Skip to content

Commit 746145d

Browse files
BethanyZhouisra-felYeming Liu
committed
[KeyVault] Managed HSM (#13259)
* Enable MHSM Management via *-AzKeyVault (#12575) * Support creating a MHSM pool. * Supporting querying MHSM objects * Support deleting MHSM * Support updating mhsm * Add test cases * Hide unavailable services * Add test cases * expose EnablePurgeProtection for MHSM * correct indent of ps1xml * upload localfeed * Hide enablePurgeProtection * Update ChangeLog.md and help.md * Modify codes according to comments * Update help.md * Update VaultCreationParameters.cs * Update get-azkeyvault.md * Update KeyVaultManagementTests.ps1 * Record scenario test for Managed Hsm (#12631) * Record scenario tests for managed hsm * add default parameter set for * Re-record scenario tests. * [KeyVault] Update to official SDK (#12767) * local 3.1.0 sdk * Use production key vault mgmt sdk * remove security domain from format xml * combine track 1&2 sdk (#13018) * combine track 1&2 sdk * update azure.core to 1.5.0 * add exception; revert addkeyvaultkey * add dll to psd1 * fix exception * Detach managed hsm from key vault command (#13187) * get managed hsm * new managed hsm * remove managed hsm * update help.md * update managed hsm * add online version for new help.md * Convert mhsm test to liveonly * add test record * Support data plane of managed HSM (#13216) * create managed hsm key * get managed hsm key * remove managed hsm key * update managed hsm key * undo managed hsm key removal * back up and restore managed hsm key * add help.md * import/download managed hsm RSA key * Update help.md * Update changelog.md * suppress signature issues * Update all help markdowns * add logger for track2sdk * add metadata for oct-HSM Co-authored-by: Yeming Liu <[email protected]> * Limit KeyType to be required only when create managed HSM key (#13242) * limit KeyType to be required only when create managed HSM key * add pester test * Security domain (#13226) * wip * wip * wip * wip * wip * wip * support securestring * wip * wip * wip * generate docs * docs & error handling * move crypto alg inside security domain * resource strings * remove extra code * write help markdown * resolve relative path to absolute path * suppress signature issues Co-authored-by: Yeming Liu <[email protected]> Co-authored-by: Beisi Zhou <[email protected]> Co-authored-by: Beisi Zhou <[email protected]> * remove pfx file * full backup restore + rbac (#13261) Co-authored-by: Yeming Liu <[email protected]> * small fixes changelog; azure.core; sdk version; online version; breaking change csv; shared assembly conflict; failed tests; * license of BouncyCastle.NetCore * remove local feed Co-authored-by: Yeming Liu <[email protected]> Co-authored-by: Yeming Liu <[email protected]>
1 parent 42727bb commit 746145d

File tree

130 files changed

+18537
-1736
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

130 files changed

+18537
-1736
lines changed

‎LICENSE.txt

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,5 +223,19 @@ Permission is hereby granted, free of charge, to any person obtaining a copy of
223223
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
224224
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
225225

226+
***************
227+
228+
The software includes BouncyCastle.NetCore. The MIT License set out below is provided for informational purposes only. It is not the license that governs any part of the software.
229+
230+
BouncyCastle.NetCore
231+
232+
LICENSE
233+
Copyright (c) 2000 - 2020 The Legion of the Bouncy Castle Inc. (https://www.bouncycastle.org)
234+
235+
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
236+
237+
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
238+
239+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
226240
-------------END OF THIRD PARTY NOTICE----------------------------------------
227241

‎src/Compute/Compute.Test/Compute.Test.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<ItemGroup>
1414
<PackageReference Include="Microsoft.Azure.Graph.RBAC" Version="3.4.0-preview" />
1515
<PackageReference Include="Microsoft.Azure.Management.Compute" Version="39.0.0" />
16-
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.0.0" />
16+
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.1.0-preview.2" />
1717
<PackageReference Include="Microsoft.Azure.Management.Network" Version="20.1.1" />
1818
</ItemGroup>
1919

‎src/EventHub/EventHub.Test/EventHub.Test.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<ItemGroup>
1414
<PackageReference Include="Microsoft.Azure.KeyVault" Version="3.0.5" />
1515
<PackageReference Include="Microsoft.Azure.Management.EventHub" Version="2.7.2" />
16-
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.0.0" />
16+
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.1.0-preview.2" />
1717
</ItemGroup>
1818

