Skip to content

Commit 78d3aae

Browse files
cormacpaynecormacpayne
authored
Merge pull request #4990 from ranisha2/preview
SQL Auditing: Remove AUDIT_CHANGE_GROUP from available AuditActionGroups
2 parents b1845a1 + 8f19f74 commit 78d3aae

10 files changed

+63
-26
lines changed

‎src/ResourceManager/Sql/ChangeLog.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@
1919
-->
2020
## Current Release
2121
* Added ability to rename database using Set-AzureRmSqlDatabase
22+
* Fixed issue https://github.com/Azure/azure-powershell/issues/4974
23+
- Providing invalid AUDIT_CHANGED_GROUP value for auditing cmdlets no longer throws an error and will be removed in an upcoming release.
2224
* Fixed issue https://github.com/Azure/azure-powershell/issues/5046
2325
- AuditAction parameter in auditing cmdlets is no longer being ignored
2426
* Fixed an issue in Auditing cmdlets when 'Secondary' StorageKeyType is provided

‎src/ResourceManager/Sql/Commands.Sql/Auditing/Cmdlet/AuditingSettings/SqlDatabaseAuditingCmdletBase.cs

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,12 @@
1313
// ----------------------------------------------------------------------------------
1414

1515
using System;
16+
using System.Linq;
1617
using Microsoft.Azure.Commands.Common.Authentication.Models;
1718
using Microsoft.Azure.Commands.Sql.Auditing.Model;
1819
using Microsoft.Azure.Commands.Sql.Auditing.Services;
1920
using Microsoft.Azure.Commands.Sql.Common;
21+
using Microsoft.Azure.Commands.Sql.Properties;
2022
using Microsoft.Azure.Commands.Common.Authentication.Abstractions;
2123

2224
namespace Microsoft.Azure.Commands.Sql.Auditing.Cmdlet
@@ -54,6 +56,15 @@ protected override SqlAuditAdapter InitModelAdapter(IAzureSubscription subscript
5456
/// <param name="model">The model object with the data to be sent to the REST endpoints</param>
5557
protected override DatabaseBlobAuditingSettingsModel PersistChanges(DatabaseBlobAuditingSettingsModel model)
5658
{
59+
if (Array.IndexOf(model.AuditActionGroup, AuditActionGroups.AUDIT_CHANGE_GROUP) > -1)
60+
{
61+
// AUDIT_CHANGE_GROUP is not supported.
62+
WriteWarning(Resources.auditChangeGroupDeprecationMessage);
63+
64+
// Remove it
65+
model.AuditActionGroup = model.AuditActionGroup.Where(v => v != AuditActionGroups.AUDIT_CHANGE_GROUP).ToArray();
66+
}
67+
5768
ModelAdapter.SetDatabaseBlobAuditingPolicyV2(model, DefaultContext.Environment.GetEndpoint(AzureEnvironment.Endpoint.StorageEndpointSuffix));
5869

5970
return null;

‎src/ResourceManager/Sql/Commands.Sql/Auditing/Cmdlet/AuditingSettings/SqlServerAuditingCmdletBase.cs

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,15 @@
1212
// limitations under the License.
1313
// ----------------------------------------------------------------------------------
1414

15+
using System;
16+
using System.Linq;
17+
using System.Management.Automation;
1518
using Microsoft.Azure.Commands.Common.Authentication.Abstractions;
1619
using Microsoft.Azure.Commands.Common.Authentication.Models;
1720
using Microsoft.Azure.Commands.Sql.Auditing.Model;
1821
using Microsoft.Azure.Commands.Sql.Auditing.Services;
1922
using Microsoft.Azure.Commands.Sql.Common;
20-
using System.Management.Automation;
23+
using Microsoft.Azure.Commands.Sql.Properties;
2124

