Skip to content

Commit bc3b625

Browse files
isra-felBethanyZhouYeming Liudingmeng-xue
authored
Managed HSM (#13287)
Force merge after CI passed * [KeyVault] Managed HSM (#13259) * Enable MHSM Management via *-AzKeyVault (#12575) * Support creating a MHSM pool. * Supporting querying MHSM objects * Support deleting MHSM * Support updating mhsm * Add test cases * Hide unavailable services * Add test cases * expose EnablePurgeProtection for MHSM * correct indent of ps1xml * upload localfeed * Hide enablePurgeProtection * Update ChangeLog.md and help.md * Modify codes according to comments * Update help.md * Update VaultCreationParameters.cs * Update get-azkeyvault.md * Update KeyVaultManagementTests.ps1 * Record scenario test for Managed Hsm (#12631) * Record scenario tests for managed hsm * add default parameter set for * Re-record scenario tests. * [KeyVault] Update to official SDK (#12767) * local 3.1.0 sdk * Use production key vault mgmt sdk * remove security domain from format xml * combine track 1&2 sdk (#13018) * combine track 1&2 sdk * update azure.core to 1.5.0 * add exception; revert addkeyvaultkey * add dll to psd1 * fix exception * Detach managed hsm from key vault command (#13187) * get managed hsm * new managed hsm * remove managed hsm * update help.md * update managed hsm * add online version for new help.md * Convert mhsm test to liveonly * add test record * Support data plane of managed HSM (#13216) * create managed hsm key * get managed hsm key * remove managed hsm key * update managed hsm key * undo managed hsm key removal * back up and restore managed hsm key * add help.md * import/download managed hsm RSA key * Update help.md * Update changelog.md * suppress signature issues * Update all help markdowns * add logger for track2sdk * add metadata for oct-HSM Co-authored-by: Yeming Liu <[email protected]> * Limit KeyType to be required only when create managed HSM key (#13242) * limit KeyType to be required only when create managed HSM key * add pester test * Security domain (#13226) * wip * wip * wip * wip * wip * wip * support securestring * wip * wip * wip * generate docs * docs & error handling * move crypto alg inside security domain * resource strings * remove extra code * write help markdown * resolve relative path to absolute path * suppress signature issues Co-authored-by: Yeming Liu <[email protected]> Co-authored-by: Beisi Zhou <[email protected]> Co-authored-by: Beisi Zhou <[email protected]> * remove pfx file * full backup restore + rbac (#13261) Co-authored-by: Yeming Liu <[email protected]> * small fixes changelog; azure.core; sdk version; online version; breaking change csv; shared assembly conflict; failed tests; * license of BouncyCastle.NetCore * remove local feed Co-authored-by: Yeming Liu <[email protected]> Co-authored-by: Yeming Liu <[email protected]> * use portable.bouncycastle * bug fix... ...replace bouncycastle lib; fix security domain issue on windows powershell * Add pester test for RBAC and full-backup managed HSM * fix dll list * support relative path when restoring SD * update license (bouncycastle.netcore -> portable) * remove dependency Microsoft.IdentityModel.Tokens Co-authored-by: Beisi Zhou <[email protected]> Co-authored-by: Yeming Liu <[email protected]> Co-authored-by: Beisi Zhou <[email protected]> Co-authored-by: Dingmeng Xue <[email protected]>
1 parent cf2d280 commit bc3b625

File tree

133 files changed

+18776
-1736
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

133 files changed

+18776
-1736
lines changed

‎LICENSE.txt

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -223,5 +223,19 @@ Permission is hereby granted, free of charge, to any person obtaining a copy of
223223
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
224224
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
225225

226+
***************
227+
228+
The software includes Portable.BouncyCastle. The MIT License set out below is provided for informational purposes only. It is not the license that governs any part of the software.
229+
230+
Portable.BouncyCastle
231+
232+
LICENSE
233+
Copyright (c) 2000 - 2017 The Legion of the Bouncy Castle Inc. (http://www.bouncycastle.org)
234+
235+
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
236+
237+
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
238+
239+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
226240
-------------END OF THIRD PARTY NOTICE----------------------------------------
227241

‎src/Accounts/Authentication/Utilities/CustomAssemblyResolver.cs

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ public static class CustomAssemblyResolver
2626
{"System.Reflection.DispatchProxy", new Version("4.0.3.0")},
2727
{"System.Runtime.CompilerServices.Unsafe", new Version("4.0.5.0")},
2828
{"System.Security.AccessControl", new Version("4.1.1.0")},
29+
{"System.Security.Cryptography.Cng", new Version("4.3.0.0")},
2930
{"System.Security.Permissions", new Version("4.0.1.0")},
3031
{"System.Security.Principal.Windows", new Version("4.1.1.0")},
3132
{"System.ServiceModel.Primitives", new Version("4.2.0.0")},

