Skip to content

Commit 42397a9

Browse files
mccoypmccoyp
authored
[Key Vault] Add support for custom role definitions (Azure#16063)
* Implement sync API * Implement async API * Add sync tests, update public model * Add async tests, update Definitions model * Add sync test recordings * Add async test recordings * Re-generate with approved swagger changes * Add enum, address feedback * Update KeyVaultRoleScope location * Address feedback * Add test recordings * Apply naming changes * Thanks, Charles!
1 parent 91b3438 commit 42397a9

21 files changed

+2104
-434
lines changed

‎sdk/keyvault/azure-keyvault-administration/azure/keyvault/administration/__init__.py‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,13 +4,13 @@
44
# ------------------------------------
55
from ._access_control_client import KeyVaultAccessControlClient
66
from ._backup_client import KeyVaultBackupClient
7+
from ._enums import KeyVaultRoleScope, KeyVaultDataAction
78
from ._internal.client_base import ApiVersion
89
from ._models import (
910
BackupOperation,
1011
KeyVaultPermission,
1112
KeyVaultRoleAssignment,
1213
KeyVaultRoleDefinition,
13-
KeyVaultRoleScope,
1414
RestoreOperation,
1515
SelectiveKeyRestoreOperation,
1616
)
@@ -21,6 +21,7 @@
2121
"BackupOperation",
2222
"KeyVaultAccessControlClient",
2323
"KeyVaultBackupClient",
24+
"KeyVaultDataAction",
2425
"KeyVaultPermission",
2526
"KeyVaultRoleAssignment",
2627
"KeyVaultRoleDefinition",

‎sdk/keyvault/azure-keyvault-administration/azure/keyvault/administration/_access_control_client.py‎

Lines changed: 82 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,10 +12,11 @@
1212

1313
if TYPE_CHECKING:
1414
# pylint:disable=ungrouped-imports
15-
from typing import Any, Union
15+
from typing import Any, Iterable, Union
1616
from uuid import UUID
1717
from azure.core.paging import ItemPaged
18-
from ._models import KeyVaultRoleScope
18+
from ._enums import KeyVaultRoleScope
19+
from ._models import KeyVaultPermission
1920

2021

2122
class KeyVaultAccessControlClient(KeyVaultClientBase):
@@ -83,7 +84,7 @@ def get_role_assignment(self, role_scope, role_assignment_name, **kwargs):
8384
:param role_scope: the assignment's scope, for example "/", "/keys", or "/keys/<specific key identifier>"
8485
:class:`KeyVaultRoleScope` defines common broad scopes. Specify a narrower scope as a string.
8586
:type role_scope: str or KeyVaultRoleScope
86-
:param role_assignment_name: the assignment's name. Must be a UUID.
87+
:param role_assignment_name: the assignment's name.
8788
:type role_assignment_name: str or uuid.UUID
8889
:rtype: KeyVaultRoleAssignment
8990
"""
@@ -109,6 +110,84 @@ def list_role_assignments(self, role_scope, **kwargs):
109110
**kwargs
110111
)
111112

