted file share" -InformationAction Continue
50+
51+
$listSharesUrl = [string]::Concat($Context.FileEndPoint, "?include=metadata,deleted&comp=list&api-version=2019-10-10&", $listToken.Substring(1))
52+
53+
$listSharesResponse = Invoke-WebRequest $listSharesUrl -Method "GET" -Verbose
54+
55+
if ($listSharesResponse.StatusCode -ne 200)
56+
{
57+
Write-Error "Request to list file shares failed." -ErrorAction Stop
58+
}
59+
60+
Write-Verbose $listSharesResponse.RawContent -Verbose
61+
62+
$listSharesResponseContent = $listSharesResponse.Content.Substring(3)
63+
64+
Write-Information -MessageData "Completed: Listing File Shares to find the deleted file share" -InformationAction Continue
65+
66+
Write-Information -MessageData "Started: Search for a deleted file share with the specified name" -InformationAction Continue
67+
68+
$deletedFileShares = Select-Xml -Content $listSharesResponseContent -XPath "/EnumerationResults/Shares/Share[Deleted=""true"" and Name=""$FileShareName""]"
69+
70+
$matchedCount = 0
71+
$deletedShareVersions = New-Object System.Collections.Generic.List[string]
72+
73+
foreach($share in $deletedFileShares)
74+
{
75+
if($matchedCount -eq 0)
76+
{
77+
Write-Verbose $share.Node.InnerXml -Verbose
78+
79+
Write-Information -MessageData "Completed: Search for a deleted file share with the specified name And Found versions" -InformationAction Continue
80+
}
81+
82+
$shareVer = $share.Node.Item("Version").InnerText
83+
$shareDelTime = $share.Node.Item("Properties").Item("DeletedTime").InnerText
84+
$retDays = $share.Node.Item("Properties").Item("RemainingRetentionDays").InnerText
85+
86+
$deletedShareVersions.Add($share.Node.Item("Version").InnerText)
87+
88+
Write-Information -MessageData "DeletedVersion: $shareVer, DeletedTime: $shareDelTime, RemainingRetentionDays: $retDays" -InformationAction Continue
89+
90+
$matchedCount++
91+
}
92+
93+
if($ListOption -eq $True)
94+
{
95+
return;
96+
}
97+
98+
if ($matchedCount -eq 0)
99+
{
100+
Write-Error "Deleted file share with the specified name was not found." -ErrorAction Stop
101+
}
102+
elseif($matchedCount -eq 1 -and ([string]::IsNullOrWhiteSpace($DeletedShareVersion) -or $deletedShareVersions.Contains($DeletedShareVersion)))
103+
{
104+
$DeletedShareVersion = $deletedShareVersions
105+
}
106+
elseif ($matchedCount -gt 1)
107+
{
108+
if ([string]::IsNullOrWhiteSpace($DeletedShareVersion) -or !$deletedShareVersions.Contains($DeletedShareVersion))
109+
{
110+
Write-Error "More than one share with the specified name was found. Please specify a valid DeletedShareVersion parameter from above possible values." -ErrorAction Stop
111+
}
112+
}
113+
114+
Write-Information -MessageData "Completed: Search for a deleted file share with the specified name And Found version: $DeletedShareVersion" -InformationAction Continue
115+
116+
Write-Information -MessageData "Started: Creating SASToken to Restore File Share" -InformationAction Continue
117+
118+
$restoreToken = New-AzStorageAccountSASToken -Context $Context -Service File -ResourceType Container -Permission "w" -Protocol HttpsOrHttp -StartTime (Get-Date).AddHours(-1) -ExpiryTime (Get-Date).AddHours(1)
119+
120+
Write-Information -MessageData "Completed: Creating SASToken to Restore File Share" -InformationAction Continue
121+
122+
Write-Information -MessageData "Started: Restore File Share" -InformationAction Continue
123+
124+
$restoreShareUrl = [string]::Concat($Context.FileEndPoint, $FileShareName, "?restype=share&comp=undelete&api-version=2019-10-10&", $restoreToken.Substring(1))
125+
126+
$restoreHeaders = @{"x-ms-deleted-share-name" = $FileShareName; "x-ms-deleted-share-version" = $DeletedShareVersion}
127+
128+
$restoreResponse = Invoke-WebRequest $restoreShareUrl -Headers $restoreHeaders -Method "PUT" -Verbose
129+
130+
if ($restoreResponse.StatusCode -ne 201)
131+
{
132+
Write-Error "Request to restore a file share failed." -ErrorAction Stop
133+
}
134+
135+
Write-Verbose $restoreResponse.RawContent -Verbose
136+
137+
Write-Information -MessageData "Completed: Restore File Share" -InformationAction Continue
138+
}
139+
140+
Connect-AzAccount
141+
Select-AzSubscription -Subscription $SubscriptionId
142+
$sa = Get-AzStorageAccount -ResourceGroupName $ResourceGroupName -Name $StorageAccountName
143+
144+
145+
Restore-DeletedFileShare $sa.Context $FileShareName $DeletedShareVersion
146+
```
147+
148+
## How to use the script in different scenarios
149+
150+
### Prerequisites
151+
152+
1. Install the latest Azure PowerShell Az modules from [this link](https://docs.microsoft.com//powershell/azure/install-az-ps?view=azps-3.3.0) before running the script.
