Skip to content

Commit 785b3d7

Browse files
idear1203Dongwei Wang
idear1203
and
Dongwei Wang
authored
[Synapse] Add new cmdlets related to SQL rule baseline and sensitivity on Synapse SQL pool (#13759)
* Add 9 DW related cmdlets * Save current status * Revert ValueFromPipelineByPropertyName * Add workspaceName and resourceGroupName to PSSqlPool * Fix naming * Update help doc * update psd1 * Add SqlPoolName alias to basic SQL pool related commands * Add test cases for new cmdlets * Remove default parameter for Set-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline * Remove default parameter set * Update CredScan Suppressions and test case names * Update TestVulnerabilityAssessmentBaseline.json Co-authored-by: Dongwei Wang <[email protected]>
1 parent a6ba816 commit 785b3d7

File tree

84 files changed

+23976
-68
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

84 files changed

+23976
-68
lines changed

‎src/Synapse/Synapse.Test/ScenarioTests/Common.ps1

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -110,4 +110,30 @@ function Invoke-HandledCmdlet
110110
throw;
111111
}
112112
}
113+
}
114+
115+
<#
116+
.SYNOPSIS
117+
Creates the test environment needed to perform the Sql auditing tests
118+
#>
119+
function Create-TestEnvironmentWithParams ($params, $location, $denyAsNetworkRuleDefaultAction = $False)
120+
{
121+
Create-BasicTestEnvironmentWithParams $params $location
122+
Wait-Seconds 10
123+
}
124+
125+
<#
126+
.SYNOPSIS
127+
Creates the basic test environment needed to perform the Sql data security tests - resource group, server and database
128+
#>
129+
function Create-BasicTestEnvironmentWithParams ($params, $location)
130+
{
131+
New-AzResourceGroup -Name $params.rgname -Location $location
132+
New-AzStorageAccount -ResourceGroupName $params.rgname -Name $params.storageAccountName -Location $location -SkuName Standard_GRS -Kind StorageV2 -EnableHierarchicalNamespace $true
133+
$workspaceName = $params.workspaceName
134+
$workspaceLogin = $params.loginName
135+
$workspacePassword = $params.pwd
136+
$credentials = new-object System.Management.Automation.PSCredential($workspaceLogin, ($workspacePassword | ConvertTo-SecureString -asPlainText -Force))
137+
New-AzSynapseWorkspace -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -Location $location -SqlAdministratorLoginCredential $credentials -DefaultDataLakeStorageAccountName $params.storageAccountName -DefaultDataLakeStorageFilesystem $params.fileSystemName
138+
New-AzSynapseSqlPool -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName -PerformanceLevel $params.perfLevel
113139
}

‎src/Synapse/Synapse.Test/ScenarioTests/DataClassificationTests.cs

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.Azure.ServiceManagement.Common.Models;
16+
using Microsoft.WindowsAzure.Commands.ScenarioTest;
17+
using Xunit;
18+
19+
namespace Microsoft.Azure.Commands.Synapse.Test.ScenarioTests
20+
{
21+
public class DataClassificationTests : SynapseTestBase
22+
{
23+
public XunitTracingInterceptor _logger;
24+
25+
public DataClassificationTests(Xunit.Abstractions.ITestOutputHelper output)
26+
{
27+
_logger = new XunitTracingInterceptor(output);
28+
XunitTracingInterceptor.AddToContext(_logger);
29+
}
30+
31+
[Fact]
32+
[Trait(Category.AcceptanceType, Category.CheckIn)]
33+
public void TestDataClassificationOnSqlPool()
34+
{
35+
NewInstance.RunPsTest(
36+
_logger,
37+
"Test-DataClassificationOnSqlPool");
38+
}
39+
40+
[Fact]
41+
[Trait(Category.AcceptanceType, Category.CheckIn)]
42+
public void TestEnableDisableRecommendationsOnSqlPool()
43+
{
44+
NewInstance.RunPsTest(
45+
_logger,
46+
"Test-EnableDisableRecommendationsOnSqlPool");
47+
}
48+
}
49+
}

‎src/Synapse/Synapse.Test/ScenarioTests/DataClassificationTests.ps1

Lines changed: 362 additions & 0 deletions
Large diffs are not rendered by default.

