Skip to content

Commit 2ce384f

Browse files
yanjungao718yanjungao718
authored
[Synapse] Support for workspace encrytion managed identity setting (#20010)
* workspace encrytion managed identity setting * update help doc
1 parent 2e19db1 commit 2ce384f

File tree

6 files changed

+174
-20
lines changed

6 files changed

+174
-20
lines changed

‎src/Synapse/Synapse/ChangeLog.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
-->
2020

2121
## Upcoming Release
22+
* Updated `Update-AzSynaspeWorkSpace` and `New-AzSynpaseWorkspace` to support for Workspace Encrytion Managed Identity setting
2223

2324
## Version 2.0.0
2425
* [Breaking Change] Updated models of Synapse Link for Azure Sql Database

‎src/Synapse/Synapse/Commands/ManagementCommands/Workspace/NewAzureSynapseWorkspace.cs

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -82,6 +82,13 @@ public class NewAzureSynapseWorkspace : SynapseManagementCmdletBase
8282
[ValidateNotNullOrEmpty]
8383
public string EncryptionKeyIdentifier { get; set; }
8484

85+
[Parameter(Mandatory = false, HelpMessage = HelpMessages.UserAssignedIdentityInEncryption)]
86+
public string UserAssignedIdentityInEncryption { get; set; }
87+
88+
[Parameter(Mandatory = false, HelpMessage = HelpMessages.UseSystemAssignedIdentityInEncryption)]
89+
[ValidateNotNullOrEmpty]
90+
public object UseSystemAssignedIdentityInEncryption { get; set; }
91+
8592
[Parameter(Mandatory = false, HelpMessage = HelpMessages.AsJob)]
8693
public SwitchParameter AsJob { get; set; }
8794

@@ -156,6 +163,11 @@ public override void ExecuteCmdlet()
156163
{
157164
Name = this.EncryptionKeyName,
158165
KeyVaultUrl = this.EncryptionKeyIdentifier
166+
},
167+
KekIdentity = new KekIdentityProperties
168+
{
169+
UserAssignedIdentity = this.UserAssignedIdentityInEncryption,
170+
UseSystemAssignedIdentity = this.UseSystemAssignedIdentityInEncryption
159171
}
160172
}
161173
} : null,

‎src/Synapse/Synapse/Commands/ManagementCommands/Workspace/UpdateAzureSynapseWorkspace.cs

Lines changed: 17 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
using Microsoft.Azure.Management.Synapse.Models;
2323
using Microsoft.WindowsAzure.Commands.Common;
2424
using Microsoft.WindowsAzure.Commands.Utilities.Common;
25+
using System;
2526
using System.Collections;
2627
using System.Collections.Generic;
2728
using System.Linq;
@@ -79,6 +80,13 @@ public class UpdateAzureSynapseWorkspace : SynapseManagementCmdletBase
7980
[ValidateNotNullOrEmpty]
8081
public string EncryptionKeyName { get; set; }
8182

