Skip to content

Commit 567b700

Browse files
markcowlmarkcowl
authored
Merge pull request #9222 from nivimsft/tdemiPreviewToRelease
New Cmdlets for Management.Sql that supports Managed instance key and…
2 parents ba23eaa + fb9886c commit 567b700

File tree

56 files changed

+28621
-1256
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

56 files changed

+28621
-1256
lines changed

‎src/Sql/Sql.Test/ScenarioTests/Common.ps1

Lines changed: 32 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -305,14 +305,15 @@ Gets the values of the parameters used in the Server Key Vault Key tests
305305
#>
306306
function Get-SqlServerKeyVaultKeyTestEnvironmentParameters ()
307307
{
308+
# Create a key vault with soft delete.configured
308309
return @{ rgName = Get-ResourceGroupName;
309310
serverName = Get-ServerName;
310311
databaseName = Get-DatabaseName;
311-
keyId = "https://akvtdekeyvault.vault.azure.net/keys/key1/51c2fab9ff3c4a17aab4cd51b932b106";
312-
serverKeyName = "akvtdekeyvault_key1_51c2fab9ff3c4a17aab4cd51b932b106";
313-
vaultName = "akvtdekeyvault";
312+
keyId = "https://akvtdekeyvaultcl.vault.azure.net/keys/key1/738a177a3b0d45e98d366fdf738840e8";
313+
serverKeyName = "akvtdekeyvaultcl_key1_738a177a3b0d45e98d366fdf738840e8";
314+
vaultName = "akvtdekeyvaultcl";
314315
keyName = "key1"
315-
location = "southeastasia";
316+
location = "westcentralus";
316317
}
317318
}
318319

@@ -330,17 +331,42 @@ function Create-ServerKeyVaultKeyTestEnvironment ($params)
330331
<#[SuppressMessage("Microsoft.Security", "CS002:SecretInNextLine", Justification="Test passwords only valid for the duration of the test")]#>
331332
$serverPassword = "t357ingP@s5w0rd!"
332333
$credentials = new-object System.Management.Automation.PSCredential($serverLogin, ($serverPassword | ConvertTo-SecureString -asPlainText -Force))
333-
$server = New-AzSqlServer -ResourceGroupName $rg.ResourceGroupName -ServerName $params.serverName -Location $params.location -ServerVersion "12.0" -SqlAdministratorCredentials $credentials
334+
$server = New-AzSqlServer -ResourceGroupName $rg.ResourceGroupName -ServerName $params.serverName -Location $params.location -ServerVersion "12.0" -SqlAdministratorCredentials $credentials -AssignIdentity
334335
Assert-AreEqual $server.ServerName $params.serverName
335336

336337
# Create database
337338
$db = New-AzSqlDatabase -ResourceGroupName $rg.ResourceGroupName -ServerName $server.ServerName -DatabaseName $params.databaseName
338339
Assert-AreEqual $db.DatabaseName $params.databaseName
339340

341+
#Set permissions on key Vault
342+
Set-AzKeyVaultAccessPolicy -VaultName $params.vaultName -ObjectId $server.Identity.PrincipalId -PermissionsToKeys get, list, wrapKey, unwrapKey
343+
340344
# Return the created resource group
341345
return $rg
342346
}
343347

348+
349+
<#
350+
.SYNOPSIS
351+
Creates test managed instance
352+
#>
353+
function Get-ManagedInstanceForTdeTest ($params)
354+
{
355+
# Setup
356+
$rg = Create-ResourceGroupForTest
357+
$vnetName = "cl_initial"
358+
$subnetName = "Cool"
359+
360+
# Setup VNET
361+
$virtualNetwork1 = CreateAndGetVirtualNetworkForManagedInstance $vnetName $subnetName $rg.Location
362+
$subnetId = $virtualNetwork1.Subnets.where({ $_.Name -eq $subnetName })[0].Id
363+
364+
$managedInstance = Create-ManagedInstanceForTest $rg $subnetId
365+
Set-AzKeyVaultAccessPolicy -VaultName $params.vaultName -ObjectId $managedInstance.Identity.PrincipalId -PermissionsToKeys get, list, wrapKey, unwrapKey
366+
367+
return $managedInstance
368+
}
369+
344370
<#
345371
.SYNOPSIS
346372
Gets valid resource group name
@@ -705,7 +731,7 @@ function Create-ManagedInstanceForTest ($resourceGroup, $subnetId)
705731

