Skip to content

Commit 195ab40

Browse files
nivimsftnivimsft
committed
New Cmdlets for Management.Sql that supports Managed instance key and managed instance TDE protector management
1 parent 5c3a092 commit 195ab40

29 files changed

+3071
-15
lines changed

‎src/Sql/Sql.Test/ScenarioTests/ManagedInstanceKeyVaultKeyTests.cs

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.Azure.Commands.ScenarioTest.SqlTests;
16+
using Microsoft.WindowsAzure.Commands.ScenarioTest;
17+
using Xunit;
18+
using Xunit.Abstractions;
19+
20+
namespace Microsoft.Azure.Commands.Sql.Test.ScenarioTests
21+
{
22+
public class ManagedInstanceKeyVaultKeyTests : SqlTestsBase
23+
{
24+
public ManagedInstanceKeyVaultKeyTests(ITestOutputHelper output) : base(output)
25+
{
26+
}
27+
28+
[Fact]
29+
[Trait(Category.AcceptanceType, Category.CheckIn)]
30+
public void TestManagedInstanceKeyVaultKeyCI()
31+
{
32+
RunPowerShellTest("Test-ManagedInstanceKeyVaultKeyCI");
33+
}
34+
35+
[Fact]
36+
[Trait(Category.AcceptanceType, Category.CheckIn)]
37+
public void TestManagedInstanceKeyVaultKey()
38+
{
39+
RunPowerShellTest("Test-ManagedInstanceKeyVaultKey");
40+
}
41+
42+
//Commenting out these tests because automated checks are failing when there
43+
//is [fact] tag even when there is no trait tag
44+
45+
[Fact]
46+
[Trait(Category.AcceptanceType, Category.CheckIn)]
47+
public void TestManagedInstanceKeyVaultKeyInputObject()
48+
{
49+
RunPowerShellTest("Test-ManagedInstanceKeyVaultKeyInputObject");
50+
}
51+
52+
[Fact]
53+
[Trait(Category.AcceptanceType, Category.CheckIn)]
54+
public void TestManagedInstanceKeyVaultKeyResourceId()
55+
{
56+
RunPowerShellTest("Test-ManagedInstanceKeyVaultKeyResourceId");
57+
}
58+
59+
[Fact]
60+
[Trait(Category.AcceptanceType, Category.CheckIn)]
61+
public void TestManagedInstanceKeyVaultKeyPiping()
62+
{
63+
RunPowerShellTest("Test-ManagedInstanceKeyVaultKeyPiping");
64+
}
65+
}
66+
}