2225
namespace Microsoft.Azure.Commands.Sql.Auditing.Cmdlet
2326
{
@@ -61,6 +64,15 @@ protected override SqlAuditAdapter InitModelAdapter(IAzureSubscription subscript
6164
/// <param name="baseModel">The model object with the data to be sent to the REST endpoints</param>
6265
protected override ServerBlobAuditingSettingsModel PersistChanges(ServerBlobAuditingSettingsModel baseModel)
6366
{
67+
if (Array.IndexOf(baseModel.AuditActionGroup, AuditActionGroups.AUDIT_CHANGE_GROUP) > -1)
68+
{
69+
// AUDIT_CHANGE_GROUP is not supported.
70+
WriteWarning(Resources.auditChangeGroupDeprecationMessage);
71+
72+
// Remove it
73+
baseModel.AuditActionGroup = baseModel.AuditActionGroup.Where(v => v != AuditActionGroups.AUDIT_CHANGE_GROUP).ToArray();
74+
}
75+
6476
ModelAdapter.SetServerAuditingPolicy(baseModel, DefaultContext.Environment.GetEndpoint(AzureEnvironment.Endpoint.StorageEndpointSuffix));
6577

6678
return null;

‎src/ResourceManager/Sql/Commands.Sql/Auditing/Model/BaseBlobAuditingPolicyModel.cs

Lines changed: 21 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -16,27 +16,27 @@ namespace Microsoft.Azure.Commands.Sql.Auditing.Model
1616
{
1717
public enum AuditActionGroups
1818
{
19-
BATCH_STARTED_GROUP,
20-
BATCH_COMPLETED_GROUP,
21-
APPLICATION_ROLE_CHANGE_PASSWORD_GROUP,
22-
AUDIT_CHANGE_GROUP,
23-
BACKUP_RESTORE_GROUP,
24-
DATABASE_LOGOUT_GROUP,
25-
DATABASE_OBJECT_CHANGE_GROUP,
26-
DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP,
27-
DATABASE_OBJECT_PERMISSION_CHANGE_GROUP,
28-
DATABASE_OPERATION_GROUP,
29-
DATABASE_PERMISSION_CHANGE_GROUP,
30-
DATABASE_PRINCIPAL_CHANGE_GROUP,
31-
DATABASE_PRINCIPAL_IMPERSONATION_GROUP,
32-
DATABASE_ROLE_MEMBER_CHANGE_GROUP,
33-
FAILED_DATABASE_AUTHENTICATION_GROUP,
34-
SCHEMA_OBJECT_ACCESS_GROUP,
35-
SCHEMA_OBJECT_CHANGE_GROUP,
36-
SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP,
37-
SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP,
38-
SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP,
39-
USER_CHANGE_PASSWORD_GROUP,
19+
BATCH_STARTED_GROUP,
20+
BATCH_COMPLETED_GROUP,
21+
APPLICATION_ROLE_CHANGE_PASSWORD_GROUP,
22+
BACKUP_RESTORE_GROUP,
23+
DATABASE_LOGOUT_GROUP,
24+
DATABASE_OBJECT_CHANGE_GROUP,
25+
DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP,
26+
DATABASE_OBJECT_PERMISSION_CHANGE_GROUP,
27+
DATABASE_OPERATION_GROUP,
28+
AUDIT_CHANGE_GROUP,
29+
DATABASE_PERMISSION_CHANGE_GROUP,
30+
DATABASE_PRINCIPAL_CHANGE_GROUP,
31+
DATABASE_PRINCIPAL_IMPERSONATION_GROUP,
32+
DATABASE_ROLE_MEMBER_CHANGE_GROUP,
33+
FAILED_DATABASE_AUTHENTICATION_GROUP,
34+
SCHEMA_OBJECT_ACCESS_GROUP,
35+
SCHEMA_OBJECT_CHANGE_GROUP,
36+
SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP,
37+
SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP,
38+
SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP,
39+
USER_CHANGE_PASSWORD_GROUP
4040
}
4141

4242
/// <summary>

‎src/ResourceManager/Sql/Commands.Sql/Properties/Resources.Designer.cs

Lines changed: 9 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/ResourceManager/Sql/Commands.Sql/Properties/Resources.resx

