Skip to content

Commit a68de1a

Browse files
MiYanniMiYanni
authored
Merge pull request #7561 from bashahee/preview
Support Extended Auditing policy
2 parents d27c625 + 78f5552 commit a68de1a

File tree

82 files changed

+56174
-42885
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

82 files changed

+56174
-42885
lines changed

‎src/ResourceManager/Sql/Commands.Sql.Test/Commands.Sql.Test.csproj

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -445,6 +445,12 @@
445445
<None Include="SessionRecords\Microsoft.Azure.Commands.Sql.Test.ScenarioTests.BlobAuditingTests\TestBlobAuditingOnServer.json">
446446
<CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
447447
</None>
448+
<None Include="SessionRecords\Microsoft.Azure.Commands.Sql.Test.ScenarioTests.BlobAuditingTests\TestExtendedAuditingOnServer.json">
449+
<CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
450+
</None>
451+
<None Include="SessionRecords\Microsoft.Azure.Commands.Sql.Test.ScenarioTests.BlobAuditingTests\TestExtendedAuditingOnDatabase.json">
452+
<CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
453+
</None>
448454
<None Include="SessionRecords\Microsoft.Azure.Commands.Sql.Test.ScenarioTests.BlobAuditingTests\TestBlobAuditingServerRetentionKeepProperties.json">
449455
<CopyToOutputDirectory>PreserveNewest</CopyToOutputDirectory>
450456
</None>

‎src/ResourceManager/Sql/Commands.Sql.Test/ScenarioTests/AuditingClassicStorageTests.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,8 @@ protected override void SetupManagementClients(RestTestFramework.MockContext con
3333
public AuditingClassicStorageTests(ITestOutputHelper output) : base(output)
3434
{
3535
}
36-
37-
[Fact]
36+
37+
[Fact(Skip = "Skipping the test until a fix will be added by yaiyun: https://github.com/Azure/azure-powershell/issues/6601")]
3838
[Trait(Category.AcceptanceType, Category.CheckIn)]
3939
public void TestAuditingUpdatePolicyWithClassicStorage()
4040
{

‎src/ResourceManager/Sql/Commands.Sql.Test/ScenarioTests/BlobAuditingClassicStorageTests.cs

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,8 +33,8 @@ protected override void SetupManagementClients(RestTestFramework.MockContext con
3333
public BlobAuditingClassicStorageTests(ITestOutputHelper output) : base(output)
3434
{
3535
}
36-
37-
[Fact]
36+
37+
[Fact(Skip = "Skipping the test until a fix will be added by yaiyun: https://github.com/Azure/azure-powershell/issues/6601")]
3838
[Trait(Category.AcceptanceType, Category.CheckIn)]
3939
public void TestAuditingUpdatePolicyWithClassicStorage()
4040
{

‎src/ResourceManager/Sql/Commands.Sql.Test/ScenarioTests/BlobAuditingTests.cs

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -253,5 +253,29 @@ public void TestDeprecatedDatabaseAuditingCmdletToBlobAuditingNewCmdlet()
253253
{
254254
RunPowerShellTest("Test-DeprecatedDatabaseAuditingCmdletToBlobAuditingNewCmdlet");
255255
}
256+
257+
#if NETSTANDARD
258+
[Fact(Skip = "Storage version difference: Awaiting Storage.Common usage in Sql")]
259+
[Trait(Category.RunType, Category.DesktopOnly)]
260+
#else
261+
[Fact]
262+
#endif
263+
[Trait(Category.AcceptanceType, Category.CheckIn)]
264+
public void TestExtendedAuditingOnDatabase()
265+
{
266+
RunPowerShellTest("Test-ExtendedAuditingOnDatabase");
267+
}
268+
269+
#if NETSTANDARD
270+
[Fact(Skip = "Storage version difference: Awaiting Storage.Common usage in Sql")]
271+
[Trait(Category.RunType, Category.DesktopOnly)]
272+
#else
273+
[Fact]
274+
#endif
275+
[Trait(Category.AcceptanceType, Category.CheckIn)]
276+
public void TestExtendedAuditingOnServer()
277+
{
278+
RunPowerShellTest("Test-ExtendedAuditingOnServer");
279+
}
256280
}
257281
}

