Skip to content

Commit 8f95819

Browse files
isra-felisra-fel
authored
Supported "all" as an option when setting key vault access policies (#13524)
* Supported "all" as an option when setting key vault access policies * minor fix in docs * fix test
1 parent d1e906e commit 8f95819

File tree

15 files changed

+1528
-23
lines changed

15 files changed

+1528
-23
lines changed

‎src/KeyVault/KeyVault.Test/ScenarioTests/AccessPolicyTests.cs

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
using Microsoft.WindowsAzure.Commands.ScenarioTest;
2+
using Xunit;
3+
4+
namespace Microsoft.Azure.Commands.KeyVault.Test.ScenarioTests
5+
{
6+
public class AccessPolicyTests : KeyVaultTestRunner
7+
{
8+
public AccessPolicyTests(Xunit.Abstractions.ITestOutputHelper output) : base(output)
9+
{
10+
}
11+
12+
[Fact]
13+
[Trait(Category.AcceptanceType, Category.CheckIn)]
14+
public void TestSetAllAccessPolicies()
15+
{
16+
TestRunner.RunTestScript("Test-SetAllAccessPolicies");
17+
}
18+
}
19+
}

‎src/KeyVault/KeyVault.Test/ScenarioTests/AccessPolicyTests.ps1

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
function Test-SetAllAccessPolicies()
2+
{
3+
$rg = Get-ResourceGroupName
4+
$vaultName = GetAssetName
5+
$rgLocation = Get-Location "Microsoft.Resources" "resourceGroups" "West US"
6+
$vaultLocation = Get-Location "Microsoft.KeyVault" "vault" "West US"
7+
$objectId = "d7e17135-d5a7-4b8b-89e5-252aa15b7e01"
8+
New-AzResourceGroup -Name $rg -Location $rgLocation
9+
10+
try {
11+
New-AzKeyVault -ResourceGroupName $rg -VaultName $vaultName -Location $vaultLocation
12+
Set-AzKeyVaultAccessPolicy -VaultName $vaultName -ObjectId $objectId -PermissionsToCertificates all -PermissionsToKeys all -PermissionsToSecrets all -PermissionsToStorage all -BypassObjectIdValidation
13+
$vault = Get-AzKeyVault -ResourceGroupName $rg -VaultName $vaultName
14+
$accessPolicy = $vault.AccessPolicies | ? {$_.ObjectId -eq $objectId}
15+
Assert-NotNull $accessPolicy
16+
Assert-AreEqual "all" $accessPolicy.PermissionsToCertificatesStr
17+
Assert-AreEqual "all" $accessPolicy.PermissionsToKeysStr
18+
Assert-AreEqual "all" $accessPolicy.PermissionsToSecretsStr
19+
Assert-AreEqual "all" $accessPolicy.PermissionsToStorageStr
20+
}
21+
finally {
22+
Remove-AzResourceGroup -Name $rg -Force
23+
}
24+
}

‎src/KeyVault/KeyVault.Test/SessionRecords/Microsoft.Azure.Commands.KeyVault.Test.ScenarioTests.AccessPolicyTests/TestSetAllAccessPolicies.json

Lines changed: 1438 additions & 0 deletions
Large diffs are not rendered by default.

‎src/KeyVault/KeyVault.sln

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,10 @@ Global
3838
{142D7B0B-388A-4CEB-A228-7F6D423C5C2E}.Debug|Any CPU.Build.0 = Debug|Any CPU
3939
{142D7B0B-388A-4CEB-A228-7F6D423C5C2E}.Release|Any CPU.ActiveCfg = Release|Any CPU
4040
{142D7B0B-388A-4CEB-A228-7F6D423C5C2E}.Release|Any CPU.Build.0 = Release|Any CPU
41+
{6BD6B80A-06AF-4B5B-9230-69CCFC6C8D64}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
42+
{6BD6B80A-06AF-4B5B-9230-69CCFC6C8D64}.Debug|Any CPU.Build.0 = Debug|Any CPU
43+
{6BD6B80A-06AF-4B5B-9230-69CCFC6C8D64}.Release|Any CPU.ActiveCfg = Release|Any CPU
44+
{6BD6B80A-06AF-4B5B-9230-69CCFC6C8D64}.Release|Any CPU.Build.0 = Release|Any CPU
4145
{FF81DC73-B8EC-4082-8841-4FBF2B16E7CE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
4246
{FF81DC73-B8EC-4082-8841-4FBF2B16E7CE}.Debug|Any CPU.Build.0 = Debug|Any CPU
4347
{FF81DC73-B8EC-4082-8841-4FBF2B16E7CE}.Release|Any CPU.ActiveCfg = Release|Any CPU