83+
[Parameter(Mandatory = false, HelpMessage = HelpMessages.UserAssignedIdentityInEncryption)]
84+
public string UserAssignedIdentityInEncryption { get; set; }
85+
86+
[Parameter(Mandatory = false, HelpMessage = HelpMessages.UseSystemAssignedIdentityInEncryption)]
87+
[ValidateNotNullOrEmpty]
88+
public object UseSystemAssignedIdentityInEncryption { get; set; }
89+
8290
[Parameter(Mandatory = false, HelpMessage = HelpMessages.GitRepository)]
8391
[ValidateNotNull]
8492
public PSWorkspaceRepositoryConfiguration GitRepository { get; set; }
@@ -137,14 +145,21 @@ public override void ExecuteCmdlet()
137145
patchInfo.Tags = this.IsParameterBound(c => c.Tag) ? TagsConversionHelper.CreateTagDictionary(this.Tag, validate: true) : TagsConversionHelper.CreateTagDictionary(this.InputObject?.Tags, validate:true);
138146
patchInfo.SqlAdministratorLoginPassword = this.IsParameterBound(c => c.SqlAdministratorLoginPassword) ? this.SqlAdministratorLoginPassword.ConvertToString() : null;
139147
patchInfo.ManagedVirtualNetworkSettings = this.IsParameterBound(c => c.ManagedVirtualNetwork) ? this.ManagedVirtualNetwork?.ToSdkObject() : this.InputObject?.ManagedVirtualNetworkSettings?.ToSdkObject();
140-
string encrptionKeyName = this.IsParameterBound(c => c.EncryptionKeyName) ? this.EncryptionKeyName : this.InputObject?.Encryption?.CustomerManagedKeyDetails?.Key?.Name;
141-
patchInfo.Encryption = !string.IsNullOrEmpty(encrptionKeyName) ? new EncryptionDetails
148+
string encrptionKeyName = this.IsParameterBound(c => c.EncryptionKeyName) ? this.EncryptionKeyName : this.InputObject?.Encryption?.CustomerManagedKeyDetails?.Key?.Name;
149+
string userAssignedIdentityInEncryption = this.IsParameterBound(c => c.UserAssignedIdentityInEncryption) ? this.UserAssignedIdentityInEncryption : this.InputObject?.Encryption?.CustomerManagedKeyDetails?.KekIdentity?.UserAssignedIdentity;
150+
object useSystemAssignedIdentityInEncryption = this.IsParameterBound(c => c.UseSystemAssignedIdentityInEncryption) ? this.UseSystemAssignedIdentityInEncryption : this.InputObject?.Encryption?.CustomerManagedKeyDetails?.KekIdentity?.UseSystemAssignedIdentity;
151+
patchInfo.Encryption = !string.IsNullOrEmpty(encrptionKeyName) || this.IsParameterBound(c => c.UseSystemAssignedIdentityInEncryption) ? new EncryptionDetails
142152
{
143153
Cmk = new CustomerManagedKeyDetails
144154
{
145155
Key = new WorkspaceKeyDetails
146156
{
147157
Name = encrptionKeyName
158+
},
159+
KekIdentity = new KekIdentityProperties
160+
{
161+
UserAssignedIdentity = userAssignedIdentityInEncryption,
162+
UseSystemAssignedIdentity = useSystemAssignedIdentityInEncryption
148163
}
149164
}
150165
} : null;

‎src/Synapse/Synapse/Common/HelpMessages.cs

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -497,6 +497,10 @@ SELECT on dbo.myTable by public
497497

498498
public const string EncryptionKeyIdentifier = "Key identifier should be in the format of: https://{keyvaultname}.vault.azure.net/keys/{keyname}.";
499499

500+
public const string UserAssignedIdentityInEncryption = "User assigned identity resource Id used in Workspace Encryption";
501+
502+
public const string UseSystemAssignedIdentityInEncryption = "specifying whether to use system assigned identity in Workspace Encryption or not";
503+
500504
public const string WorkspaceKeyName = "The name of the workspace key.";
501505

502506
public const string WorkspaceItemType = "The workspace item type.";