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -399,4 +399,7 @@
399399
<data name="ServerDnsAliasNameExists" xml:space="preserve">
400400
<value>Server Dns Alias with name: '{0}' already exists.</value>
401401
</data>
402+
<data name="auditChangeGroupDeprecationMessage" xml:space="preserve">
403+
<value>The action group 'AUDIT_CHANGE_GROUP' is not supported. It will be removed in a future release.</value>
404+
</data>
402405
</root>

‎src/ResourceManager/Sql/Commands.Sql/help/Set-AzureRmSqlDatabaseAuditing.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ The set of the audit action groups
6868
Type: AuditActionGroups[]
6969
Parameter Sets: (All)
7070
Aliases:
71-
Accepted values: BATCH_STARTED_GROUP, BATCH_COMPLETED_GROUP, APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, AUDIT_CHANGE_GROUP, BACKUP_RESTORE_GROUP, DATABASE_LOGOUT_GROUP, DATABASE_OBJECT_CHANGE_GROUP, DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, DATABASE_OPERATION_GROUP, DATABASE_PERMISSION_CHANGE_GROUP, DATABASE_PRINCIPAL_CHANGE_GROUP, DATABASE_PRINCIPAL_IMPERSONATION_GROUP, DATABASE_ROLE_MEMBER_CHANGE_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, SCHEMA_OBJECT_ACCESS_GROUP, SCHEMA_OBJECT_CHANGE_GROUP, SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, USER_CHANGE_PASSWORD_GROUP
71+
Accepted values: BATCH_STARTED_GROUP, BATCH_COMPLETED_GROUP, APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, BACKUP_RESTORE_GROUP, DATABASE_LOGOUT_GROUP, DATABASE_OBJECT_CHANGE_GROUP, DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, DATABASE_OPERATION_GROUP, DATABASE_PERMISSION_CHANGE_GROUP, DATABASE_PRINCIPAL_CHANGE_GROUP, DATABASE_PRINCIPAL_IMPERSONATION_GROUP, DATABASE_ROLE_MEMBER_CHANGE_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, SCHEMA_OBJECT_ACCESS_GROUP, SCHEMA_OBJECT_CHANGE_GROUP, SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, USER_CHANGE_PASSWORD_GROUP
7272

7373
Required: False
7474
Position: Named

‎src/ResourceManager/Sql/Commands.Sql/help/Set-AzureRmSqlDatabaseAuditingPolicy.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -92,7 +92,7 @@ This parameter is only applicable to Blob auditing.
9292
Type: AuditActionGroups[]
9393
Parameter Sets: (All)
9494
Aliases:
95-
Accepted values: BATCH_STARTED_GROUP, BATCH_COMPLETED_GROUP, APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, AUDIT_CHANGE_GROUP, BACKUP_RESTORE_GROUP, DATABASE_LOGOUT_GROUP, DATABASE_OBJECT_CHANGE_GROUP, DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, DATABASE_OPERATION_GROUP, DATABASE_PERMISSION_CHANGE_GROUP, DATABASE_PRINCIPAL_CHANGE_GROUP, DATABASE_PRINCIPAL_IMPERSONATION_GROUP, DATABASE_ROLE_MEMBER_CHANGE_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, SCHEMA_OBJECT_ACCESS_GROUP, SCHEMA_OBJECT_CHANGE_GROUP, SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, USER_CHANGE_PASSWORD_GROUP
95+
Accepted values: BATCH_STARTED_GROUP, BATCH_COMPLETED_GROUP, APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, BACKUP_RESTORE_GROUP, DATABASE_LOGOUT_GROUP, DATABASE_OBJECT_CHANGE_GROUP, DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, DATABASE_OPERATION_GROUP, DATABASE_PERMISSION_CHANGE_GROUP, DATABASE_PRINCIPAL_CHANGE_GROUP, DATABASE_PRINCIPAL_IMPERSONATION_GROUP, DATABASE_ROLE_MEMBER_CHANGE_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, SCHEMA_OBJECT_ACCESS_GROUP, SCHEMA_OBJECT_CHANGE_GROUP, SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, USER_CHANGE_PASSWORD_GROUP
9696