‎src/Compute/Compute.Test/Compute.Test.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<ItemGroup>
1414
<PackageReference Include="Microsoft.Azure.Graph.RBAC" Version="3.4.0-preview" />
1515
<PackageReference Include="Microsoft.Azure.Management.Compute" Version="39.0.0" />
16-
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.0.0" />
16+
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.1.0-preview.2" />
1717
<PackageReference Include="Microsoft.Azure.Management.Network" Version="20.1.1" />
1818
</ItemGroup>
1919

‎src/EventHub/EventHub.Test/EventHub.Test.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<ItemGroup>
1414
<PackageReference Include="Microsoft.Azure.KeyVault" Version="3.0.5" />
1515
<PackageReference Include="Microsoft.Azure.Management.EventHub" Version="2.7.2" />
16-
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.0.0" />
16+
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.1.0-preview.2" />
1717
</ItemGroup>
1818

1919
<ItemGroup>

‎src/HDInsight/HDInsight.Test/HDInsight.Test.csproj

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
<PackageReference Include="Microsoft.Azure.KeyVault" Version="3.0.5" />
1515
<PackageReference Include="Microsoft.Azure.Management.HDInsight" Version="5.6.0" />
1616
<PackageReference Include="Microsoft.Azure.Management.HDInsight.Job" Version="2.0.7" />
17-
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.0.0" />
17+
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.1.0-preview.2" />
1818
<PackageReference Include="Microsoft.Azure.Management.ManagedServiceIdentity" Version="0.11.0" />
1919
<PackageReference Include="Microsoft.Azure.Management.Network" Version="20.1.1" />
2020
<PackageReference Include="Microsoft.Azure.Management.OperationalInsights" Version="0.21.0-preview" />

‎src/KeyVault/KeyVault.Test/KeyVault.Test.csproj

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<ItemGroup>
1414
<PackageReference Include="Microsoft.Azure.KeyVault" Version="3.0.1" />
1515
<PackageReference Include="Microsoft.Azure.KeyVault.WebKey" Version="3.0.1" />
16-
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.0.0" />
16+
<PackageReference Include="Microsoft.Azure.Management.KeyVault" Version="3.1.0-preview.2" />
1717
<PackageReference Include="Microsoft.Azure.Management.Network" Version="20.1.1" />
1818
</ItemGroup>
1919

@@ -23,7 +23,10 @@
2323

2424
<ItemGroup>
2525
<None Update="Scripts\ControlPlane\KeyVaultManagementTests.ps1" CopyToOutputDirectory="PreserveNewest" />
26-
<None Update="Resources\pshtest.pfx" CopyToOutputDirectory="PreserveNewest" />
26+
</ItemGroup>
27+
28+
<ItemGroup>
29+
<Folder Include="ScenarioTests\PesterTests\" />
2730
</ItemGroup>
2831

2932
</Project>

‎src/KeyVault/KeyVault.Test/Models/UtilitiesTests.cs

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -58,22 +58,5 @@ public void GetWebKeyFromByok()
5858
Assert.True(webKey.T.SequenceEqual(byokBlob));
5959
Assert.Equal(webKey.Kty, JsonWebKeyType.RsaHsm);
6060
}
61-
62-
[Fact]
63-
[Trait(Category.AcceptanceType, Category.CheckIn)]
64-
public void GetWebKeyFromCertificate()
65-
{
66-
string password = "123";
67-
// This allows the test to run in Visual Studio and in the console runner. The file will exist in one of the two locations depending on the environment.
68-
var consolePath = Path.Combine(Path.GetDirectoryName(Assembly.GetExecutingAssembly().Location) ?? String.Empty, "Resources", "pshtest.pfx");
69-
var vsPath = Path.Combine(Directory.GetCurrentDirectory(), "Resources", "pshtest.pfx");
70-
71-
IWebKeyConverter converters = WebKeyConverterFactory.CreateConverterChain();
72-
var webKey = converters.ConvertKeyFromFile(new FileInfo(File.Exists(consolePath) ? consolePath : vsPath), password.ConvertToSecureString());
73-
74-
Assert.True(webKey.HasPrivateKey());
75-
Assert.True(webKey.IsValid());
76-
Assert.Equal(webKey.Kty, JsonWebKeyType.Rsa);
77-
}
7861
}
7962
}