1919
<ItemGroup>

‎src/HDInsight/HDInsight.Test/HDInsight.Test.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
<PackageReference Include="Microsoft.Azure.KeyVault" Version="3.0.5" />
1515
<PackageReference Include="Microsoft.Azure.Management.HDInsight" Version="5.6.0" />
1616
<PackageReference Include="Microsoft.Azure.Management.HDInsight.Job" Version="2.0.7" />
17-
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.0.0" />
17+
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.1.0-preview.2" />
1818
<PackageReference Include="Microsoft.Azure.Management.ManagedServiceIdentity" Version="0.11.0" />
1919
<PackageReference Include="Microsoft.Azure.Management.Network" Version="20.1.1" />
2020
<PackageReference Include="Microsoft.Azure.Management.OperationalInsights" Version="0.21.0-preview" />

‎src/KeyVault/KeyVault.Test/KeyVault.Test.csproj

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,10 @@
1313
<ItemGroup>
1414
<PackageReference Include="Microsoft.Azure.KeyVault" Version="3.0.1" />
1515
<PackageReference Include="Microsoft.Azure.KeyVault.WebKey" Version="3.0.1" />
16-
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.0.0" />
16+
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.1.0-preview.2" />
17+
<PackageReference Include="Microsoft.IdentityModel.Tokens" Version="5.6.0">
18+
<NoWarn>NU1608</NoWarn>
19+
</PackageReference>
1720
<PackageReference Include="Microsoft.Azure.Management.Network" Version="20.1.1" />
1821
</ItemGroup>
1922

@@ -23,7 +26,10 @@
2326

2427
<ItemGroup>
2528
<None Update="Scripts\ControlPlane\KeyVaultManagementTests.ps1" CopyToOutputDirectory="PreserveNewest" />
26-
<None Update="Resources\pshtest.pfx" CopyToOutputDirectory="PreserveNewest" />
29+
</ItemGroup>
30+
31+
<ItemGroup>
32+
<Folder Include="ScenarioTests\PesterTests\" />
2733
</ItemGroup>
2834

2935
</Project>

‎src/KeyVault/KeyVault.Test/Models/UtilitiesTests.cs

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -58,22 +58,5 @@ public void GetWebKeyFromByok()
5858
Assert.True(webKey.T.SequenceEqual(byokBlob));
5959
Assert.Equal(webKey.Kty, JsonWebKeyType.RsaHsm);
6060
}
61-
62-
[Fact]
63-
[Trait(Category.AcceptanceType, Category.CheckIn)]
64-
public void GetWebKeyFromCertificate()
65-
{
66-
string password = "123";
67-
// This allows the test to run in Visual Studio and in the console runner. The file will exist in one of the two locations depending on the environment.
68-
var consolePath = Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location) ?? String.Empty, "Resources", "pshtest.pfx");
69-
var vsPath = Path.Combine(Directory.GetCurrentDirectory(), "Resources", "pshtest.pfx");
70-
71-
IWebKeyConverter converters = WebKeyConverterFactory.CreateConverterChain();
72-
var webKey = converters.ConvertKeyFromFile(new FileInfo(File.Exists(consolePath) ? consolePath : vsPath), password.ConvertToSecureString());
73-
74-
Assert.True(webKey.HasPrivateKey());
75-
Assert.True(webKey.IsValid());
76-
Assert.Equal(webKey.Kty, JsonWebKeyType.Rsa);
77-
}
7861
}
7962
}