706732
$managedInstance = New-AzSqlInstance -ResourceGroupName $resourceGroup.ResourceGroupName -Name $managedInstanceName `
707733
-Location $resourceGroup.Location -AdministratorCredential $credentials -SubnetId $subnetId `
708-
-Vcore $vCore -SkuName $skuName
734+
-Vcore $vCore -SkuName $skuName -AssignIdentity
709735

710736
return $managedInstance
711737
}

‎src/Sql/Sql.Test/ScenarioTests/ManagedInstanceKeyVaultKeyTests.cs

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.Azure.Commands.ScenarioTest.SqlTests;
16+
using Microsoft.WindowsAzure.Commands.ScenarioTest;
17+
using Xunit;
18+
using Xunit.Abstractions;
19+
using RestTestFramework = Microsoft.Rest.ClientRuntime.Azure.TestFramework;
20+
21+
namespace Microsoft.Azure.Commands.Sql.Test.ScenarioTests
22+
{
23+
public class ManagedInstanceKeyVaultKeyTests : SqlTestsBase
24+
{
25+
public ManagedInstanceKeyVaultKeyTests(ITestOutputHelper output) : base(output)
26+
{
27+
}
28+
29+
protected override void SetupManagementClients(RestTestFramework.MockContext context)
30+
{
31+
var sqlClient = GetSqlClient(context);
32+
var newResourcesClient = GetResourcesClient(context);
33+
var graphClient = GetGraphClient(context);
34+
var networkClient = GetNetworkClient(context);
35+
var keyVaultClient = GetKeyVaultClient(context);
36+
Helper.SetupSomeOfManagementClients(sqlClient, newResourcesClient, networkClient, graphClient, keyVaultClient);
37+
}
38+
39+
[Fact]
40+
[Trait(Category.AcceptanceType, Category.CheckIn)]
41+
public void TestManagedInstanceKeyVaultKeyCI()
42+
{
43+
RunPowerShellTest("Test-ManagedInstanceKeyVaultKeyCI");
44+
}
45+
46+
[Fact]
47+
[Trait(Category.AcceptanceType, Category.CheckIn)]
48+
public void TestManagedInstanceKeyVaultKey()
49+
{
50+
RunPowerShellTest("Test-ManagedInstanceKeyVaultKey");
51+
}
52+
53+
[Fact]
54+
[Trait(Category.AcceptanceType, Category.CheckIn)]
55+
public void TestManagedInstanceKeyVaultKeyInputObject()
56+
{
57+
RunPowerShellTest("Test-ManagedInstanceKeyVaultKeyInputObject");
58+
}
59+
60+
[Fact]
61+
[Trait(Category.AcceptanceType, Category.CheckIn)]
62+
public void TestManagedInstanceKeyVaultKeyResourceId()
63+
{
64+
RunPowerShellTest("Test-ManagedInstanceKeyVaultKeyResourceId");
65+
}
66+
67+
[Fact]
68+
[Trait(Category.AcceptanceType, Category.CheckIn)]
69+
public void TestManagedInstanceKeyVaultKeyPiping()
70+
{
71+
RunPowerShellTest("Test-ManagedInstanceKeyVaultKeyPiping");
72+
}
73+
}
74+
}