‎src/ResourceManager/Sql/Commands.Sql.Test/ScenarioTests/BlobAuditingTests.ps1

Lines changed: 144 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -832,4 +832,148 @@ function Test-DeprecatedDatabaseAuditingCmdletToBlobAuditingNewCmdlet
832832
# Cleanup
833833
Remove-BlobAuditingTestEnvironment $testSuffix
834834
}
835+
}
836+
837+
<#
838+
.SYNOPSIS
839+
Test for extended auditing and auditing on a server
840+
#>
841+
function Test-ExtendedAuditingOnServer
842+
{
843+
# Setup
844+
$testSuffix = getAssetName
845+
Create-BlobAuditingTestEnvironment $testSuffix
846+
$params = Get-SqlBlobAuditingTestEnvironmentParameters $testSuffix
847+
848+
try
849+
{
850+
# Enable auditing policy, without speficying a predicate expression, and verify it.
851+
Set-AzureRmSqlServerAuditing -State Enabled -ResourceGroupName $params.rgname -ServerName $params.serverName -StorageAccountName $params.storageAccount -AuditActionGroup "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP", "FAILED_DATABASE_AUTHENTICATION_GROUP" -RetentionInDays 8
852+
$policy = Get-AzureRmSqlServerAuditing -ResourceGroupName $params.rgname -ServerName $params.serverName
853+
Assert-AreEqual "Enabled" $policy.AuditState
854+
Assert-AreEqual 2 $policy.AuditActionGroup.Length
855+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP)}
856+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::FAILED_DATABASE_AUTHENTICATION_GROUP)}
857+
Assert-AreEqual 8 $policy.RetentionInDays
858+
Assert-AreEqual "Primary" $policy.StorageKeyType
859+
Assert-AreEqual "" $policy.PredicateExpression
860+
861+
# Enable Extended auditing policy, speficying a predicate expression, and verify it.
862+
Set-AzureRmSqlServerAuditing -State Enabled -ResourceGroupName $params.rgname -ServerName $params.serverName -StorageAccountName $params.storageAccount -AuditActionGroup "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP", "FAILED_DATABASE_AUTHENTICATION_GROUP" -RetentionInDays 8 -PredicateExpression "statement <> 'select 1'"
863+
$policy = Get-AzureRmSqlServerAuditing -ResourceGroupName $params.rgname -ServerName $params.serverName
864+
Assert-AreEqual "Enabled" $policy.AuditState
865+
Assert-AreEqual 2 $policy.AuditActionGroup.Length
866+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP)}
867+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::FAILED_DATABASE_AUTHENTICATION_GROUP)}
868+
Assert-AreEqual 8 $policy.RetentionInDays
869+
Assert-AreEqual "Primary" $policy.StorageKeyType
870+
Assert-AreEqual "statement <> 'select 1'" $policy.PredicateExpression
871+
872+
# Disable auditing policy and verify it.
873+
Set-AzureRmSqlServerAuditing -State Disabled -ResourceGroupName $params.rgname -ServerName $params.serverName
874+
$policy = Get-AzureRmSqlServerAuditing -ResourceGroupName $params.rgname -ServerName $params.serverName
875+
Assert-AreEqual "Disabled" $policy.AuditState
876+
877+
# Enable Extended auditing policy, without speficying a predicate expression, and verify it.
878+
Set-AzureRmSqlServerAuditing -State Enabled -ResourceGroupName $params.rgname -ServerName $params.serverName -StorageAccountName $params.storageAccount -AuditActionGroup "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP", "FAILED_DATABASE_AUTHENTICATION_GROUP" -RetentionInDays 8
879+
$policy = Get-AzureRmSqlServerAuditing -ResourceGroupName $params.rgname -ServerName $params.serverName
880+
Assert-AreEqual "Enabled" $policy.AuditState
881+
Assert-AreEqual 2 $policy.AuditActionGroup.Length
882+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP)}
883+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::FAILED_DATABASE_AUTHENTICATION_GROUP)}
884+
Assert-AreEqual 8 $policy.RetentionInDays
885+
Assert-AreEqual "Primary" $policy.StorageKeyType
886+
Assert-AreEqual "statement <> 'select 1'" $policy.PredicateExpression
887+
888+
# Remove Extended auditing policy, and enable auditing policy
889+
Set-AzureRmSqlServerAuditing -State Enabled -ResourceGroupName $params.rgname -ServerName $params.serverName -StorageAccountName $params.storageAccount -AuditActionGroup "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP", "FAILED_DATABASE_AUTHENTICATION_GROUP" -RetentionInDays 8 -PredicateExpression ""
890+
$policy = Get-AzureRmSqlServerAuditing -ResourceGroupName $params.rgname -ServerName $params.serverName
891+
Assert-AreEqual "Enabled" $policy.AuditState
892+
Assert-AreEqual 2 $policy.AuditActionGroup.Length
893+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP)}
894+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::FAILED_DATABASE_AUTHENTICATION_GROUP)}
895+
Assert-AreEqual 8 $policy.RetentionInDays
896+
Assert-AreEqual "Primary" $policy.StorageKeyType
897+
Assert-AreEqual "" $policy.PredicateExpression
898+
899+
# Disable auditing policy.
900+
Set-AzureRmSqlServerAuditing -State Disabled -ResourceGroupName $params.rgname -ServerName $params.serverName