‎src/Synapse/Synapse/help/New-AzSynapseWorkspace.md

Lines changed: 60 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,10 @@ Creates a Synapse Analytics workspace.
1616
New-AzSynapseWorkspace -ResourceGroupName <String> -Name <String> -Location <String> [-Tag <Hashtable>]
1717
-DefaultDataLakeStorageAccountName <String> -DefaultDataLakeStorageFilesystem <String>
1818
-SqlAdministratorLoginCredential <PSCredential> [-ManagedVirtualNetwork <PSManagedVirtualNetworkSettings>]
19-
[-EncryptionKeyName <String>] [-EncryptionKeyIdentifier <String>] [-AsJob]
20-
[-ManagedResourceGroupName <String>] [-GitRepository <PSWorkspaceRepositoryConfiguration>]
21-
[-EnablePublicNetworkAccess <Boolean>] [-UserAssignedIdentityId <System.Collections.Generic.List`1[System.String]>]
19+
[-EncryptionKeyName <String>] [-EncryptionKeyIdentifier <String>] [-UserAssignedIdentityInEncryption <String>]
20+
[-UseSystemAssignedIdentityInEncryption <Object>] [-AsJob] [-ManagedResourceGroupName <String>]
21+
[-GitRepository <PSWorkspaceRepositoryConfiguration>] [-EnablePublicNetworkAccess <Boolean>]
22+
[-UserAssignedIdentityId <System.Collections.Generic.List`1[System.String]>]
2223
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
2324
```
2425

@@ -80,6 +81,32 @@ New-AzSynapseWorkspace -ResourceGroupName ContosoResourceGroup -Name ContosoWork
8081

8182
This command creates a Synapse Analytics workspace named ContosoWorkspace that uses the ContosoAdlGenStorage Data Store, in the resource group named ContosoResourceGroup, and add user assigned managed identities that get from ResourceGroup ContosoResourceGroup to workspace.
8283

84+
### Example 6
85+
```powershell
86+
New-AzSynapseWorkspace -ResourceGroupName ContosoResourceGroup -Name ContosoWorkspace -Location northeurope -DefaultDataLakeStorageAccountName ContosoAdlGen2Storage -DefaultDataLakeStorageFilesystem ContosoFileSystem -SqlAdministratorLoginCredential $creds -EncryptionKeyIdentifier $identifier -UseSystemAssignedIdentityInEncryption $true
87+
$ws = Get-AzSynapseWorkspace -name ContosoWorkspace
88+
$ws.Encryption.CustomerManagedKeyDetails.Key
89+
```
90+
91+
```output
92+
Name KeyVaultUrl
93+
---- -----------
94+
default https://contosoKeyValut.vault.azure.net/keys/testkey
95+
```
96+
97+
```powershell
98+
$ws = Get-AzSynapseWorkspace -name ContosoWorkspace
99+
$ws.Encryption.CustomerManagedKeyDetails.KekIdentity
100+
```
101+
102+
```output
103+
UserAssignedIdentity UseSystemAssignedIdentity
104+
-------------------- -------------------------
105+
True
106+
```
107+
108+
This command creates a Synapse Analytics workspace named ContosoWorkspace that uses the ContosoAdlGenStorage Data Store, in the resource group named ContosoResourceGroup, and enable double encryption with customer-managed key with specified key identifier and set Managed Identity as System Assigned. After creation, we can call `Get-AzSynapseWorkspace` to get Encryption properties of workspace.
109+
83110
## PARAMETERS
84111

85112
### -AsJob
@@ -322,6 +349,36 @@ Accept pipeline input: False
322349
Accept wildcard characters: False
323350
```
324351
352+
### -UserAssignedIdentityInEncryption
353+
User assigned identity resource Id used in Workspace Encryption
354+
355+
```yaml
356+
Type: System.String
357+
Parameter Sets: (All)
358+
Aliases:
359+
360+
Required: False
361+
Position: Named
362+
Default value: None
363+
Accept pipeline input: False
364+
Accept wildcard characters: False
365+
```
366+
367+
### -UseSystemAssignedIdentityInEncryption
368+
specifying whether to use system assigned identity in Workspace Encryption or not
369+
370+
```yaml
371+
Type: System.Object
372+
Parameter Sets: (All)
373+
Aliases:
374+
375+
Required: False
376+
Position: Named
377+
Default value: None
378+
Accept pipeline input: False
379+
Accept wildcard characters: False
380+
```
381+
325382
### -Confirm
326383
Prompts you for confirmation before running the cmdlet.
327384