‎src/KeyVault/KeyVault.Test/PesterTests/ManagedHsmDatePlaneTests.Tests.ps1

Lines changed: 262 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,262 @@
1+
$here = Split-Path -Parent $MyInvocation.MyCommand.Path
2+
$sut = (Split-Path -Leaf $MyInvocation.MyCommand.Path) -replace '\.Tests\.', '.'
3+
. "$here\$sut"
4+
5+
BeforeAll {
6+
. $PSScriptRoot/ManagedHsmDatePlaneTests.ps1
7+
ImportModules
8+
$hsmName = GetAzManagedHsm
9+
}
10+
11+
Describe "AddAzManagedHsmKey" {
12+
It "Create a RSA key inside a managed HSM" {
13+
$keyName = GetRandomName -Prefix "key"
14+
$keyType = "RSA"
15+
$rsaKey = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType $keyType
16+
$rsaKey.VaultName | Should -BeExactly $hsmName
17+
$rsaKey.Name | Should -BeExactly $keyName
18+
$rsaKey.Attributes.KeyType | Should -Be "RSA-HSM"
19+
}
20+
21+
It "Create an EC key with curve P-256 inside a managed HSM" {
22+
$keyName = GetRandomName -Prefix "key"
23+
$keyType = "EC"
24+
$curveName = "P-256"
25+
$rsaKey = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType $keyType -CurveName $curveName
26+
$rsaKey.VaultName | Should -BeExactly $hsmName
27+
$rsaKey.Name | Should -BeExactly $keyName
28+
$rsaKey.Attributes.KeyType | Should -Be "EC-HSM"
29+
$rsaKey.Key.CurveName | Should -Be $curveName
30+
}
31+
32+
It "Create an oct key inside a managed HSM" {
33+
$keyName = GetRandomName -Prefix "key"
34+
$keyType = "oct"
35+
$rsaKey = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType $keyType
36+
$rsaKey.VaultName | Should -BeExactly $hsmName
37+
$rsaKey.Name | Should -BeExactly $keyName
38+
$rsaKey.Attributes.KeyType | Should -Be "oct-HSM"
39+
}
40+
41+
It "Create an oct key inside a managed HSM" {
42+
$keyName = GetRandomName -Prefix "key"
43+
$keyType = "oct"
44+
$rsaKey = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType $keyType
45+
$rsaKey.VaultName | Should -BeExactly $hsmName
46+
$rsaKey.Name | Should -BeExactly $keyName
47+
$rsaKey.Attributes.KeyType | Should -Be "oct-HSM"
48+
}
49+
50+
It "Create a key with non-default values inside a managed HSM" {
51+
$keyName = GetRandomName -Prefix "key"
52+
$keyType = "RSA"
53+
$KeyOps = 'decrypt', 'verify'
54+
# Expires & NotBefore is hard to cmpare, may add in the furture
55+
$Tags = @{'Severity' = 'high'; 'Accounting' = "true"}
56+
57+
$key = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType $keyType -KeyOps $KeyOps -Disable -Tag $Tags
58+
59+
$key.Attributes.KeyOps | Should -Be $KeyOps
60+
$key.Tags.Count | Should -Be 2
61+
$key.Enabled | Should -Be $false
62+
}
63+
64+
# It "Import a RSA key from pfx file into a managed HSM" {
65+
# $keyName = GetRandomName -Prefix "key"
66+
# $keyFilePath = Join-Path $PSScriptRoot ../Resources/testImportKey.pfx -Resolve
67+
# $keyFilePwd = $null
68+
# $key = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyFilePath $keyFilePath -KeyFilePassword $keyFilePwd
69+
# $key.Name | Should -BeExactly $keyName
70+
# }
71+
}
72+
73+
Describe "GetAzManagedHsmKey"{
74+
BeforeEach{
75+
# Add a key
76+
$keyName = GetRandomName -Prefix "key"
77+
$key = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType "RSA"
78+
}
79+
80+
It "List all the keys in a managed HSM" {
81+
$keys = Get-AzManagedHsmKey -HsmName $hsmName
82+
$keys.Count | Should -BeGreaterThan 0
83+
}
84+
85+
It "Get a specific key in a managed HSM" {
86+
$got = Get-AzManagedHsmKey -HsmName $hsmName -KeyName $keyName
87+
$got.Id | Should -Be $key.Id
88+
}
89+
90+
It "List all the keys that have been deleted in a managed HSM" {
91+
Remove-AzManagedHsmKey -HsmName $hsmName -Name $keyName -Force
92+