901+
}
902+
finally
903+
{
904+
# Cleanup
905+
Remove-BlobAuditingTestEnvironment $testSuffix
906+
}
907+
}
908+
909+
<#
910+
.SYNOPSIS
911+
Test for extended auditing and auditing on a database
912+
#>
913+
function Test-ExtendedAuditingOnDatabase
914+
{
915+
# Setup
916+
$testSuffix = getAssetName
917+
Create-BlobAuditingTestEnvironment $testSuffix
918+
$params = Get-SqlBlobAuditingTestEnvironmentParameters $testSuffix
919+
920+
try
921+
{
922+
# Enable auditing policy, without speficying a predicate expression, and verify it.
923+
Set-AzureRmSqlDatabaseAuditing -State Enabled -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -StorageAccountName $params.storageAccount -AuditActionGroup "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP", "FAILED_DATABASE_AUTHENTICATION_GROUP" -RetentionInDays 8
924+
$policy = Get-AzureRmSqlDatabaseAuditing -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
925+
Assert-AreEqual "Enabled" $policy.AuditState
926+
Assert-AreEqual 2 $policy.AuditActionGroup.Length
927+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP)}
928+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::FAILED_DATABASE_AUTHENTICATION_GROUP)}
929+
Assert-AreEqual 8 $policy.RetentionInDays
930+
Assert-AreEqual "Primary" $policy.StorageKeyType
931+
Assert-AreEqual "" $policy.PredicateExpression
932+
933+
# Enable Extended auditing policy, speficying a predicate expression, and verify it.
934+
Set-AzureRmSqlDatabaseAuditing -State Enabled -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -StorageAccountName $params.storageAccount -AuditActionGroup "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP", "FAILED_DATABASE_AUTHENTICATION_GROUP" -RetentionInDays 8 -PredicateExpression "statement <> 'select 1'"
935+
$policy = Get-AzureRmSqlDatabaseAuditing -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
936+
Assert-AreEqual "Enabled" $policy.AuditState
937+
Assert-AreEqual 2 $policy.AuditActionGroup.Length
938+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP)}
939+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::FAILED_DATABASE_AUTHENTICATION_GROUP)}
940+
Assert-AreEqual 8 $policy.RetentionInDays
941+
Assert-AreEqual "Primary" $policy.StorageKeyType
942+
Assert-AreEqual "statement <> 'select 1'" $policy.PredicateExpression
943+
944+
# Disable auditing policy and verify it.
945+
Set-AzureRmSqlDatabaseAuditing -State Disabled -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
946+
$policy = Get-AzureRmSqlDatabaseAuditing -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
947+
Assert-AreEqual "Disabled" $policy.AuditState
948+
949+
# Enable Extended auditing policy, without speficying a predicate expression, and verify it.
950+
Set-AzureRmSqlDatabaseAuditing -State Enabled -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -StorageAccountName $params.storageAccount -AuditActionGroup "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP", "FAILED_DATABASE_AUTHENTICATION_GROUP" -RetentionInDays 8
951+
$policy = Get-AzureRmSqlDatabaseAuditing -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
952+
Assert-AreEqual "Enabled" $policy.AuditState
953+
Assert-AreEqual 2 $policy.AuditActionGroup.Length
954+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP)}
955+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::FAILED_DATABASE_AUTHENTICATION_GROUP)}
956+
Assert-AreEqual 8 $policy.RetentionInDays
957+
Assert-AreEqual "Primary" $policy.StorageKeyType
958+
Assert-AreEqual "statement <> 'select 1'" $policy.PredicateExpression
959+
960+
# Remove Extended auditing policy, and enable auditing policy
961+
Set-AzureRmSqlDatabaseAuditing -State Enabled -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName -StorageAccountName $params.storageAccount -AuditActionGroup "SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP", "FAILED_DATABASE_AUTHENTICATION_GROUP" -RetentionInDays 8 -PredicateExpression ""
962+
$policy = Get-AzureRmSqlDatabaseAuditing -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
963+
Assert-AreEqual "Enabled" $policy.AuditState
964+
Assert-AreEqual 2 $policy.AuditActionGroup.Length
965+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP)}
966+
Assert-True {$policy.AuditActionGroup.Contains([Microsoft.Azure.Commands.Sql.Auditing.Model.AuditActionGroups]::FAILED_DATABASE_AUTHENTICATION_GROUP)}
967+
Assert-AreEqual 8 $policy.RetentionInDays
968+
Assert-AreEqual "Primary" $policy.StorageKeyType
969+
Assert-AreEqual "" $policy.PredicateExpression
970+
971+
# Disable auditing policy.
972+
Set-AzureRmSqlDatabaseAuditing -State Disabled -ResourceGroupName $params.rgname -ServerName $params.serverName -DatabaseName $params.databaseName
973+
}
974+
finally
975+
{
976+
# Cleanup
977+
Remove-BlobAuditingTestEnvironment $testSuffix
978+
}
835979
}

0 commit comments

Comments
 (0)