‎src/Synapse/Synapse.Test/ScenarioTests/VulnerabilityAssessmentTests.cs

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
// ----------------------------------------------------------------------------------
2+
//
3+
// Copyright Microsoft Corporation
4+
// Licensed under the Apache License, Version 2.0 (the "License");
5+
// you may not use this file except in compliance with the License.
6+
// You may obtain a copy of the License at
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
// Unless required by applicable law or agreed to in writing, software
9+
// distributed under the License is distributed on an "AS IS" BASIS,
10+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
// See the License for the specific language governing permissions and
12+
// limitations under the License.
13+
// ----------------------------------------------------------------------------------
14+
15+
using Microsoft.Azure.ServiceManagement.Common.Models;
16+
using Microsoft.WindowsAzure.Commands.ScenarioTest;
17+
using System;
18+
using System.Collections.Generic;
19+
using System.Text;
20+
using Xunit;
21+
22+
namespace Microsoft.Azure.Commands.Synapse.Test.ScenarioTests
23+
{
24+
public class VulnerabilityAssessmentTests : SynapseTestBase
25+
{
26+
public XunitTracingInterceptor _logger;
27+
28+
public VulnerabilityAssessmentTests(Xunit.Abstractions.ITestOutputHelper output)
29+
{
30+
_logger = new XunitTracingInterceptor(output);
31+
XunitTracingInterceptor.AddToContext(_logger);
32+
}
33+
34+
[Fact]
35+
[Trait(Category.AcceptanceType, Category.CheckIn)]
36+
public void TestVulnerabilityAssessmentBaseline(){
37+
NewInstance.RunPsTest(
38+
_logger,
39+
"Test-VulnerabilityAssessmentBaseline");
40+
}
41+
}
42+
}