‎src/Synapse/Synapse/help/Update-AzSynapseWorkspace.md

Lines changed: 80 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -16,30 +16,36 @@ Updates a Synapse Analytics workspace.
1616
```
1717
Update-AzSynapseWorkspace [-ResourceGroupName <String>] -Name <String> [-Tag <Hashtable>]
1818
[-SqlAdministratorLoginPassword <SecureString>] [-ManagedVirtualNetwork <PSManagedVirtualNetworkSettings>]
19-
[-EncryptionKeyName <String>] [-GitRepository <PSWorkspaceRepositoryConfiguration>]
20-
[-EnablePublicNetworkAccess <Boolean>] [-UserAssignedIdentityAction <UserAssignedManagedIdentityActionType>]
21-
[-UserAssignedIdentityId <System.Collections.Generic.List`1[System.String]>] [-AsJob]
22-
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
19+
[-EncryptionKeyName <String>] [-UserAssignedIdentityInEncryption <String>]
20+
[-UseSystemAssignedIdentityInEncryption <Object>] [-GitRepository <PSWorkspaceRepositoryConfiguration>]
21+
[-UserAssignedIdentityAction <UserAssignedManagedIdentityActionType>]
22+
[-UserAssignedIdentityId <System.Collections.Generic.List`1[System.String]>]
23+
[-EnablePublicNetworkAccess <Boolean>] [-AsJob] [-DefaultProfile <IAzureContextContainer>] [-WhatIf]
24+
[-Confirm] [<CommonParameters>]
2325
```
2426

2527
### SetByInputObjectParameterSet
2628
```
2729
Update-AzSynapseWorkspace -InputObject <PSSynapseWorkspace> [-Tag <Hashtable>]
2830
[-SqlAdministratorLoginPassword <SecureString>] [-ManagedVirtualNetwork <PSManagedVirtualNetworkSettings>]
29-
[-EncryptionKeyName <String>] [-GitRepository <PSWorkspaceRepositoryConfiguration>]
30-
[-EnablePublicNetworkAccess <Boolean>] [-UserAssignedIdentityAction <UserAssignedManagedIdentityActionType>]
31-
[-UserAssignedIdentityId <System.Collections.Generic.List`1[System.String]>] [-AsJob]
32-
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
31+
[-EncryptionKeyName <String>] [-UserAssignedIdentityInEncryption <String>]
32+
[-UseSystemAssignedIdentityInEncryption <Object>] [-GitRepository <PSWorkspaceRepositoryConfiguration>]
33+
[-UserAssignedIdentityAction <UserAssignedManagedIdentityActionType>]
34+
[-UserAssignedIdentityId <System.Collections.Generic.List`1[System.String]>]
35+
[-EnablePublicNetworkAccess <Boolean>] [-AsJob] [-DefaultProfile <IAzureContextContainer>] [-WhatIf]
36+
[-Confirm] [<CommonParameters>]
3337
```
3438

3539
### SetByResourceIdParameterSet
3640
```
3741
Update-AzSynapseWorkspace -ResourceId <String> [-Tag <Hashtable>]
3842
[-SqlAdministratorLoginPassword <SecureString>] [-ManagedVirtualNetwork <PSManagedVirtualNetworkSettings>]
39-
[-EncryptionKeyName <String>] [-GitRepository <PSWorkspaceRepositoryConfiguration>]
40-
[-EnablePublicNetworkAccess <Boolean>] [-UserAssignedIdentityAction <UserAssignedManagedIdentityActionType>]
41-
[-UserAssignedIdentityId <System.Collections.Generic.List`1[System.String]>] [-AsJob]
42-
[-DefaultProfile <IAzureContextContainer>] [-WhatIf] [-Confirm] [<CommonParameters>]
43+
[-EncryptionKeyName <String>] [-UserAssignedIdentityInEncryption <String>]
44+
[-UseSystemAssignedIdentityInEncryption <Object>] [-GitRepository <PSWorkspaceRepositoryConfiguration>]
45+
[-UserAssignedIdentityAction <UserAssignedManagedIdentityActionType>]
46+
[-UserAssignedIdentityId <System.Collections.Generic.List`1[System.String]>]
47+
[-EnablePublicNetworkAccess <Boolean>] [-AsJob] [-DefaultProfile <IAzureContextContainer>] [-WhatIf]
48+
[-Confirm] [<CommonParameters>]
4349
```
4450

4551
## DESCRIPTION
@@ -86,7 +92,7 @@ This commands updates the specififed Azure Synapse Analytics workspace to enable
8692

