Skip to content

Commit 522a4b6

Browse files
mccoypmccoyp
authored
[Key Vault] Update test resource deployment template for policy changes (Azure#39594)
1 parent 81443ef commit 522a4b6

File tree

8 files changed

+194
-330
lines changed

8 files changed

+194
-330
lines changed

‎sdk/keyvault/azure-keyvault-administration/tests/_async_test_case.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,8 @@ def __init__(self, **kwargs) -> None:
1818
playback_sas_token = "fake-sas"
1919

2020
if self.is_live:
21-
self.managed_hsm_url = os.environ.get("AZURE_MANAGEDHSM_URL")
21+
hsm = os.environ.get("AZURE_MANAGEDHSM_URL")
22+
self.managed_hsm_url = hsm if hsm else None
2223
storage_url = os.environ.get("BLOB_STORAGE_URL")
2324
container_name = os.environ.get("BLOB_CONTAINER_NAME")
2425
self.container_uri = f"{storage_url}/{container_name}"

‎sdk/keyvault/azure-keyvault-administration/tests/_test_case.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,8 @@ def __init__(self, **kwargs) -> None:
1919
playback_sas_token = "fake-sas"
2020

2121
if self.is_live:
22-
self.managed_hsm_url = os.environ.get("AZURE_MANAGEDHSM_URL")
22+
hsm = os.environ.get("AZURE_MANAGEDHSM_URL")
23+
self.managed_hsm_url = hsm if hsm else None
2324
storage_url = os.environ.get("BLOB_STORAGE_URL")
2425
container_name = os.environ.get("BLOB_CONTAINER_NAME")
2526
self.container_uri = f"{storage_url}/{container_name}"

‎sdk/keyvault/azure-keyvault-keys/tests/_async_test_case.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,8 @@ def __init__(self, *args, **kwargs):
6363

6464
if self.is_live:
6565
self.vault_url = os.environ["AZURE_KEYVAULT_URL"]
66-
self.managed_hsm_url = os.environ.get("AZURE_MANAGEDHSM_URL")
66+
hsm = os.environ.get("AZURE_MANAGEDHSM_URL")
67+
self.managed_hsm_url = hsm if hsm else None
6768
else:
6869
self.vault_url = vault_playback_url
6970
self.managed_hsm_url = hsm_playback_url

‎sdk/keyvault/azure-keyvault-keys/tests/_test_case.py

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,8 @@ def __init__(self, *args, **kwargs):
6767
if self.is_live:
6868
self.vault_url = os.environ["AZURE_KEYVAULT_URL"]
6969
self.vault_url = self.vault_url.rstrip("/")
70-
self.managed_hsm_url = os.environ.get("AZURE_MANAGEDHSM_URL", None)
70+
hsm = os.environ.get("AZURE_MANAGEDHSM_URL")
71+
self.managed_hsm_url = hsm if hsm else None
7172
if self.managed_hsm_url:
7273
self.managed_hsm_url = self.managed_hsm_url.rstrip("/")
7374
else:

‎sdk/keyvault/test-resources-cleanup.py

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@
2222
if "KEYVAULT_CLIENT_SECRET" not in os.environ:
2323
raise EnvironmentError("Missing a client secret for Key Vault")
2424

25-
hsm_present = "AZURE_MANAGEDHSM_URL" in os.environ
25+
hsm_present = bool(os.environ.get("AZURE_MANAGEDHSM_URL"))
2626

2727
credential = ClientSecretCredential(
2828
tenant_id=os.environ["KEYVAULT_TENANT_ID"],

‎sdk/keyvault/test-resources-post.ps1

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -111,3 +111,7 @@ Log "Creating additional required role assignments for resource access."
111111
New-AzKeyVaultRoleAssignment -HsmName $hsmName -RoleDefinitionName "Managed HSM Crypto Officer" -ObjectID $testApplicationOid
112112
New-AzKeyVaultRoleAssignment -HsmName $hsmName -RoleDefinitionName "Managed HSM Crypto User" -ObjectID $testApplicationOid
113113
Log "Role assignments created for '$testApplicationOid'"
114+
115+
Log "Associating managed identity with managed HSM"
116+
Update-AzKeyVaultManagedHsm -HsmName $hsmName -ResourceGroupName $DeploymentOutputs["KEYVAULT_RESOURCE_GROUP"] -UserAssignedIdentity $DeploymentOutputs["MANAGED_IDENTITY_ID"]
117+
Log "Managed identity associated with managed HSM - backup and restore using managed identity is enabled"