$deletedKey = Get-AzManagedHsmKey -HsmName $hsmName -KeyName $keyName -InRemovedState
93+
$deletedKey.Id | Should -Be $key.Id
94+
}
95+
96+
It "Download a key from a managed HSM" {
97+
$filePath = "$PSScriptRoot\public.pem"
98+
Get-AzManagedHsmKey -HsmName $hsmName -KeyName $keyName -OutFile $filePath
99+
$filePath | Should -Exist
100+
}
101+
}
102+
103+
Describe "RemoveAzManagedHsmKey"{
104+
It "Remove a key from a managed HSM" {
105+
$keyName = GetRandomName -Prefix "key"
106+
$key = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType "RSA"
107+
$deletedKey = Remove-AzManagedHsmKey -HsmName $hsmName -Name $keyName -Force -PassThru
108+
$deletedKey.Id | Should -Be $key.Id
109+
}
110+
111+
It "Purge a deleted key from a managed HSM" {
112+
$keyName = GetRandomName -Prefix "key"
113+
Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType "RSA"
114+
Remove-AzManagedHsmKey -HsmName $hsmName -Name $keyName -Force -PassThru
115+
Remove-AzManagedHsmKey -HsmName $hsmName -Name $keyName -InRemovedState -Force -PassThru
116+
$deletedKey = Get-AzManagedHsmKey -HsmName $hsmName -Name $keyName -InRemovedState
117+
$deletedKey | Should -Be $null
118+
}
119+
120+
It "Remove keys by using piping" {
121+
Get-AzManagedHsmKey -HsmName $hsmName | Remove-AzManagedHsmKey -Force
122+
$keys = Get-AzManagedHsmKey -HsmName $hsmName
123+
$keys.Count | Should -Be 0
124+
}
125+
}
126+
127+
Describe "UpdateAzManagedHsmKey"{
128+
It "Enable a key and set tags" {
129+
$keyName = GetRandomName -Prefix "key"
130+
$key = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType "RSA" -Disable
131+
$Tags = @{'Severity' = 'high'; 'Accounting' = 'true'}
132+
133+
$updatedKey = Update-AzManagedHsmKey -HsmName $hsmName -Name $keyName -Enable $True -Tag $Tags -PassThru
134+
135+
$updatedKey.Id | Should -Be $key.Id
136+
$updatedKey.Enabled | Should -Be $True
137+
$updatedKey.Tags.Count | Should -Be 2
138+
}
139+
}
140+
141+
Describe "UndoAzManagedHsmKeyRemoval"{
142+
It "Undo a key removal" {
143+
$keyName = GetRandomName -Prefix "key"
144+
$key = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType "RSA"
145+
$deletedKey = Remove-AzManagedHsmKey -HsmName $hsmName -Name $keyName -Force -PassThru
146+
$recoveredKey = $deletedKey | Undo-AzManagedHsmKeyRemoval
147+
$recoveredKey.Id | Should -Be $key.Id
148+
}
149+
}
150+
151+
Describe "BackupAndRestoreAzManagedHsmKey"{
152+
It "Backup and restore a key" {
153+
$keyName = GetRandomName -Prefix "key"
154+
$key = Add-AzManagedHsmKey -HsmName $hsmName -Name $keyName -KeyType "RSA"
155+
$filePath = "$PSScriptRoot/backupkey.blob"
156+
$key | Backup-AzManagedHsmKey -OutputFile $filePath -Force
157+
$filePath | Should -Exist
158+
159+
Remove-AzManagedHsmKey -HsmName $hsmName -Name $keyName -Force
160+
Remove-AzManagedHsmKey -HsmName $hsmName -Name $keyName -InRemovedState -Force
161+
$restoredKey = Restore-AzManagedHsmKey -HsmName $hsmName -InputFile $filePath
162+
$restoredKey.Id | Should -Be $key.Id
163+
}
164+
}
165+
166+
Describe "BackupAndRestoreAzManagedHsm"{
167+
BeforeEach{
168+
$sasToken = ConvertTo-SecureString -AsPlainText -Force "?sv=2019-12-12&ss=bfqt&srt=sco&sp=rwdlacupx&se=2020-10-21T13:11:01Z&st=2020-10-21T05:11:01Z&spr=https&sig=******"
169+
$containerUri = "https://{accountName}.blob.core.windows.net/{containerName}"
170+
}
171+
172+
It "Backup a managed HSM" {
173+
$uri = Backup-AzManagedHsm -Name $hsmName -StorageContainerUri $containerUri -SasToken $sasToken
174+
$uri | Should -Not -Be $null
175+
}
176+
177+
It "Restore a managed HSM" {
178+
$restoreResult = Restore-AzManagedHsm -Name $hsmName -StorageContainerUri $containerUri -BackupFolder "mhsm-$hsmName-2020102105402658" -SasToken $sasToken -PassThru