8793
### Example 6
8894
```powershell
89-
$uamis = Get-AzUserAssignedIdentity -ResourceGroupName bigdataqa
95+
$uamis = Get-AzUserAssignedIdentity -ResourceGroupName ContosoResourceGroup
9096
$uamilist = New-Object System.Collections.Generic.List[string]
9197
foreach($uami in $uamis){
9298
$uamilist.Add($uami.Id)
@@ -99,7 +105,7 @@ This commands updates workspace to add user assigned managed identites in $uamil
99105

100106
### Example 7
101107
```powershell
102-
$uamis = Get-AzUserAssignedIdentity -ResourceGroupName bigdataqa
108+
$uamis = Get-AzUserAssignedIdentity -ResourceGroupName ContosoResourceGroup
103109
$uamilist = New-Object System.Collections.Generic.List[string]
104110
foreach($uami in $uamis){
105111
$uamilist.Add($uami.Id)
@@ -112,7 +118,7 @@ This commands removes user assigned managed identites $uamilist[0] from workspac
112118

113119
### Example 8
114120
```powershell
115-
$uamis = Get-AzUserAssignedIdentity -ResourceGroupName bigdataqa
121+
$uamis = Get-AzUserAssignedIdentity -ResourceGroupName ContosoResourceGroup
116122
$uamilist = New-Object System.Collections.Generic.List[string]
117123
foreach($uami in $uamis){
118124
$uamilist.Add($uami.Id)
@@ -123,6 +129,35 @@ Update-AzSynapseWorkspace -Name ContosoWorkspace -UserAssignedIdentityAction Set
123129

124130
This commands updates workspace with user assigned managed identites $uamilist that will cover current identities.
125131

132+
### Example 9
133+
```powershell
134+
$uamis = Get-AzUserAssignedIdentity -ResourceGroupName ContosoResourceGroup
135+
$identityId = $uamis[0].Id
136+
$ws = Get-AzSynapseWorkspace -Name ContosoWorkspace
137+
$ws | Update-AzSynapseWorkspace -UseSystemAssignedIdentityInEncryption $false -UserAssignedIdentityInEncryption $identityId
138+
$ws = Get-AzSynapseWorkspace -Name ContosoWorkspace
139+
$ws.Encryption.CustomerManagedKeyDetails.Key
140+
```
141+
142+
```output
143+
Name KeyVaultUrl
144+
---- -----------
145+
default https://contosoKeyValut.vault.azure.net/keys/testkey
146+
```
147+
148+
```powershell
149+
$ws = Get-AzSynapseWorkspace -name ContosoWorkspace
150+
$ws.Encryption.CustomerManagedKeyDetails.KekIdentity
151+
```
152+
153+
```output
154+
UserAssignedIdentity UseSystemAssignedIdentity
155+
-------------------- -------------------------
156+
/subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourcegroups/ContosoResourceGroup/providers/Microsoft.ManagedIdentity/userAssignedIdentities/uaminame False
157+
```
158+
159+
This commands updates workspace Encryption Managed Identity as User Assigned and specify an user assigned identity Id to access your customer-managed key stored in key vault. After updating, we can call `Get-AzSynapseWorkspace` to get Encryption properties of workspace.
160+
126161
## PARAMETERS
127162

128163
### -AsJob
@@ -341,6 +376,36 @@ Accept pipeline input: False
341376
Accept wildcard characters: False
342377
```
343378
379+
### -UserAssignedIdentityInEncryption
380+
User assigned identity resource Id used in Workspace Encryption
381+
382+
```yaml
383+
Type: System.String
384+
Parameter Sets: (All)
385+
Aliases:
386+
387+
Required: False
388+
Position: Named
389+
Default value: None
390+
Accept pipeline input: False
391+
Accept wildcard characters: False
392+
```
393+
394+
### -UseSystemAssignedIdentityInEncryption
395+
specifying whether to use system assigned identity in Workspace Encryption or not
396+
397+
```yaml
398+
Type: System.Object
399+
Parameter Sets: (All)
400+
Aliases:
401+
402+
Required: False
403+
Position: Named
404+
Default value: None
405+
Accept pipeline input: False
406+
Accept wildcard characters: False
407+
```
408+
344409
### -Confirm
345410
Prompts you for confirmation before running the cmdlet.
346411

0 commit comments

Comments
 (0)