‎src/Sql/Sql.Test/ScenarioTests/ManagedInstanceKeyVaultKeyTests.ps1

Lines changed: 164 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,164 @@
1+
# ----------------------------------------------------------------------------------
2+
#
3+
# Copyright Microsoft Corporation
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
# ----------------------------------------------------------------------------------
14+
15+
# A managed instance can be provisioned using instructions here https://docs.microsoft.com/en-us/azure/sql-database/sql-database-managed-instance-get-started
16+
# currently this takes about 2-3 hours
17+
$mangedInstanceRg = "BenjinResourceGroup"
18+
$managedInstanceName = "benjinmitest"
19+
$keyVaultName = "mitest-eus-doNotDelete"
20+
$keyName = "mitest-key"
21+
$keyId = "https://mitest-eus-donotdelete.vault.azure.net/keys/mitest-key/6dc78e98a3274d87bd847436dd34045e"
22+
$keyVersion = "6dc78e98a3274d87bd847436dd34045e"
23+
$tdeKeyName = $keyVaultName + "_" + $keyName + "_" + $keyVersion
24+
25+
26+
<#
27+
.SYNOPSIS
28+
Tests for managing TDE keyVaultKey in managed instance for continuous validation
29+
#>
30+
function Test-ManagedInstanceKeyVaultKeyCI
31+
{
32+
33+
$managedInstance = Get-AzSqlInstance -Name $managedInstanceName -ResourceGroupName $mangedInstanceRg
34+
$managedInstanceResourceId = $managedInstance.Id
35+
36+
# Test Add
37+
$keyResult = Add-AzSqlInstanceKeyVaultKey -ResourceGroupName $mangedInstanceRg -InstanceName $managedInstanceName -KeyId $keyId
38+
39+
Assert-AreEqual $keyId $keyResult.KeyId "KeyId mismatch after calling Add-AzSqlInstanceKeyVaultKey"
40+
Assert-AreEqual $tdeKeyName $keyResult.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Add-AzSqlInstanceKeyVaultKey"
41+
42+
43+
# Test Get
44+
$keyResult2 = $managedInstance | Get-AzSqlInstanceKeyVaultKey -KeyId $keyId
45+
46+
Assert-AreEqual $keyId $keyResult2.KeyId "KeyId mismatch after calling Get-AzSqlInstanceKeyVaultKey"
47+
Assert-AreEqual $tdeKeyName $keyResult2.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Get-AzSqlInstanceKeyVaultKey"
48+
49+
# Test List
50+
$keyResults = Get-AzSqlInstanceKeyVaultKey -InstanceResourceId $managedInstanceResourceId
51+
Assert-True {$keyResults.Count -gt 0} "List count <= 0 after calling (List) Get-AzSqlInstanceKeyVaultKey without KeyId"
52+
}
53+
54+
<#
55+
.SYNOPSIS
56+
Tests for managing TDE keyVaultKey in managed instance
57+
#>
58+
function Test-ManagedInstanceKeyVaultKey
59+
{
60+
# Test Add
61+
$keyResult = Add-AzSqlInstanceKeyVaultKey -ResourceGroupName $mangedInstanceRg -InstanceName $managedInstanceName -KeyId $keyId
62+
63+
Assert-AreEqual $keyId $keyResult.KeyId "KeyId mismatch after calling Add-AzSqlInstanceKeyVaultKey"
64+
Assert-AreEqual $tdeKeyName $keyResult.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Add-AzSqlInstanceKeyVaultKey"
65+
66+
67+
# Test Get
68+
$keyResult2 = Get-AzSqlInstanceKeyVaultKey -ResourceGroupName $mangedInstanceRg -InstanceName $managedInstanceName -KeyId $keyId
69+
70+
Assert-AreEqual $keyId $keyResult2.KeyId "KeyId mismatch after calling Get-AzSqlInstanceKeyVaultKey"
71+
Assert-AreEqual $tdeKeyName $keyResult2.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Get-AzSqlInstanceKeyVaultKey"
72+
73+
# Test List
74+
$keyResults = Get-AzSqlInstanceKeyVaultKey -ResourceGroupName $mangedInstanceRg -InstanceName $managedInstanceName
75+
Assert-True {$keyResults.Count -gt 0} "List count <= 0 after calling (List) Get-AzSqlInstanceKeyVaultKey without KeyId"
76+
}
77+
78+
79+
<#
80+
.SYNOPSIS
81+
Tests for managing TDE keyVaultKey in managed instance using input object parameter set
82+
#>
83+