‎src/Sql/Sql.Test/ScenarioTests/ManagedInstanceKeyVaultKeyTests.ps1

Lines changed: 169 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,169 @@
1+
# ----------------------------------------------------------------------------------
2+
#
3+
# Copyright Microsoft Corporation
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
# ----------------------------------------------------------------------------------
14+
15+
<#
16+
.SYNOPSIS
17+
Tests for managing TDE keyVaultKey in managed instance for continuous validation
18+
#>
19+
function Test-ManagedInstanceKeyVaultKeyCI
20+
{
21+
$params = Get-SqlServerKeyVaultKeyTestEnvironmentParameters
22+
$managedInstance = Get-ManagedInstanceForTdeTest $params
23+
$mangedInstanceRg = $managedInstance.ResourceGroupName
24+
$managedInstanceName = $managedInstance.ManagedInstanceName
25+
$managedInstanceResourceId = $managedInstance.Id
26+
27+
# Test Add
28+
$keyResult = Add-AzSqlInstanceKeyVaultKey -ResourceGroupName $mangedInstanceRg -InstanceName $managedInstanceName -KeyId $params.keyId
29+
30+
Assert-AreEqual $params.keyId $keyResult.KeyId "KeyId mismatch after calling Add-AzSqlInstanceKeyVaultKey"
31+
Assert-AreEqual $params.serverKeyName $keyResult.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Add-AzSqlInstanceKeyVaultKey"
32+
33+
34+
# Test Get
35+
$keyResult2 = $managedInstance | Get-AzSqlInstanceKeyVaultKey -KeyId $params.keyId
36+
37+
Assert-AreEqual $params.keyId $keyResult2.KeyId "KeyId mismatch after calling Get-AzSqlInstanceKeyVaultKey"
38+
Assert-AreEqual $params.serverKeyName $keyResult2.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Get-AzSqlInstanceKeyVaultKey"
39+
40+
# Test List
41+
$keyResults = Get-AzSqlInstanceKeyVaultKey -InstanceResourceId $managedInstanceResourceId
42+
Assert-True {$keyResults.Count -gt 0} "List count <= 0 after calling (List) Get-AzSqlInstanceKeyVaultKey without KeyId"
43+
}
44+
45+
<#
46+
.SYNOPSIS
47+
Tests for managing TDE keyVaultKey in managed instance
48+
#>
49+
function Test-ManagedInstanceKeyVaultKey
50+
{
51+
$params = Get-SqlServerKeyVaultKeyTestEnvironmentParameters
52+
$managedInstance = Get-ManagedInstanceForTdeTest $params
53+
$mangedInstanceRg = $managedInstance.ResourceGroupName
54+
$managedInstanceName = $managedInstance.ManagedInstanceName
55+
56+
# Test Add
57+
$keyResult = Add-AzSqlInstanceKeyVaultKey -ResourceGroupName $mangedInstanceRg -InstanceName $managedInstanceName -KeyId $params.keyId
58+
59+
Assert-AreEqual $params.keyId $keyResult.KeyId "KeyId mismatch after calling Add-AzSqlInstanceKeyVaultKey"
60+
Assert-AreEqual $params.serverKeyName $keyResult.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Add-AzSqlInstanceKeyVaultKey"
61+
62+
63+
# Test Get
64+
$keyResult2 = Get-AzSqlInstanceKeyVaultKey -ResourceGroupName $mangedInstanceRg -InstanceName $managedInstanceName -KeyId $params.keyId
65+
66+
Assert-AreEqual $params.keyId $keyResult2.KeyId "KeyId mismatch after calling Get-AzSqlInstanceKeyVaultKey"
67+
Assert-AreEqual $params.serverKeyName $keyResult2.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Get-AzSqlInstanceKeyVaultKey"
68+
69+
# Test List
70+
$keyResults = Get-AzSqlInstanceKeyVaultKey -ResourceGroupName $mangedInstanceRg -InstanceName $managedInstanceName
71+
Assert-True {$keyResults.Count -gt 0} "List count <= 0 after calling (List) Get-AzSqlInstanceKeyVaultKey without KeyId"
72+
}
73+
74+
75+
<#
76+
.SYNOPSIS
77+
Tests for managing TDE keyVaultKey in managed instance using input object parameter set
78+
#>
79+
function Test-ManagedInstanceKeyVaultKeyInputObject
80+
{
81+
$params = Get-SqlServerKeyVaultKeyTestEnvironmentParameters
82+
$managedInstance = Get-ManagedInstanceForTdeTest $params
83+
$mangedInstanceRg = $managedInstance.ResourceGroupName
84+
$managedInstanceName = $managedInstance.ManagedInstanceName
85+
86+
# Test Add
87+