‎src/KeyVault/KeyVault/ChangeLog.md

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818
- Additional information about change #1
1919
-->
2020
## Upcoming Release
21+
* Supported "all" as an option when setting key vault access policies
2122
* Supported new version of SecretManagement module [#13366]
2223
* Supported ByteArray, String, PSCredential and Hashtable for `SecretValue` in SecretManagementModule [#12190]
2324

‎src/KeyVault/KeyVault/Commands/SetAzureKeyVaultAccessPolicy.cs

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -281,7 +281,7 @@ public class SetAzureKeyVaultAccessPolicy : KeyVaultManagementCmdletBase
281281
[Parameter(Mandatory = false,
282282
ParameterSetName = ResourceIdByEmailAddress,
283283
HelpMessage = "Specifies key operation permissions to grant to a user or service principal.")]
284-
[ValidateSet("decrypt", "encrypt", "unwrapKey", "wrapKey", "verify", "sign", "get", "list", "update", "create", "import", "delete", "backup", "restore", "recover", "purge")]
284+
[ValidateSet("all", "decrypt", "encrypt", "unwrapKey", "wrapKey", "verify", "sign", "get", "list", "update", "create", "import", "delete", "backup", "restore", "recover", "purge")]
285285
public string[] PermissionsToKeys { get; set; }
286286

287287
/// <summary>
@@ -323,7 +323,7 @@ public class SetAzureKeyVaultAccessPolicy : KeyVaultManagementCmdletBase
323323
[Parameter(Mandatory = false,
324324
ParameterSetName = ResourceIdByEmailAddress,
325325
HelpMessage = "Specifies secret operation permissions to grant to a user or service principal.")]
326-
[ValidateSet("get", "list", "set", "delete", "backup", "restore", "recover", "purge")]
326+
[ValidateSet("all", "get", "list", "set", "delete", "backup", "restore", "recover", "purge")]
327327
public string[] PermissionsToSecrets { get; set; }
328328

329329
/// <summary>
@@ -365,7 +365,7 @@ public class SetAzureKeyVaultAccessPolicy : KeyVaultManagementCmdletBase
365365
[Parameter(Mandatory = false,
366366
ParameterSetName = ResourceIdByEmailAddress,
367367
HelpMessage = "Specifies certificate operation permissions to grant to a user or service principal.")]
368-
[ValidateSet("get", "list", "delete", "create", "import", "update", "managecontacts", "getissuers", "listissuers", "setissuers", "deleteissuers", "manageissuers", "recover", "purge", "backup", "restore")]
368+
[ValidateSet("all", "get", "list", "delete", "create", "import", "update", "managecontacts", "getissuers", "listissuers", "setissuers", "deleteissuers", "manageissuers", "recover", "purge", "backup", "restore")]
369369
public string[] PermissionsToCertificates { get; set; }
370370

371371
/// <summary>
@@ -407,7 +407,7 @@ public class SetAzureKeyVaultAccessPolicy : KeyVaultManagementCmdletBase
407407
[Parameter(Mandatory = false,
408408
ParameterSetName = ResourceIdByEmailAddress,
409409
HelpMessage = "Specifies managed storage account and sas definition operation permissions to grant to a user or service principal.")]
410-
[ValidateSet("get", "list", "delete", "set", "update", "regeneratekey", "getsas", "listsas", "deletesas", "setsas", "recover", "backup", "restore", "purge")]
410+
[ValidateSet("all", "get", "list", "delete", "set", "update", "regeneratekey", "getsas", "listsas", "deletesas", "setsas", "recover", "backup", "restore", "purge")]
411411
public string[] PermissionsToStorage { get; set; }
412412

413413
[Parameter(Mandatory = false,

‎src/KeyVault/KeyVault/help/Get-AzKeyVault.md

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -240,7 +240,7 @@ Required: False
240240
Position: 1
241241
Default value: None
242242
Accept pipeline input: True (ByPropertyName)
243-
Accept wildcard characters: False
243+
Accept wildcard characters: True
244244
```
245245
246246
### -Tag
@@ -271,7 +271,7 @@ Required: False
271271
Position: 0
272272
Default value: None
273273
Accept pipeline input: True (ByPropertyName)
274-
Accept wildcard characters: False
274+
Accept wildcard characters: True
275275
```
276276
277277
```yaml
@@ -283,7 +283,7 @@ Required: True
283283
Position: 0
284284
Default value: None
285285
Accept pipeline input: True (ByPropertyName)
286-
Accept wildcard characters: False
286+
Accept wildcard characters: True
287287
```
288288
289289
### CommonParameters