function Test-ManagedInstanceKeyVaultKeyInputObject
84+
{
85+
$managedInstance = Get-AzSqlInstance -Name $managedInstanceName -ResourceGroupName $mangedInstanceRg
86+
87+
# Test Add
88+
$keyResult = Add-AzSqlInstanceKeyVaultKey -Instance $managedInstance -KeyId $keyId
89+
90+
Assert-AreEqual $keyId $keyResult.KeyId "KeyId mismatch after calling Add-AzSqlInstanceKeyVaultKey"
91+
Assert-AreEqual $tdeKeyName $keyResult.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Add-AzSqlInstanceKeyVaultKey"
92+
93+
94+
# Test Get
95+
$keyResult2 = Get-AzSqlInstanceKeyVaultKey -Instance $managedInstance -KeyId $keyId
96+
97+
Assert-AreEqual $keyId $keyResult2.KeyId "KeyId mismatch after calling Get-AzSqlInstanceKeyVaultKey"
98+
Assert-AreEqual $tdeKeyName $keyResult2.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Get-AzSqlInstanceKeyVaultKey"
99+
100+
101+
# Test List
102+
$keyResults = Get-AzSqlInstanceKeyVaultKey -Instance $managedInstance
103+
104+
Assert-True {$keyResults.Count -gt 0} "List count <= 0 after calling (List) Get-AzSqlInstanceKeyVaultKey without KeyId"
105+
}
106+
107+
108+
<#
109+
.SYNOPSIS
110+
Tests for managing TDE keyVaultKey in managed instance using resource id parameter set
111+
#>
112+
function Test-ManagedInstanceKeyVaultKeyResourceId
113+
{
114+
$managedInstance = Get-AzSqlInstance -Name $managedInstanceName -ResourceGroupName $mangedInstanceRg
115+
$managedInstanceResourceId = $managedInstance.Id
116+
117+
# Test Add
118+
$keyResult = Add-AzSqlInstanceKeyVaultKey -InstanceResourceId $managedInstanceResourceId -KeyId $keyId
119+
120+
Assert-AreEqual $keyId $keyResult.KeyId "KeyId mismatch after calling Add-AzSqlInstanceKeyVaultKey"
121+
Assert-AreEqual $tdeKeyName $keyResult.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Add-AzSqlInstanceKeyVaultKey"
122+
123+
124+
# Test Get
125+
$keyResult2 = Get-AzSqlInstanceKeyVaultKey -InstanceResourceId $managedInstanceResourceId -KeyId $keyId
126+
127+
Assert-AreEqual $keyId $keyResult2.KeyId "KeyId mismatch after calling Get-AzSqlInstanceKeyVaultKey"
128+
Assert-AreEqual $tdeKeyName $keyResult2.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Get-AzSqlInstanceKeyVaultKey"
129+
130+
131+
# Test List
132+
$keyResults = Get-AzSqlInstanceKeyVaultKey -InstanceResourceId $managedInstanceResourceId
133+
134+
Assert-True {$keyResults.Count -gt 0} "List count <= 0 after calling (List) Get-AzSqlInstanceKeyVaultKey without KeyId"
135+
}
136+
137+
138+
<#
139+
.SYNOPSIS
140+
Tests for managing TDE keyVaultKey in managed instance using piping
141+
#>
142+
function Test-ManagedInstanceKeyVaultKeyPiping
143+
{
144+
$managedInstance = Get-AzSqlInstance -Name $managedInstanceName -ResourceGroupName $mangedInstanceRg
145+
146+
# Test Add
147+
$keyResult = $managedInstance | Add-AzSqlInstanceKeyVaultKey -KeyId $keyId
148+
149+
Assert-AreEqual $keyId $keyResult.KeyId "KeyId mismatch after calling Add-AzSqlInstanceKeyVaultKey"
150+
Assert-AreEqual $tdeKeyName $keyResult.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Add-AzSqlInstanceKeyVaultKey"
151+
152+
153+
# Test Get
154+
$keyResult2 = $managedInstance | Get-AzSqlInstanceKeyVaultKey -KeyId $keyId
155+
156+
Assert-AreEqual $keyId $keyResult2.KeyId "KeyId mismatch after calling Get-AzSqlInstanceKeyVaultKey"
157+
Assert-AreEqual $tdeKeyName $keyResult2.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Get-AzSqlInstanceKeyVaultKey"
158+
159+
160+
# Test List
161+
$keyResults = $managedInstance | Get-AzSqlInstanceKeyVaultKey
162+
163+
Assert-True {$keyResults.Count -gt 0} "List count <= 0 after calling (List) Get-AzSqlInstanceKeyVaultKey without KeyId"
164+
}