$keyResult = Add-AzSqlInstanceKeyVaultKey -Instance $managedInstance -KeyId $params.keyId
88+
89+
Assert-AreEqual $params.keyId $keyResult.KeyId "KeyId mismatch after calling Add-AzSqlInstanceKeyVaultKey"
90+
Assert-AreEqual $params.serverKeyName $keyResult.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Add-AzSqlInstanceKeyVaultKey"
91+
92+
93+
# Test Get
94+
$keyResult2 = Get-AzSqlInstanceKeyVaultKey -Instance $managedInstance -KeyId $params.keyId
95+
96+
Assert-AreEqual $params.keyId $keyResult2.KeyId "KeyId mismatch after calling Get-AzSqlInstanceKeyVaultKey"
97+
Assert-AreEqual $params.serverKeyName $keyResult2.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Get-AzSqlInstanceKeyVaultKey"
98+
99+
100+
# Test List
101+
$keyResults = Get-AzSqlInstanceKeyVaultKey -Instance $managedInstance
102+
103+
Assert-True {$keyResults.Count -gt 0} "List count <= 0 after calling (List) Get-AzSqlInstanceKeyVaultKey without KeyId"
104+
}
105+
106+
107+
<#
108+
.SYNOPSIS
109+
Tests for managing TDE keyVaultKey in managed instance using resource id parameter set
110+
#>
111+
function Test-ManagedInstanceKeyVaultKeyResourceId
112+
{
113+
$params = Get-SqlServerKeyVaultKeyTestEnvironmentParameters
114+
$managedInstance = Get-ManagedInstanceForTdeTest $params
115+
$mangedInstanceRg = $managedInstance.ResourceGroupName
116+
$managedInstanceName = $managedInstance.ManagedInstanceName
117+
$managedInstanceResourceId = $managedInstance.Id
118+
119+
# Test Add
120+
$keyResult = Add-AzSqlInstanceKeyVaultKey -InstanceResourceId $managedInstanceResourceId -KeyId $params.keyId
121+
122+
Assert-AreEqual $params.keyId $keyResult.KeyId "KeyId mismatch after calling Add-AzSqlInstanceKeyVaultKey"
123+
Assert-AreEqual $params.serverKeyName $keyResult.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Add-AzSqlInstanceKeyVaultKey"
124+
125+
126+
# Test Get
127+
$keyResult2 = Get-AzSqlInstanceKeyVaultKey -InstanceResourceId $managedInstanceResourceId -KeyId $params.keyId
128+
129+
Assert-AreEqual $params.keyId $keyResult2.KeyId "KeyId mismatch after calling Get-AzSqlInstanceKeyVaultKey"
130+
Assert-AreEqual $params.serverKeyName $keyResult2.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Get-AzSqlInstanceKeyVaultKey"
131+
132+
133+
# Test List
134+
$keyResults = Get-AzSqlInstanceKeyVaultKey -InstanceResourceId $managedInstanceResourceId
135+
136+
Assert-True {$keyResults.Count -gt 0} "List count <= 0 after calling (List) Get-AzSqlInstanceKeyVaultKey without KeyId"
137+
}
138+
139+
140+
<#
141+
.SYNOPSIS
142+
Tests for managing TDE keyVaultKey in managed instance using piping
143+
#>
144+
function Test-ManagedInstanceKeyVaultKeyPiping
145+
{
146+
$params = Get-SqlServerKeyVaultKeyTestEnvironmentParameters
147+
$managedInstance = Get-ManagedInstanceForTdeTest $params
148+
$mangedInstanceRg = $managedInstance.ResourceGroupName
149+
$managedInstanceName = $managedInstance.ManagedInstanceName
150+
151+
# Test Add
152+
$keyResult = $managedInstance | Add-AzSqlInstanceKeyVaultKey -KeyId $params.keyId
153+
154+
Assert-AreEqual $params.keyId $keyResult.KeyId "KeyId mismatch after calling Add-AzSqlInstanceKeyVaultKey"
155+
Assert-AreEqual $params.serverKeyName $keyResult.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Add-AzSqlInstanceKeyVaultKey"
156+
157+
158+
# Test Get
159+
$keyResult2 = $managedInstance | Get-AzSqlInstanceKeyVaultKey -KeyId $params.keyId
160+
161+
Assert-AreEqual $params.keyId $keyResult2.KeyId "KeyId mismatch after calling Get-AzSqlInstanceKeyVaultKey"
162+
Assert-AreEqual $params.serverKeyName $keyResult2.ManagedInstanceKeyName "ManagedInstanceKeyName mismatch after calling Get-AzSqlInstanceKeyVaultKey"
163+
164+
165+
# Test List
166+
$keyResults = $managedInstance | Get-AzSqlInstanceKeyVaultKey
167+
168+
Assert-True {$keyResults.Count -gt 0} "List count <= 0 after calling (List) Get-AzSqlInstanceKeyVaultKey without KeyId"
169+
}

0 commit comments

Comments
 (0)