‎src/KeyVault/KeyVault/help/Get-AzKeyVaultCertificate.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -318,7 +318,7 @@ Required: False
318318
Position: 1
319319
Default value: None
320320
Accept pipeline input: False
321-
Accept wildcard characters: False
321+
Accept wildcard characters: True
322322
```
323323
324324
```yaml
@@ -330,7 +330,7 @@ Required: True
330330
Position: 1
331331
Default value: None
332332
Accept pipeline input: False
333-
Accept wildcard characters: False
333+
Accept wildcard characters: True
334334
```
335335
336336
### -ResourceId

‎src/KeyVault/KeyVault/help/Get-AzKeyVaultCertificateIssuer.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -115,7 +115,7 @@ Required: False
115115
Position: 1
116116
Default value: None
117117
Accept pipeline input: False
118-
Accept wildcard characters: False
118+
Accept wildcard characters: True
119119
```
120120
121121
### -ResourceId

‎src/KeyVault/KeyVault/help/Get-AzKeyVaultKey.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -333,7 +333,7 @@ Required: False
333333
Position: 1
334334
Default value: None
335335
Accept pipeline input: False
336-
Accept wildcard characters: False
336+
Accept wildcard characters: True
337337
```
338338
339339
```yaml
@@ -345,7 +345,7 @@ Required: True
345345
Position: 1
346346
Default value: None
347347
Accept pipeline input: False
348-
Accept wildcard characters: False
348+
Accept wildcard characters: True
349349
```
350350
351351
### -OutFile

‎src/KeyVault/KeyVault/help/Get-AzKeyVaultManagedStorageAccount.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -113,7 +113,7 @@ Required: False
113113
Position: 1
114114
Default value: None
115115
Accept pipeline input: False
116-
Accept wildcard characters: False
116+
Accept wildcard characters: True
117117
```
118118
119119
### -DefaultProfile

‎src/KeyVault/KeyVault/help/Get-AzKeyVaultSecret.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -353,7 +353,7 @@ Required: False
353353
Position: 1
354354
Default value: None
355355
Accept pipeline input: False
356-
Accept wildcard characters: False
356+
Accept wildcard characters: True
357357
```
358358
359359
```yaml
@@ -365,7 +365,7 @@ Required: True
365365
Position: 1
366366
Default value: None
367367
Accept pipeline input: False
368-
Accept wildcard characters: False
368+
Accept wildcard characters: True
369369
```
370370
371371
### -ResourceId

‎src/KeyVault/KeyVault/help/Get-AzManagedHsm.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -99,7 +99,7 @@ Required: False
9999
Position: 0
100100
Default value: None
101101
Accept pipeline input: True (ByPropertyName)
102-
Accept wildcard characters: False
102+
Accept wildcard characters: True
103103
```
104104
105105
### -ResourceGroupName
@@ -114,7 +114,7 @@ Required: False
114114
Position: 1
115115
Default value: None
116116
Accept pipeline input: True (ByPropertyName)
117-
Accept wildcard characters: False
117+
Accept wildcard characters: True
118118
```
119119
120120
### -Tag

‎src/KeyVault/KeyVault/help/Get-AzManagedHsmKey.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -353,7 +353,7 @@ Required: False
353353
Position: 1
354354
Default value: None
355355
Accept pipeline input: False
356-
Accept wildcard characters: False
356+
Accept wildcard characters: True
357357
```
358358
359359
```yaml
@@ -365,7 +365,7 @@ Required: True
365365
Position: 1
366366
Default value: None
367367
Accept pipeline input: False
368-
Accept wildcard characters: False
368+
Accept wildcard characters: True
369369
```
370370
371371
### -OutFile