‎src/KeyVault/KeyVault.Test/PesterTests/ManagedHsmDatePlaneTests.Tests.ps1

Lines changed: 172 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,172 @@
1+
$here = Split-Path -Parent $MyInvocation.MyCommand.Path
2+
$sut = (Split-Path -Leaf $MyInvocation.MyCommand.Path) -replace '\.Tests\.', '.'
3+
. "$here\$sut"
4+
5+
BeforeAll {
6+
. $PSScriptRoot/ManagedHsmDatePlaneTests.ps1
7+
ImportModules
8+
$hsmName = GetAzManagedHsm
9+
}
10+
11+
Describe "AddAzManagedHsmKey" {
12+
It "Create a RSA key inside a managed HSM" {
13+
$keyName = GetRandomName -Prefix "key"
14+
$keyType = "RSA"
15+
$rsaKey = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType $keyType
16+
$rsaKey.VaultName | Should -BeExactly $hsmName
17+
$rsaKey.Name | Should -BeExactly $keyName
18+
$rsaKey.Attributes.KeyType | Should -Be "RSA-HSM"
19+
}
20+
21+
It "Create an EC key with curve P-256 inside a managed HSM" {
22+
$keyName = GetRandomName -Prefix "key"
23+
$keyType = "EC"
24+
$curveName = "P-256"
25+
$rsaKey = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType $keyType -CurveName $curveName
26+
$rsaKey.VaultName | Should -BeExactly $hsmName
27+
$rsaKey.Name | Should -BeExactly $keyName
28+
$rsaKey.Attributes.KeyType | Should -Be "EC-HSM"
29+
$rsaKey.Key.CurveName | Should -Be $curveName
30+
}
31+
32+
It "Create an oct key inside a managed HSM" {
33+
$keyName = GetRandomName -Prefix "key"
34+
$keyType = "oct"
35+
$rsaKey = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType $keyType
36+
$rsaKey.VaultName | Should -BeExactly $hsmName
37+
$rsaKey.Name | Should -BeExactly $keyName
38+
$rsaKey.Attributes.KeyType | Should -Be "oct-HSM"
39+
}
40+
41+
It "Create an oct key inside a managed HSM" {
42+
$keyName = GetRandomName -Prefix "key"
43+
$keyType = "oct"
44+
$rsaKey = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType $keyType
45+
$rsaKey.VaultName | Should -BeExactly $hsmName
46+
$rsaKey.Name | Should -BeExactly $keyName
47+
$rsaKey.Attributes.KeyType | Should -Be "oct-HSM"
48+
}
49+
50+
It "Create a key with non-default values inside a managed HSM" {
51+
$keyName = GetRandomName -Prefix "key"
52+
$keyType = "RSA"
53+
$KeyOps = 'decrypt', 'verify'
54+
# Expires & NotBefore is hard to cmpare, may add in the furture
55+
$Tags = @{'Severity' = 'high'; 'Accounting' = "true"}
56+
57+
$key = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType $keyType -KeyOps $KeyOps -Disable -Tag $Tags
58+
59+
$key.Attributes.KeyOps | Should -Be $KeyOps
60+
$key.Tags.Count | Should -Be 2
61+
$key.Enabled | Should -Be $false
62+
}
63+
64+
# It "Import a RSA key from pfx file into a managed HSM" {
65+
# $keyName = GetRandomName -Prefix "key"
66+
# $keyFilePath = Join-Path $PSScriptRoot ../Resources/testImportKey.pfx -Resolve
67+
# $keyFilePwd = $null
68+
# $key = Add-AzManagedHsmKey -HsmName bezmhsm -Name $keyName -KeyFilePath $keyFilePath -KeyFilePassword $keyFilePwd
69+
# $key.Name | Should -BeExactly $keyName
70+
# }
71+
}
72+
73+
Describe "GetAzManagedHsmKey"{
74+
It "List all the keys in a managed HSM" {
75+
$keyName = GetRandomName -Prefix "key"
76+
Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType "RSA"
77+
$keys = Get-AzManagedHsmKey -HsmName $hsmName
78+
$keys.Count | Should -BeGreaterThan 0
79+
}
80+
81+
It "Get a specific key in a managed HSM" {
82+
$keyName = GetRandomName -Prefix "key"
83+
$key = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType "RSA"
84+
$got = Get-AzManagedHsmKey -HsmName $hsmName -KeyName $keyName
85+
$got.Id | Should -Be $key.Id
86+
}
87+
88+
It "List all the keys that have been deleted in a managed HSM" {
89+
$keyName = GetRandomName -Prefix "key"
90+
$key = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType "RSA"
91+
Remove-AzManagedHsmKey -HsmName $hsmName -Name $keyName
92+
$deletedKey = Get-AzManagedHsmKey -HsmName $hsmName -KeyName $keyName -InRemovedState
93+
$deletedKey.Id | Should -Be $key.Id
94+
}
95+
96+
It "Download a key from a managed HSM" {
97+
$keyName = GetRandomName -Prefix "key"
98+
Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType "RSA"
99+
$filePath = "$PSScriptRoot\public.pem"
100+
Get-AzManagedHsmKey -HsmName $hsmName -KeyName $keyName -OutFile $filePath
101+
$filePath | Should -Exist
102+
}
103+
}
104+
105+
Describe "RemoveAzManagedHsmKey"{
106+
It "Remove a key from a managed HSM" {
107+
$keyName = GetRandomName -Prefix "key"
108+
$key = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType "RSA"
109+
$deletedKey = Remove-AzManagedHsmKey -HsmName $hsmName -Name $keyName -Force -PassThru
110+
$deletedKey.Id | Should -Be $key.Id
111+
}
112+
113+
It "Purge a deleted key from a managed HSM" {
114+
$keyName = GetRandomName -Prefix "key"
115+
Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType "RSA"
116+
Remove-AzManagedHsmKey -HsmName $hsmName -Name $keyName -Force -PassThru
117+
Remove-AzManagedHsmKey -HsmName $hsmName -Name $keyName -InRemovedState -Force -PassThru
118+
$deletedKey = Get-AzManagedHsmKey -HsmName $hsmName -Name $keyName -InRemovedState
119+
$deletedKey | Should -Be $null
120+
}
121+
122+
It "Remove keys by using piping" {
123+
Get-AzManagedHsmKey -HsmName $hsmName | Remove-AzManagedHsmKey -Force
124+
$keys = Get-AzManagedHsmKey -HsmName $hsmName
125+
$keys.Count | Should -Be 0
126+
}
127+
}
128+
129+
Describe "UpdateAzManagedHsmKey"{
130+
It "Enable a key and set tags" {
131+
$keyName = GetRandomName -Prefix "key"
132+
$key = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType "RSA" -Disable
133+
$Tags = @{'Severity' = 'high'; 'Accounting' = 'true'}
134+
135+
$updatedKey = Update-AzManagedHsmKey -HsmName $hsmName -Name $keyName -Enable $True -Tag $Tags -PassThru
136+
137+
$updatedKey.Id | Should -Be $key.Id
138+
$updatedKey.Enabled | Should -Be $True
139+
$updatedKey.Tags.Count | Should -Be 2
140+
}
141+
}
142+
143+
Describe "UndoAzManagedHsmKeyRemoval"{
144+
It "Undo a key removal" {
145+
$keyName = GetRandomName -Prefix "key"
146+
$key = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType "RSA"
147+
$deletedKey = Remove-AzManagedHsmKey -HsmName $hsmName -Name $keyName -Force -PassThru
148+
$recoveredKey = $deletedKey | Undo-AzManagedHsmKeyRemoval
149+
$recoveredKey.Id | Should -Be $key.Id
150+
}
151+
}
152+
153+
Describe "BackupAndRetoreAzManagedHsmKey"{
154+
It "Backup and retore a key" {
155+
$keyName = GetRandomName -Prefix "key"
156+
$key = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType "RSA"
157+
$filePath = "$PSScriptRoot/backupkey.blob"
158+
$key | Backup-AzManagedHsmKey -OutputFile $filePath -Force
159+
$filePath | Should -Exist
160+
161+
Remove-AzManagedHsmKey -HsmName $hsmName -Name $keyName -Force
162+
Remove-AzManagedHsmKey -HsmName $hsmName -Name $keyName -InRemovedState -Force
163+
$restoredKey = Restore-AzManagedHsmKey -HsmName $hsmName -InputFile $filePath
164+
$restoredKey.Id | Should -Be $key.Id
165+
}
166+
}
167+
168+
# to do: manually remove all stuffs in resource group
169+
# AfterAll {
170+
# $hsm = Get-AzManagedHsm -Name $hsmName
171+
# Remove-AzResourceGroup -Name $hsm.ResourceGroupName -Force
172+
# }