153+
2. Keep the following details handy as you will need to pass them as values for different parameters of the script:
154+
155+
* **-SubscriptionId** - ID of the subscription where the file share is present.
156+
* **-ResourceGroupName** - Resource Group of the Storage Account hosting the file share.
157+
* **-StorageAccountName** - Name of the storage account hosting the file share.
158+
* **-FileShareName** - Name of the file share to be undeleted
159+
160+
### Execution steps
161+
162+
1. Save the script above on your machine with a name of your choice. In this example, we saved it as *Undelete.ps1*
163+
2. Run the script according to the scenario that fits your requirements.
164+
165+
#### Scenario 1
166+
167+
There are no multiple deleted versions with the same name as the file share you are trying to undelete.
168+
169+
The following example undeletes the file share *share1* present in storage account *afsshare*.
170+
171+
```powershell
172+
.\UnDelete.ps1 -ResourceGroupName afsshare -StorageAccountName afsshare -SubscriptionId f75d8d8b-6735-4697-82e1-1a7a3ff0d5d4 -FileShareName share1
173+
```
174+
175+
The output should show the message `Completed:Restore File Share`
176+
177+
#### Scenario 2
178+
179+
There are multiple deleted versions with the same name as the fileshare you are trying to undelete.
180+
181+
The following example undeletes a version of the file share *share1*
182+
183+
##### Step 1
184+
185+
Execute the script as follows by providing the file share name.
186+
187+
```PowerShell
188+
.\UnDelete.ps1 -ResourceGroupName afsshare -StorageAccountName afsshare -SubscriptionId f75d8d8b-6735-4697-82e1-1a7a3ff0d5d4 -FileShareName share1
189+
```
190+
191+
```Output
192+
Completed: Search for a deleted file share with the specified name and Found versions
193+
DeletedVersion: 01D5D7F77ACC7864, DeletedTime: Fri, 31 Jan 2020 05:30:33 GMT, RemainingRetentionDays: 14
194+
DeletedVersion: 01D5D7F7A76CAF42, DeletedTime: Fri, 31 Jan 2020 05:31:25 GMT, RemainingRetentionDays: 14
195+
Restore-DeletedFileShare : More than one share with the specified name was found. Please specify a valid DeletedShareVersion parameter from above possible values.
196+
```
197+
198+
##### Step 2
199+
200+
Choose the version from the output of step 1 that you want to undelete and pass it as a value for the **-DeletedShareVersion** parameter.
201+
202+
The following example undeletes the *01D5D7F77ACC7864* version of the *share1* file share.
203+
204+
```powershell
205+
.\UnDelete.ps1 -ResourceGroupName afsshare-StorageAccountName afsshare -SubscriptionId f75d8d8b-6735-4697-82e1-1a7a3ff0d5d4 -FileShareName share1 -DeletedShareVersion 01D5D7F77ACC7864
206+
```
207+
Lines changed: 121 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,121 @@
1+
---
2+
title: Script Sample - Disable Soft delete for File Share
3+
description: Learn how to use a script to disable soft delete for file shares in a storage account.
4+
ms.topic: sample
5+
ms.date: 02/02/2020
6+
---
7+
8+
# Disable soft delete for file shares in a storage account
9+
10+
This document explains the process to disable soft delete for file shares in a storage account.