179+
$restoreResult | Should -Be $True
180+
}
181+
}
182+
183+
Describe "GetAzManagedHsmRoleDefinition"{
184+
It "List all the roles at '/keys' scope" {
185+
$roles = Get-AzManagedHsmRoleDefinition -HsmName $hsmName -Scope "/keys"
186+
$roles.Count | Should -BeGreaterThan 0
187+
}
188+
189+
It "Get a specific role" {
190+
$backupRole = Get-AzManagedHsmRoleDefinition -HsmName $hsmName -RoleDefinitionName "managed hsm backup"
191+
$backupRole | Should -Not -Be $null
192+
$backupRole.Permissions | Should -Not -Be $null
193+
$backupRole.Permissions.AllowedDataActions | Should -Not -Be $null
194+
}
195+
}
196+
197+
Describe "NewAzManagedHsmRoleAssignment"{
198+
BeforeEach{
199+
$signInName = "[email protected]"
200+
$roleDefinitionName = "Managed HSM Backup"
201+
# Clean role
202+
$roleAssignment = Get-AzManagedHsmRoleAssignment -HsmName $hsmName -RoleDefinitionName $roleDefinitionName -SignInName $signInName
203+
if($roleAssignment){
204+
Remove-AzManagedHsmRoleAssignment -HsmName $hsmName -RoleDefinitionName $roleDefinitionName -SignInName $signInName
205+
}
206+
}
207+
208+
It "Assign a role to user" {
209+
# Assign role
210+
$roleAssignment = New-AzManagedHsmRoleAssignment -HsmName $hsmName -RoleDefinitionName $roleDefinitionName -SignInName $signInName
211+
$roleAssignment | Should -Not -Be $null
212+
$roleAssignment.RoleDefinitionName | Should -Be $roleDefinitionName
213+
}
214+
}
215+
216+
Describe "RemoveAzManagedHsmRoleAssignment"{
217+
BeforeEach{
218+
# Assign role
219+
$signInName = "[email protected]"
220+
$roleDefinitionName = "Managed HSM Backup"
221+
$roleAssignment = Get-AzManagedHsmRoleAssignment -HsmName $hsmName -RoleDefinitionName $roleDefinitionName -SignInName $signInName
222+
if(!$roleAssignment){
223+
$roleAssignment = New-AzManagedHsmRoleAssignment -HsmName $hsmName -RoleDefinitionName $roleDefinitionName -SignInName $signInName
224+
}
225+
}
226+
227+
It "Revoke a role from user at '/keys' scope" {
228+
Remove-AzManagedHsmRoleAssignment -HsmName $hsmName -RoleDefinitionName $roleDefinitionName -SignInName $signInName -Scope "/keys"
229+
$roleAssignment = Get-AzManagedHsmRoleAssignment -HsmName $hsmName -RoleDefinitionName $roleDefinitionName -SignInName $signInName
230+
$roleAssignment | Should -Be $null
231+
}
232+
}
233+
234+
Describe "GetAzManagedHsmRoleAssignment"{
235+
BeforeEach{
236+
# Assign role
237+
$signInName = "[email protected]"
238+
$roleDefinitionName = "Managed HSM Backup"
239+
$roleAssignment = Get-AzManagedHsmRoleAssignment -HsmName $hsmName -RoleDefinitionName $roleDefinitionName -SignInName $signInName
240+
if(!$roleAssignment){
241+
$roleAssignment = New-AzManagedHsmRoleAssignment -HsmName $hsmName -RoleDefinitionName $roleDefinitionName -SignInName $signInName
242+
}
243+
}
244+
245+
It "List all role assignmentss in a managed HSM" {
246+
$roleAssignments = Get-AzManagedHsmRoleAssignment -HsmName $hsmName
247+
$roleAssignments | Should -Not -Be $null
248+
$roleAssignments.Count | Should -BeGreaterThan 0
249+
}
250+
251+
It "List a user's role assignments in a managed HSM on '/keys' scope" {
252+
$roleAssignments = Get-AzManagedHsmRoleAssignment -HsmName $hsmName -SignInName $signInName -Scope "/keys"
253+
$roleAssignments | Should -Not -Be $null
254+
$roleAssignments.Count | Should -BeGreaterThan 0
255+
}
256+
}
257+
258+
# to do: manually remove all stuffs in resource group
259+
# AfterAll {
260+
# $hsm = Get-AzManagedHsm -Name $hsmName
261+
# Remove-AzResourceGroup -Name $hsm.ResourceGroupName -Force
262+
# }

0 commit comments

Comments
 (0)