‎src/KeyVault/KeyVault.Test/PesterTests/ManagedHsmDatePlaneTests.ps1

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
function GetAzManagedHsm{
2+
Param(
3+
[parameter(Mandatory=$false)]
4+
[String]
5+
$HsmName,
6+
[parameter(Mandatory=$false)]
7+
[String]
8+
$ResourceGroupName,
9+
[parameter(Mandatory=$false)]
10+
[String]
11+
$Location,
12+
[parameter(Mandatory=$false)]
13+
[String[]]
14+
$Administrator
15+
)
16+
$hsmName = GetRandomName -Prefix "hsm"
17+
$resourceGroupName = GetRandomName -Prefix "rg"
18+
$Location = "eastus2euap"
19+
$administrator = "c1be1392-39b8-4521-aafc-819a47008545"
20+
$hsm = New-AzManagedHsm -Name $HsmName -ResourceGroupName $ResourceGroupName -Location $r -Administrator $Administrator
21+
return $hsm
22+
}
23+
24+
function GetRandomName{
25+
Param(
26+
[parameter(Mandatory=$false)]
27+
[String]
28+
$Prefix
29+
)
30+
$randomNum = Get-Random -Minimum 100 -Maximum 99999
31+
return "$Prefix$randomNum"
32+
}
33+
34+
function ImportModules{
35+
$psd1Path = Join-Path $PSScriptRoot "../../../../artifacts/Debug/" -Resolve
36+
$accountsPsd1 = Join-Path $psd1Path "./Az.Accounts/Az.Accounts.psd1" -Resolve
37+
$keyVaultPsd1 = Join-Path $psd1Path "./Az.KeyVault/Az.KeyVault.psd1" -Resolve
38+
Import-Module $accountsPsd1
39+
Import-Module $keyVaultPsd1
40+
}