‎sdk/keyvault/test-resources.bicep

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
param hsmLocation string = 'brazilsouth'
2+
3+
param baseName string = resourceGroup().name
4+
param tenantId string = '72f988bf-86f1-41af-91ab-2d7cd011db47'
5+
param testApplicationOid string
6+
param provisionerApplicationOid string
7+
param location string = resourceGroup().location
8+
param enableHsm bool = false
9+
param keyVaultSku string = 'premium'
10+
param attestationImage string = 'keyvault-mock-attestation:latest'
11+
12+
var attestationFarm = '${baseName}farm'
13+
var attestationSite = '${baseName}site'
14+
var attestationImageUri = 'DOCKER|azsdkengsys.azurecr.io/${attestationImage}'
15+
var kvName = baseName
16+
var hsmName = '${baseName}hsm'
17+
var blobContainerName = 'hsmbackups'
18+
var primaryAccountName = '${replace(baseName, '-', '')}prim'
19+
var kvAdminDefinitionId = '00482a5a-887f-4fb3-b363-3b7fe8e74483'
20+
var kvAdminAssignmentName = guid(resourceGroup().id, kvAdminDefinitionId, testApplicationOid)
21+
var encryption = {
22+
services: {
23+
blob: {
24+
enabled: true
25+
}
26+
}
27+
keySource: 'Microsoft.Storage'
28+
}
29+
var networkAcls = {
30+
bypass: 'AzureServices'
31+
virtualNetworkRules: []
32+
ipRules: []
33+
defaultAction: 'Allow'
34+
}
35+
var managedIdentityName = '${baseName}-managedIdentity'
36+
var managedIdentityId = managedIdentity.id
37+
38+
resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = if (enableHsm) {
39+
name: managedIdentityName
40+
location: location
41+
}
42+
43+
resource keyVault 'Microsoft.KeyVault/vaults@2024-04-01-preview' = {
44+
name: kvName
45+
location: location
46+
properties: {
47+
sku: {
48+
family: 'A'
49+
name: keyVaultSku
50+
}
51+
tenantId: tenantId
52+
enabledForDeployment: false
53+
enabledForDiskEncryption: false
54+
enabledForTemplateDeployment: false
55+
enableSoftDelete: true
56+
enableRbacAuthorization: true
57+
softDeleteRetentionInDays: 7
58+
}
59+
}
60+
61+
resource kvRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
62+
name: kvAdminAssignmentName
63+
properties: {
64+
roleDefinitionId: resourceId('Microsoft.Authorization/roleDefinitions', kvAdminDefinitionId)
65+
principalId: testApplicationOid
66+
}
67+
}
68+
69+
resource managedHsm 'Microsoft.KeyVault/managedHSMs@2024-04-01-preview' = if (enableHsm) {
70+
name: hsmName
71+
location: hsmLocation
72+
sku: {
73+
family: 'B'
74+
name: 'Standard_B1'
75+
}
76+
identity: {
77+
type: 'UserAssigned'
78+
userAssignedIdentities: {
79+
'${managedIdentityId}': {}
80+
}
81+
}
82+
properties: {
83+
publicNetworkAccess: 'Enabled'
84+
networkAcls: networkAcls
85+
tenantId: tenantId
86+
initialAdminObjectIds: union([testApplicationOid], [provisionerApplicationOid])
87+
enablePurgeProtection: false
88+
enableSoftDelete: true
89+
softDeleteRetentionInDays: 7
90+
}
91+
}
92+
93+
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-05-01' = {
94+
name: primaryAccountName
95+
location: location
96+
sku: {
97+
name: 'Standard_RAGRS'
98+
}
99+
kind: 'StorageV2'
100+
properties: {
101+
networkAcls: networkAcls
102+
supportsHttpsTrafficOnly: true
103+
encryption: encryption
104+
accessTier: 'Hot'
105+
allowSharedKeyAccess: false
106+
}
107+
}
108+
109+
resource blobService 'Microsoft.Storage/storageAccounts/blobServices@2023-05-01' = {
110+
name: 'default'
111+
properties: {
112+
cors: {
113+
corsRules: []
114+
}
115+
deleteRetentionPolicy: {
116+
enabled: false
117+
}
118+
}
119+
parent: storageAccount
120+
}
121+
122+
resource blobContainer 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-05-01' = {
123+
name: blobContainerName
124+
properties: {
125+
publicAccess: 'None'
126+
}
127+
parent: blobService
128+
}
129+
130+
resource managedIdentityRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = if (enableHsm) {
131+
name: guid(resourceGroup().id, 'StorageBlobContributor', managedIdentityId)
132+
properties: {
133+
roleDefinitionId: subscriptionResourceId(
134+
'Microsoft.Authorization/roleDefinitions',
135+
'ba92f5b4-2d11-453d-a403-e96b0029c9fe'
136+
)
137+
principalId: managedIdentity.properties.principalId
138+
scope: resourceGroup().id
139+
principalType: 'ServicePrincipal'
140+
}
141+
}
142+
143+
resource appServicePlan 'Microsoft.Web/serverfarms@2023-12-01' = {
144+
name: attestationFarm
145+
location: location
146+
kind: 'linux'
147+
sku: {
148+
name: 'B1'
149+
}
150+
properties: {
151+
reserved: true
152+
}
153+
}
154+
155+
resource webApp 'Microsoft.Web/sites@2023-12-01' = {
156+
name: attestationSite
157+
location: location
158+
properties: {
159+
httpsOnly: true
160+
serverFarmId: appServicePlan.id
161+
siteConfig: {
162+
alwaysOn: true
163+
linuxFxVersion: attestationImageUri
164+
appSettings: [
165+
{
166+
name: 'WEBSITES_ENABLE_APP_SERVICE_STORAGE'
167+
value: 'false'
168+
}
169+
]
170+
}
171+
}
172+
}
173+
174+
output AZURE_KEYVAULT_URL string = keyVault.properties.vaultUri
175+
output AZURE_MANAGEDHSM_URL string = (enableHsm) ? managedHsm.properties.hsmUri : ''
176+
output KEYVAULT_SKU string = keyVault.properties.sku.name
177+
output CLIENT_OBJECTID string = testApplicationOid
178+
output BLOB_STORAGE_URL string = storageAccount.properties.primaryEndpoints.blob
179+
output BLOB_CONTAINER_NAME string = blobContainerName
180+
output AZURE_KEYVAULT_ATTESTATION_URL string = 'https://${webApp.properties.defaultHostName}/'
181+
output MANAGED_IDENTITY_CLIENT_ID string = managedIdentityId

0 commit comments

Comments
 (0)