‎src/Synapse/Synapse.Test/ScenarioTests/VulnerabilityAssessmentTests.ps1

Lines changed: 199 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,199 @@
1+
# ----------------------------------------------------------------------------------
2+
#
3+
# Copyright Microsoft Corporation
4+
# Licensed under the Apache License, Version 2.0 (the "License");
5+
# you may not use this file except in compliance with the License.
6+
# You may obtain a copy of the License at
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
# ----------------------------------------------------------------------------------
14+
15+
<#
16+
.SYNOPSIS
17+
Tests for vulnerability assessment baseline scenarios
18+
#>
19+
function Test-VulnerabilityAssessmentBaseline
20+
{
21+
# Setup
22+
$testSuffix = getAssetName
23+
Create-VulnerabilityAssessmentTestEnvironment $testSuffix
24+
$params = Get-SqlVulnerabilityAssessmentTestEnvironmentParameters $testSuffix
25+
26+
try
27+
{
28+
# Turn on ATP
29+
Enable-AzSynapseSqlAdvancedThreatProtection -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -DoNotConfigureVulnerabilityAssessment
30+
31+
Update-AzSynapseSqlPoolVulnerabilityAssessmentSetting -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName `
32+
-StorageAccountName $params.storageAccountName
33+
34+
$ruleId = "VA2108"
35+
36+
# Get and remove baseline for non existing baseline
37+
$baselineDoesntExistsErrorMessage = "Baseline does not exist for rule 'VA2108'."
38+
Assert-ThrowsContains -script { Get-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName `
39+
-SqlPoolName $params.sqlPoolName -RuleId $ruleId } -message $baselineDoesntExistsErrorMessage
40+
41+
Assert-ThrowsContains -script { Clear-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName `
42+
-SqlPoolName $params.sqlPoolName -RuleId $ruleId } -message $baselineDoesntExistsErrorMessage
43+
44+
# Set baseline
45+
$baselineToSet = @( 'Principal1', 'db_ddladmin', 'SQL_USER', 'None'), @( 'Principal2', 'db_ddladmin', 'SQL_USER', 'None')
46+
Set-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName `
47+
-RuleId $ruleId -BaselineResult $baselineToSet
48+
49+
# Get baseline and compare with what we sent
50+
$baseline = Get-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName `
51+
-RuleId $ruleId
52+
53+
Assert-AreEqual $params.rgname $baseline.ResourceGroupName
54+
Assert-AreEqual $params.workspaceName $baseline.WorkspaceName
55+
Assert-AreEqual $params.sqlPoolName $baseline.SqlPoolName
56+
Assert-AreEqual $ruleId $baseline.RuleId
57+
Assert-AreEqual $false $baseline.RuleAppliesToMaster
58+
Assert-AreEqualArray $baselineToSet[0] $baseline.BaselineResult[0].Result
59+
Assert-AreEqualArray $baselineToSet[1] $baseline.BaselineResult[1].Result
60+
61+
# Set baseline
62+
$baselineToSet = @( 'Principal3', 'db_ddladmin', 'SQL_USER', 'None'), @( 'Principal4', 'db_ddladmin', 'SQL_USER', 'None')
63+
Set-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName `
64+
-RuleId $ruleId -BaselineResult $baselineToSet
65+
66+
# Get baseline and compare with what we sent
67+
$baseline = Get-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName `
68+
-RuleId $ruleId
69+
70+
Assert-AreEqual $params.rgname $baseline.ResourceGroupName
71+
Assert-AreEqual $params.workspaceName $baseline.WorkspaceName
72+
Assert-AreEqual $params.sqlPoolName $baseline.SqlPoolName
73+
Assert-AreEqual $ruleId $baseline.RuleId
74+
Assert-AreEqual $false $baseline.RuleAppliesToMaster
75+
Assert-AreEqualArray $baselineToSet[0] $baseline.BaselineResult[0].Result
76+
Assert-AreEqualArray $baselineToSet[1] $baseline.BaselineResult[1].Result
77+
78+
# Clear baseline
79+
Clear-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName `
80+
-SqlPoolName $params.sqlPoolName -RuleId $ruleId
81+
82+
# Get and remove baseline for non existing baseline
83+
Assert-ThrowsContains -script { Get-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName `
84+
-SqlPoolName $params.sqlPoolName -RuleId $ruleId } -message $baselineDoesntExistsErrorMessage
85+
86+
Assert-ThrowsContains -script { Clear-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName `
87+
-SqlPoolName $params.sqlPoolName -RuleId $ruleId } -message $baselineDoesntExistsErrorMessage
88+
89+
# Test RuleAppliesToMaster parameter
90+
Set-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName `
91+
-RuleId $ruleId -BaselineResult $baselineToSet
92+
93+
# We expect no baseline to be found on the master
94+
Assert-ThrowsContains -script { Get-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName `
95+
-SqlPoolName $params.sqlPoolName -RuleId $ruleId -RuleAppliesToMaster } -message $baselineDoesntExistsErrorMessage
96+
97+
Assert-ThrowsContains -script { Clear-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName `
98+