‎src/KeyVault/KeyVault/help/Set-AzKeyVaultAccessPolicy.md

Lines changed: 23 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -440,6 +440,7 @@ Accept wildcard characters: False
440440
### -PermissionsToCertificates
441441
Specifies an array of certificate permissions to grant to a user or service principal.
442442
The acceptable values for this parameter:
443+
- All
443444
- Get
444445
- List
445446
- Delete
@@ -461,7 +462,7 @@ The acceptable values for this parameter:
461462
Type: System.String[]
462463
Parameter Sets: ByUserPrincipalName, ByObjectId, ByServicePrincipalName, ByEmailAddress, InputObjectByObjectId, InputObjectByServicePrincipalName, InputObjectByUserPrincipalName, InputObjectByEmailAddress, ResourceIdByObjectId, ResourceIdByServicePrincipalName, ResourceIdByUserPrincipalName, ResourceIdByEmailAddress
463464
Aliases:
464-
Accepted values: get, list, delete, create, import, update, managecontacts, getissuers, listissuers, setissuers, deleteissuers, manageissuers, recover, purge, backup, restore
465+
Accepted values: all, get, list, delete, create, import, update, managecontacts, getissuers, listissuers, setissuers, deleteissuers, manageissuers, recover, purge, backup, restore
465466

466467
Required: False
467468
Position: Named
@@ -473,6 +474,7 @@ Accept wildcard characters: False
473474
### -PermissionsToKeys
474475
Specifies an array of key operation permissions to grant to a user or service principal.
475476
The acceptable values for this parameter:
477+
- All
476478
- Decrypt
477479
- Encrypt
478480
- UnwrapKey
@@ -494,7 +496,7 @@ The acceptable values for this parameter:
494496
Type: System.String[]
495497
Parameter Sets: ByUserPrincipalName, ByObjectId, ByServicePrincipalName, ByEmailAddress, InputObjectByObjectId, InputObjectByServicePrincipalName, InputObjectByUserPrincipalName, InputObjectByEmailAddress, ResourceIdByObjectId, ResourceIdByServicePrincipalName, ResourceIdByUserPrincipalName, ResourceIdByEmailAddress
496498
Aliases:
497-
Accepted values: decrypt, encrypt, unwrapKey, wrapKey, verify, sign, get, list, update, create, import, delete, backup, restore, recover, purge
499+
Accepted values: all, decrypt, encrypt, unwrapKey, wrapKey, verify, sign, get, list, update, create, import, delete, backup, restore, recover, purge
498500

499501
Required: False
500502
Position: Named
@@ -506,6 +508,7 @@ Accept wildcard characters: False
506508
### -PermissionsToSecrets
507509
Specifies an array of secret operation permissions to grant to a user or service principal.
508510
The acceptable values for this parameter:
511+
- All
509512
- Get
510513
- List
511514
- Set
@@ -519,7 +522,7 @@ The acceptable values for this parameter:
519522
Type: System.String[]
520523
Parameter Sets: ByUserPrincipalName, ByObjectId, ByServicePrincipalName, ByEmailAddress, InputObjectByObjectId, InputObjectByServicePrincipalName, InputObjectByUserPrincipalName, InputObjectByEmailAddress, ResourceIdByObjectId, ResourceIdByServicePrincipalName, ResourceIdByUserPrincipalName, ResourceIdByEmailAddress
521524
Aliases:
522-
Accepted values: get, list, set, delete, backup, restore, recover, purge
525+
Accepted values: all, get, list, set, delete, backup, restore, recover, purge
523526

524527
Required: False
525528
Position: Named
@@ -530,12 +533,28 @@ Accept wildcard characters: False
530533
531534
### -PermissionsToStorage
532535
Specifies managed storage account and SaS-definition operation permissions to grant to a user or service principal.
536+
The acceptable values for this parameter:
537+
- all
538+
- get
539+
- list
540+
- delete
541+
- set
542+
- update
543+
- regeneratekey
544+
- getsas
545+
- listsas
546+
- deletesas
547+
- setsas
548+
- recover
549+
- backup
550+
- restore
551+
- purge
533552
534553
```yaml
535554
Type: System.String[]
536555
Parameter Sets: ByUserPrincipalName, ByObjectId, ByServicePrincipalName, ByEmailAddress, InputObjectByObjectId, InputObjectByServicePrincipalName, InputObjectByUserPrincipalName, InputObjectByEmailAddress, ResourceIdByObjectId, ResourceIdByServicePrincipalName, ResourceIdByUserPrincipalName, ResourceIdByEmailAddress
537556
Aliases:
538-
Accepted values: get, list, delete, set, update, regeneratekey, getsas, listsas, deletesas, setsas, recover, backup, restore, purge
557+
Accepted values: all, get, list, delete, set, update, regeneratekey, getsas, listsas, deletesas, setsas, recover, backup, restore, purge
539558

540559
Required: False
541560
Position: Named

0 commit comments

Comments
 (0)