11+
12+
Follow these steps:
13+
14+
1. Install armclient. To learn how to install it, visit [this link](https://github.com/projectkudu/ARMClient).
15+
16+
2. Save the following two request body files to a folder on your machine.
17+
18+
```json
19+
rqbody-enableSoftDelete.json
20+
21+
{
22+
"properties": {
23+
"shareDeleteRetentionPolicy": {
24+
"enabled":true,
25+
"days": 14
26+
}
27+
},
28+
"cors": {
29+
"corsRules": []
30+
}
31+
}
32+
33+
rqbody-disableSoftDelete.json
34+
35+
{
36+
"properties": {
37+
"shareDeleteRetentionPolicy": {
38+
"enabled":false,
39+
"days": 0
40+
}
41+
},
42+
"cors": {
43+
"corsRules": []
44+
}
45+
}
46+
```
47+
48+
3. Keep your storage account ARM Id handy. For example: `/subscriptions/37aa2d43-d4f5-4322-bae0-6ee11c627f50/resourceGroups/afsshare/providers/Microsoft.Storage/storageAccounts/inquirytest`
49+
50+
4. Sign in using your credentials by running **armclient login**.
51+
52+
5. Get the current soft delete properties of file shares in storage account.
53+
54+
The following GET operation fetches the soft delete properties for file shares in the *inquirytest* account:
55+
56+
```cmd
57+
armclient get /subscriptions/37aa2d43-d4f5-4322-bae0-6ee11c627f50/resourceGroups/afsshare /providers/Microsoft.Storage/storageAccounts/inquirytest/fileServices/default?api-version=2019-04-01
58+
```
59+
60+
```output
61+
{
62+
"id": "/subscriptions/37aa2d43-d4f5-4322-bae0-6ee11c627f50/resourceGroups/Bugbash/providers/Microsoft.Storage/storageAccounts/inquirytest/fileServices/de
63+
fault",
64+
"name": "default",
65+
"type": "Microsoft.Storage/storageAccounts/fileServices",
66+
"properties": {
67+
"cors": {
68+
"corsRules": []
69+
},
70+
"shareDeleteRetentionPolicy": {
71+
"enabled": true,
72+
"days": 14
73+
}
74+
}
75+
}
76+
```
77+
78+
6. Disable Soft Delete for File shares in storage account.
79+
80+
The following PUT operation disables the soft delete properties for file shares in the *inquirytest* account:
81+
82+
```cmd
83+
armclient put /subscriptions/37aa2d43-d4f5-4322-bae0-6ee11c627f50/resourceGroups/afsshare /providers/Microsoft.Storage/storageAccounts/inquirytest/fileServices/default?api-version=2019-04-01 .\rqbody-disableSoftDelete.json
84+
```
85+
86+
```Output
87+
{
88+
"id": "/subscriptions/37aa2d43-d4f5-4322-bae0-6ee11c627f50/resourceGroups/Bugbash/providers/Microsoft.Storage/storageAccounts/inquirytest/fileServices/de
89+
fault",
90+
"name": "default",
91+
"type": "Microsoft.Storage/storageAccounts/fileServices",
92+
"properties": {
93+
"shareDeleteRetentionPolicy": {
94+
"enabled": false,
95+
"days": 0
96+
}
97+
}
98+
}
99+
```
100+
101+
7. If you want to reenable soft delete, use the following sample.
102+
103+
The following PUT operation enables the soft delete properties for file shares in “inquirytest “account.
104+
105+
```cmd
106+
armclient put /subscriptions/37aa2d43-d4f5-4322-bae0-6ee11c627f50/resourceGroups/afsshare /providers/Microsoft.Storage/storageAccounts/inquirytest/fileServices/default?api-version=2019-04-01 .\rqbody-EnableSoftDelete.json
107+
```
108+
109+
```Output
110+
{
111+
"id": "/subscriptions/37aa2d43-d4f5-4322-bae0-6ee11c627f50/resourceGroups/Bugbash/providers/Microsoft.Storage/storageAccounts/inquirytest/fileServices/default",
112+
"name": "default",
113+
"type": "Microsoft.Storage/storageAccounts/fileServices",
114+
"properties": {
115+
"shareDeleteRetentionPolicy": {
116+
"enabled": true,
117+
"days": 14
118+
}
119+
}
120+
}
121+
```

0 commit comments

Comments
 (0)