-SqlPoolName $params.sqlPoolName -RuleId $ruleId -RuleAppliesToMaster} -message $baselineDoesntExistsErrorMessage
99+
100+
Set-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName `
101+
-RuleId $ruleId -RuleAppliesToMaster -BaselineResult $baselineToSet
102+
103+
$baseline = Get-AzSynapseSqlPool -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName`
104+
| Get-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -RuleId $ruleId -RuleAppliesToMaster
105+
Assert-AreEqual $params.rgname $baseline.ResourceGroupName
106+
Assert-AreEqual $params.workspaceName $baseline.WorkspaceName
107+
Assert-AreEqual $params.sqlPoolName $baseline.SqlPoolName
108+
Assert-AreEqual $ruleId $baseline.RuleId
109+
Assert-AreEqual $true $baseline.RuleAppliesToMaster
110+
Assert-AreEqualArray $baselineToSet[0] $baseline.BaselineResult[0].Result
111+
Assert-AreEqualArray $baselineToSet[1] $baseline.BaselineResult[1].Result
112+
113+
Clear-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName `
114+
-RuleId $ruleId -RuleAppliesToMaster
115+
116+
# piping scenario
117+
Set-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName `
118+
-RuleId $ruleId -BaselineResult $baselineToSet
119+
120+
Get-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName `
121+
-RuleId $ruleId | Set-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline
122+
123+
$baseline = Get-AzSynapseSqlPool -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName | Get-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline `
124+
-RuleId $ruleId
125+
Assert-AreEqual $params.rgname $baseline.ResourceGroupName
126+
Assert-AreEqual $params.workspaceName $baseline.WorkspaceName
127+
Assert-AreEqual $params.sqlPoolName $baseline.SqlPoolName
128+
Assert-AreEqual $ruleId $baseline.RuleId
129+
Assert-AreEqual $false $baseline.RuleAppliesToMaster
130+
Assert-AreEqualArray $baselineToSet[0] $baseline.BaselineResult[0].Result
131+
Assert-AreEqualArray $baselineToSet[1] $baseline.BaselineResult[1].Result
132+
133+
Get-AzSynapseSqlPool -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName | Clear-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline `
134+
-RuleId $ruleId
135+
Assert-ThrowsContains -script { Get-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName `
136+
-SqlPoolName $params.sqlPoolName -RuleId $ruleId } -message $baselineDoesntExistsErrorMessage
137+
138+
# Test WhatIf parameter of Set-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline
139+
Set-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName `
140+
-RuleId $ruleId -BaselineResult $baselineToSet -WhatIf
141+
142+
# See that exception is thrown because set settings was run with WhatIf
143+
Assert-ThrowsContains -script { Clear-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName `
144+
-RuleId $ruleId } -message $baselineDoesntExistsErrorMessage
145+
146+
# Test WhatIf parameter of Clear-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline
147+
Set-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName `
148+
-RuleId $ruleId -BaselineResult $baselineToSet
149+
150+
Clear-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName `
151+
-SqlPoolName $params.sqlPoolName -RuleId $ruleId -WhatIf
152+
153+
# See no exception is thrown because clear was run with WhatIf
154+
Clear-AzSynapseSqlPoolVulnerabilityAssessmentRuleBaseline -ResourceGroupName $params.rgname -WorkspaceName $params.workspaceName -SqlPoolName $params.sqlPoolName `
155+
-RuleId $ruleId
156+
}
157+
finally
158+
{
159+
# Cleanup
160+
Remove-VulnerabilityAssessmentTestEnvironment $testSuffix
161+
}
162+
}
163+
164+
<#
165+
.SYNOPSIS
166+
Creates the test environment needed to perform the tests
167+
#>
168+
function Create-VulnerabilityAssessmentTestEnvironment ($testSuffix, $location = "West Central US")
169+
{
170+
$params = Get-SqlVulnerabilityAssessmentTestEnvironmentParameters $testSuffix
171+
Create-TestEnvironmentWithParams $params $location
172+
}
173+
174+
<#
175+
.SYNOPSIS
176+
Gets the values of the parameters used at the tests
177+
#>
178+
function Get-SqlVulnerabilityAssessmentTestEnvironmentParameters ($testSuffix)
179+
{
180+
return @{ rgname = "sql-va-cmdlet-test-rg" +$testSuffix;
181+
workspaceName = "sqlvaws" +$testSuffix;
182+
sqlPoolName = "sqlvapool" + $testSuffix;
183+
storageAccountName = "sqlvastorage" + $testSuffix;
184+
fileSystemName = "sqlvacmdletfs" + $testSuffix;
185+
loginName = "testlogin";
186+
pwd = "testp@ssMakingIt1007Longer";
187+
perfLevel = 'DW200c'
188+
}
189+
}
190+
191+
<#
192+
.SYNOPSIS
193+
Removes the test environment that was needed to perform the tests
194+
#>
195+
function Remove-VulnerabilityAssessmentTestEnvironment ($testSuffix)
196+
{
197+
$params = Get-SqlVulnerabilityAssessmentTestEnvironmentParameters $testSuffix
198+
Remove-AzResourceGroup -Name $params.rgname -Force
199+
}

0 commit comments

Comments
 (0)