9797
Required: False
9898
Position: Named

‎src/ResourceManager/Sql/Commands.Sql/help/Set-AzureRmSqlServerAuditing.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ The set of the audit action groups
5353
Type: AuditActionGroups[]
5454
Parameter Sets: (All)
5555
Aliases:
56-
Accepted values: BATCH_STARTED_GROUP, BATCH_COMPLETED_GROUP, APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, AUDIT_CHANGE_GROUP, BACKUP_RESTORE_GROUP, DATABASE_LOGOUT_GROUP, DATABASE_OBJECT_CHANGE_GROUP, DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, DATABASE_OPERATION_GROUP, DATABASE_PERMISSION_CHANGE_GROUP, DATABASE_PRINCIPAL_CHANGE_GROUP, DATABASE_PRINCIPAL_IMPERSONATION_GROUP, DATABASE_ROLE_MEMBER_CHANGE_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, SCHEMA_OBJECT_ACCESS_GROUP, SCHEMA_OBJECT_CHANGE_GROUP, SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, USER_CHANGE_PASSWORD_GROUP
56+
Accepted values: BATCH_STARTED_GROUP, BATCH_COMPLETED_GROUP, APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, BACKUP_RESTORE_GROUP, DATABASE_LOGOUT_GROUP, DATABASE_OBJECT_CHANGE_GROUP, DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, DATABASE_OPERATION_GROUP, DATABASE_PERMISSION_CHANGE_GROUP, DATABASE_PRINCIPAL_CHANGE_GROUP, DATABASE_PRINCIPAL_IMPERSONATION_GROUP, DATABASE_ROLE_MEMBER_CHANGE_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, SCHEMA_OBJECT_ACCESS_GROUP, SCHEMA_OBJECT_CHANGE_GROUP, SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, USER_CHANGE_PASSWORD_GROUP
5757

5858
Required: False
5959
Position: Named

‎src/ResourceManager/Sql/Commands.Sql/help/Set-AzureRmSqlServerAuditingPolicy.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ This parameter is only applicable to Blob auditing.
7070
Type: AuditActionGroups[]
7171
Parameter Sets: (All)
7272
Aliases:
73-
Accepted values: BATCH_STARTED_GROUP, BATCH_COMPLETED_GROUP, APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, AUDIT_CHANGE_GROUP, BACKUP_RESTORE_GROUP, DATABASE_LOGOUT_GROUP, DATABASE_OBJECT_CHANGE_GROUP, DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, DATABASE_OPERATION_GROUP, DATABASE_PERMISSION_CHANGE_GROUP, DATABASE_PRINCIPAL_CHANGE_GROUP, DATABASE_PRINCIPAL_IMPERSONATION_GROUP, DATABASE_ROLE_MEMBER_CHANGE_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, SCHEMA_OBJECT_ACCESS_GROUP, SCHEMA_OBJECT_CHANGE_GROUP, SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, USER_CHANGE_PASSWORD_GROUP
73+
Accepted values: BATCH_STARTED_GROUP, BATCH_COMPLETED_GROUP, APPLICATION_ROLE_CHANGE_PASSWORD_GROUP, BACKUP_RESTORE_GROUP, DATABASE_LOGOUT_GROUP, DATABASE_OBJECT_CHANGE_GROUP, DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP, DATABASE_OBJECT_PERMISSION_CHANGE_GROUP, DATABASE_OPERATION_GROUP, DATABASE_PERMISSION_CHANGE_GROUP, DATABASE_PRINCIPAL_CHANGE_GROUP, DATABASE_PRINCIPAL_IMPERSONATION_GROUP, DATABASE_ROLE_MEMBER_CHANGE_GROUP, FAILED_DATABASE_AUTHENTICATION_GROUP, SCHEMA_OBJECT_ACCESS_GROUP, SCHEMA_OBJECT_CHANGE_GROUP, SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP, SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP, SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP, USER_CHANGE_PASSWORD_GROUP
7474

7575
Required: False
7676
Position: Named

0 commit comments

Comments
 (0)