‎src/KeyVault/KeyVault.Test/ScenarioTests/ManagedHsmManagementTests.cs

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
using Microsoft.WindowsAzure.Commands.ScenarioTest;
2+
using System;
3+
using System.Collections.Generic;
4+
using System.Text;
5+
using Xunit;
6+
7+
namespace Microsoft.Azure.Commands.KeyVault.Test.ScenarioTests
8+
{
9+
public class ManagedHsmManagementTests: KeyVaultTestRunner
10+
{
11+
public ManagedHsmManagementTests(Xunit.Abstractions.ITestOutputHelper output) : base(output)
12+
{
13+
}
14+
15+
[Fact]
16+
[Trait(Category.AcceptanceType, Category.CheckIn)]
17+
public void TestManagedHsmCRUD()
18+
{
19+
TestRunner.RunTestScript("Test-ManagedHsmCRUD");
20+
}
21+
}
22+
}

‎src/KeyVault/KeyVault.Test/ScenarioTests/ManagedHsmManagementTests.ps1

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# ----------------------------------------------------------------------------------
2+
#
3+
# Copyright Microsoft Corporation
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
# ----------------------------------------------------------------------------------
14+
15+
<#
16+
.SYNOPSIS
17+
Tests CRUD for Managed Hsm.
18+
#>
19+
function Test-ManagedHsmCRUD {
20+
$rgName = getAssetName
21+
$rgLocation = Get-Location "Microsoft.Resources" "resourceGroups" "West US"
22+
$hsmName = getAssetName
23+
$hsmLocation = Get-Location "Microsoft.KeyVault" "managedHSMs" "East US 2"
24+
$administrator = "c1be1392-39b8-4521-aafc-819a47008545"
25+
New-AzResourceGroup -Name $rgName -Location $rgLocation
26+
27+
try {
28+
# Test create a default managed HSM
29+
$hsm = New-AzManagedHsm -Name $hsmName -ResourceGroupName $rgName -Location $hsmLocation -Administrator $administrator
30+
Assert-AreEqual $hsmName $hsm.Name
31+
Assert-AreEqual $rgName $hsm.ResourceGroupName
32+
Assert-AreEqual $hsmLocation $hsm.Location
33+
Assert-AreEqual 1 $hsm.InitialAdminObjectIds.Count
34+
Assert-True { $hsm.InitialAdminObjectIds.Contains($administrator) }
35+
Assert-AreEqual "StandardB1" $hsm.Sku
36+
37+
# Default retention days
38+
Assert-AreEqual 90 $hsm.SoftDeleteRetentionInDays "By default SoftDeleteRetentionInDays should be 90"
39+
40+
# Test get managed HSM
41+
$got = Get-AzManagedHsm -Name $hsmName
42+
Assert-NotNull $got
43+
Assert-AreEqual $hsmName $got.Name
44+
Assert-AreEqual $rgName $got.ResourceGroupName
45+
Assert-AreEqual $hsmLocation $got.Location
46+
47+
# Test throws for existing managed HSM
48+
Assert-Throws { New-AzManagedHsm -Name $hsmName -ResourceGroupName $rgName -Location $hsmLocation -Administrator $administrator }
49+
50+
# Test remove managed HSM
51+
Remove-AzManagedHsm -InputObject $got -Force
52+
$deletedMhsm = Get-AzManagedHsm -Name $hsmName -ResourceGroupName $rgName
53+
Assert-Null $deletedMhsm
54+
55+
# Test throws for resourcegroup nonexistent
56+
Assert-Throws { New-AzManagedHsm -Name (getAssetName) -ResourceGroupName (getAssetName) -Location $hsmLocation -Administrator $administrator }
57+
}
58+
59+
finally {
60+
Remove-AzResourceGroup -Name $rgName -Force
61+
}
62+
}

0 commit comments

Comments
 (0)