113+
@distributed_trace
114+
def set_role_definition(self, role_scope, permissions, **kwargs):
115+
# type: (Union[str, KeyVaultRoleScope], Iterable[KeyVaultPermission], **Any) -> KeyVaultRoleDefinition
116+
"""Creates or updates a custom role definition.
117+
118+
:param role_scope: scope of the role definition. :class:`KeyVaultRoleScope` defines common broad scopes.
119+
Specify a narrower scope as a string. Managed HSM only supports '/', or KeyVaultRoleScope.global_value.
120+
:type role_scope: str or KeyVaultRoleScope
121+
:param permissions: the role definition's permissions. An empty list results in a role definition with no action
122+
permissions.
123+
:type permissions: Iterable[KeyVaultPermission]
124+
:keyword role_definition_name: the role definition's name. Must be a UUID.
125+
:type role_definition_name: str or uuid.UUID
126+
:keyword assignable_scopes: the role definition's assignable scopes.
127+
:type assignable_scopes: list[str]
128+
:returns: The created or updated role definition
129+
:rtype: KeyVaultRoleDefinition
130+
"""
131+
role_definition_name = kwargs.pop("role_definition_name", None) or uuid4()
132+
permissions = [
133+
self._client.role_definitions.models.Permission(
134+
actions=p.allowed_actions,
135+
not_actions=p.denied_actions,
136+
data_actions=p.allowed_data_actions,
137+
not_data_actions=p.denied_data_actions,
138+
)
139+
for p in permissions
140+
]
141+
142+
properties = self._client.role_definitions.models.RoleDefinitionProperties(
143+
role_name=role_definition_name, permissions=permissions, **kwargs
144+
)
145+
parameters = self._client.role_definitions.models.RoleDefinitionCreateParameters(properties=properties)
146+
147+
definition = self._client.role_definitions.create_or_update(
148+
vault_base_url=self._vault_url,
149+
scope=role_scope,
150+
role_definition_name=role_definition_name,
151+
parameters=parameters,
152+
**kwargs
153+
)
154+
return KeyVaultRoleDefinition._from_generated(definition)
155+
156+
@distributed_trace
157+
def get_role_definition(self, role_scope, role_definition_name, **kwargs):
158+
# type: (Union[str, KeyVaultRoleScope], Union[str, UUID], **Any) -> KeyVaultRoleDefinition
159+
"""Get the specified role definition.
160+
161+
:param role_scope: scope of the role definition. :class:`KeyVaultRoleScope` defines common broad scopes.
162+
Specify a narrower scope as a string. Managed HSM only supports '/', or KeyVaultRoleScope.global_value.
163+
:type role_scope: str or KeyVaultRoleScope
164+
:param role_definition_name: the role definition's name.
165+
:type role_definition_name: str or uuid.UUID
166+
:rtype: KeyVaultRoleDefinition
167+
"""
168+
definition = self._client.role_definitions.get(
169+
vault_base_url=self._vault_url, scope=role_scope, role_definition_name=str(role_definition_name), **kwargs
170+
)
171+
return KeyVaultRoleDefinition._from_generated(definition)
172+
173+
@distributed_trace
174+
def delete_role_definition(self, role_scope, role_definition_name, **kwargs):
175+
# type: (Union[str, KeyVaultRoleScope], Union[str, UUID], **Any) -> KeyVaultRoleDefinition
176+
"""Deletes a custom role definition.
177+
178+
:param role_scope: scope of the role definition. :class:`KeyVaultRoleScope` defines common broad scopes.
179+
Specify a narrower scope as a string. Managed HSM only supports '/', or KeyVaultRoleScope.global_value.
180+
:type role_scope: str or KeyVaultRoleScope
181+
:param role_definition_name: the role definition's name. Must be a UUID.
182+
:type role_definition_name: str or uuid.UUID
183+
:returns: the deleted role definition
184+
:rtype: KeyVaultRoleDefinition
185+
"""
186+
definition = self._client.role_definitions.delete(
187+
vault_base_url=self._vault_url, scope=role_scope, role_definition_name=str(role_definition_name), **kwargs
188+
)
189+
return KeyVaultRoleDefinition._from_generated(definition)
190+
112191
@distributed_trace
113192
def list_role_definitions(self, role_scope, **kwargs):
114193
# type: (Union[str, KeyVaultRoleScope], **Any) -> ItemPaged[KeyVaultRoleDefinition]