‎src/Sql/Sql.Test/ScenarioTests/ManagedInstanceProtectorTests.cs

Lines changed: 101 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,101 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.Azure.Commands.ScenarioTest.SqlTests;
16+
using Microsoft.WindowsAzure.Commands.ScenarioTest;
17+
using Xunit;
18+
using Xunit.Abstractions;
19+
20+
namespace Microsoft.Azure.Commands.Sql.Test.ScenarioTests
21+
{
22+
public class ManagedInstanceProtectorTests : SqlTestsBase
23+
{
24+
public ManagedInstanceProtectorTests(ITestOutputHelper output) : base(output)
25+
{
26+
}
27+
28+
[Fact]
29+
[Trait(Category.AcceptanceType, Category.CheckIn)]
30+
public void TestSetGetManagedInstanceEncryptionProtectorCI()
31+
{
32+
RunPowerShellTest("Test-SetGetManagedInstanceEncryptionProtectorCI");
33+
}
34+
35+
[Fact]
36+
[Trait(Category.AcceptanceType, Category.CheckIn)]
37+
public void TestSetGetManagedInstanceEncryptionProtectorByokFailsWithoutKeyId()
38+
{
39+
RunPowerShellTest("Test-SetGetManagedInstanceEncryptionProtectorByokFailsWithoutKeyId");
40+
}
41+
42+
// Commenting out these tests because automated checks are failing when there
43+
//is [fact] tag even when there is no trait tag
44+
45+
[Fact]
46+
[Trait(Category.AcceptanceType, Category.CheckIn)]
47+
public void TestSetGetManagedInstanceEncryptionProtectorServiceManaged()
48+
{
49+
RunPowerShellTest("Test-SetGetManagedInstanceEncryptionProtectorServiceManaged");
50+
}
51+
52+
[Fact]
53+
[Trait(Category.AcceptanceType, Category.CheckIn)]
54+
public void TestSetGetManagedInstanceEncryptionProtectorServiceManagedInputObject()
55+
{
56+
RunPowerShellTest("Test-SetGetManagedInstanceEncryptionProtectorServiceManagedInputObject");
57+
}
58+
59+
[Fact]
60+
[Trait(Category.AcceptanceType, Category.CheckIn)]
61+
public void TestSetGetManagedInstanceEncryptionProtectorServiceManagedResourceId()
62+
{
63+
RunPowerShellTest("Test-SetGetManagedInstanceEncryptionProtectorServiceManagedResourceId");
64+
}
65+
66+
[Fact]
67+
[Trait(Category.AcceptanceType, Category.CheckIn)]
68+
public void TestSetGetManagedInstanceEncryptionProtectorServiceManagedPiping()
69+
{
70+
RunPowerShellTest("Test-SetGetManagedInstanceEncryptionProtectorServiceManagedPiping");
71+
}
72+
73+
[Fact]
74+
[Trait(Category.AcceptanceType, Category.CheckIn)]
75+
public void TestSetGetManagedInstanceEncryptionProtectorByok()
76+
{
77+
RunPowerShellTest("Test-SetGetManagedInstanceEncryptionProtectorByok");
78+
}
79+
80+
[Fact]
81+
[Trait(Category.AcceptanceType, Category.CheckIn)]
82+
public void TestSetGetManagedInstanceEncryptionProtectorByokInputObject()
83+
{
84+
RunPowerShellTest("Test-SetGetManagedInstanceEncryptionProtectorByokInputObject");
85+
}
86+
87+
[Fact]
88+
[Trait(Category.AcceptanceType, Category.CheckIn)]
89+
public void TestSetGetManagedInstanceEncryptionProtectorByokResourceId()
90+
{
91+
RunPowerShellTest("Test-SetGetManagedInstanceEncryptionProtectorByokResourceId");
92+
}
93+
94+
[Fact]
95+
[Trait(Category.AcceptanceType, Category.CheckIn)]
96+
public void TestSetGetManagedInstanceEncryptionProtectorByokPiping()
97+
{
98+
RunPowerShellTest("Test-SetGetManagedInstanceEncryptionProtectorByokPiping");
99+
}
100+
}
101+
}

0 commit comments

Comments
 (0)