‎sdk/keyvault/azure-keyvault-administration/azure/keyvault/administration/_enums.py‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
# ------------------------------------
2+
# Copyright (c) Microsoft Corporation.
3+
# Licensed under the MIT License.
4+
# ------------------------------------
5+
from enum import Enum
6+
7+
8+
class KeyVaultRoleScope(str, Enum):
9+
"""Collection of well known role scopes. This list is not exhaustive."""
10+
11+
GLOBAL = "/" #: use this if you want role assignments to apply to everything on the resource
12+
13+
KEYS = "/keys" #: use this if you want role assignments to apply to all keys
14+
15+
16+
class KeyVaultDataAction(str, Enum):
17+
"""Supported permissions for data actions."""
18+
19+
#: Read HSM key metadata.
20+
READ_HSM_KEY = "Microsoft.KeyVault/managedHsm/keys/read/action"
21+
#: Update an HSM key.
22+
WRITE_HSM_KEY = "Microsoft.KeyVault/managedHsm/keys/write/action"
23+
#: Read deleted HSM key.
24+
READ_DELETED_HSM_KEY = "Microsoft.KeyVault/managedHsm/keys/deletedKeys/read/action"
25+
#: Recover deleted HSM key.
26+
RECOVER_DELETED_HSM_KEY = "Microsoft.KeyVault/managedHsm/keys/deletedKeys/recover/action"
27+
#: Backup HSM keys.
28+
BACKUP_HSM_KEYS = "Microsoft.KeyVault/managedHsm/keys/backup/action"
29+
#: Restore HSM keys.
30+
RESTORE_HSM_KEYS = "Microsoft.KeyVault/managedHsm/keys/restore/action"
31+
#: Delete role assignment.
32+
DELETE_ROLE_ASSIGNMENT = "Microsoft.KeyVault/managedHsm/roleAssignments/delete/action"
33+
#: Get role assignment.
34+
GET_ROLE_ASSIGNMENT = "Microsoft.KeyVault/managedHsm/roleAssignments/read/action"
35+
#: Create or update role assignment.
36+
WRITE_ROLE_ASSIGNMENT = "Microsoft.KeyVault/managedHsm/roleAssignments/write/action"
37+
#: Get role definition.
38+
READ_ROLE_DEFINITION = "Microsoft.KeyVault/managedHsm/roleDefinitions/read/action"
39+
#: Encrypt using an HSM key.
40+
ENCRYPT_HSM_KEY = "Microsoft.KeyVault/managedHsm/keys/encrypt/action"
41+
#: Decrypt using an HSM key.
42+
DECRYPT_HSM_KEY = "Microsoft.KeyVault/managedHsm/keys/decrypt/action"
43+
#: Wrap using an HSM key.
44+
WRAP_HSM_KEY = "Microsoft.KeyVault/managedHsm/keys/wrap/action"
45+
#: Unwrap using an HSM key.
46+
UNWRAP_HSM_KEY = "Microsoft.KeyVault/managedHsm/keys/unwrap/action"
47+
#: Sign using an HSM key.
48+
SIGN_HSM_KEY = "Microsoft.KeyVault/managedHsm/keys/sign/action"
49+
#: Verify using an HSM key.
50+
VERIFY_HSM_KEY = "Microsoft.KeyVault/managedHsm/keys/verify/action"
51+
#: Create an HSM key.
52+
CREATE_HSM_KEY = "Microsoft.KeyVault/managedHsm/keys/create"
53+
#: Delete an HSM key.
54+
DELETE_HSM_KEY = "Microsoft.KeyVault/managedHsm/keys/delete"
55+
#: Export an HSM key.
56+
EXPORT_HSM_KEY = "Microsoft.KeyVault/managedHsm/keys/export/action"
57+
#: Import an HSM key.
58+
IMPORT_HSM_KEY = "Microsoft.KeyVault/managedHsm/keys/import/action"
59+
#: Purge a deleted HSM key.
60+
PURGE_DELETED_HSM_KEY = "Microsoft.KeyVault/managedHsm/keys/deletedKeys/delete"
61+
#: Download an HSM security domain.
62+
DOWNLOAD_HSM_SECURITY_DOMAIN = "Microsoft.KeyVault/managedHsm/securitydomain/download/action"
63+
#: Upload an HSM security domain.
64+
UPLOAD_HSM_SECURITY_DOMAIN = "Microsoft.KeyVault/managedHsm/securitydomain/upload/action"
65+
#: Check the status of the HSM security domain exchange file.
66+
READ_HSM_SECURITY_DOMAIN_STATUS = "Microsoft.KeyVault/managedHsm/securitydomain/upload/read"
67+
#: Download an HSM security domain transfer key.
68+
READ_HSM_SECURITY_DOMAIN_TRANSFER_KEY = "Microsoft.KeyVault/managedHsm/securitydomain/transferkey/read"
69+
#: Start an HSM backup.
70+
START_HSM_BACKUP = "Microsoft.KeyVault/managedHsm/backup/start/action"
71+
#: Start an HSM restore.
72+
START_HSM_RESTORE = "Microsoft.KeyVault/managedHsm/restore/start/action"
73+
#: Read an HSM backup status.
74+
READ_HSM_BACKUP_STATUS = "Microsoft.KeyVault/managedHsm/backup/status/action"
75+
#: Read an HSM restore status.
76+
READ_HSM_RESTORE_STATUS = "Microsoft.KeyVault/managedHsm/restore/status/action"

‎sdk/keyvault/azure-keyvault-administration/azure/keyvault/administration/_generated/v7_2_preview/aio/operations_async/__init__.py‎

Lines changed: 3 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,17 +1,15 @@
11
# coding=utf-8
22
# --------------------------------------------------------------------------
3-
# Copyright (c) Microsoft Corporation. All rights reserved.
4-
# Licensed under the MIT License. See License.txt in the project root for license information.
5-
# Code generated by Microsoft (R) AutoRest Code Generator.
3+
# Code generated by Microsoft (R) AutoRest Code Generator (autorest: 3.0.6306, generator: {generator})
64
# Changes may cause incorrect behavior and will be lost if the code is regenerated.
75
# --------------------------------------------------------------------------
86

9-
from ._key_vault_client_operations_async import KeyVaultClientOperationsMixin
107
from ._role_definitions_operations_async import RoleDefinitionsOperations
118
from ._role_assignments_operations_async import RoleAssignmentsOperations
9+
from ._key_vault_client_operations_async import KeyVaultClientOperationsMixin
1210

1311
__all__ = [
14-
'KeyVaultClientOperationsMixin',
1512
'RoleDefinitionsOperations',
1613
'RoleAssignmentsOperations',
14+
'KeyVaultClientOperationsMixin',
1715
]

0 commit comments

Comments
 (0)