Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[DoNotMerge]Added EncryptionIdentity to Encryption properties. #11602

Closed
wants to merge 17 commits into from
+305 −2
Closed

[DoNotMerge]Added EncryptionIdentity to Encryption properties. #11602

Show file tree
Hide file tree
Changes from 15 commits
Commits
Show all changes
17 commits
Select commit Hold shift + click to select a range
cec4983
Added EncryptionIdentity to Encryption properties.
dhanvia Nov 9, 2020
80ba422
Made suggested changes. Added examples for account creation.
dhanvia Dec 15, 2020
7867e10
Made changes to include UserAssignedIdentity in MSIType
dhanvia Dec 15, 2020
afc7da3
Linked Examples. Fixed minor syntax issues.
dhanvia Jan 6, 2021
58757e7
fixed type error in dictionary
dhanvia Jan 6, 2021
ef13ece
removed certain properties from responses.
dhanvia Jan 6, 2021
6c56fb4
Minor Syntax changes in examples.
dhanvia Jan 6, 2021
e9beee0
white space changes
dhanvia Jan 6, 2021
0ff50e9
Removed EncryptionIdentity properties for testing purposes
dhanvia Jan 6, 2021
192bec2
Added encryptionIdentities back.
dhanvia Jan 6, 2021
1e8ef3c
Added type to Encryption Identity
dhanvia Jan 6, 2021
14bb9ef
Added EncryptionIdentity in EncryptionProperties in the example
dhanvia Jan 14, 2021
cd9db0a
Fixed identityType
dhanvia Jan 30, 2021
9b4c776
IdentityType modeasstring set to true
dhanvia Jan 30, 2021
9f831c9
Added update example
dhanvia Jan 30, 2021
faa5744
Fixed ModelValidation Errors
dhanvia Feb 2, 2021
60cdf16
fix prettier check
Juliehzl Feb 3, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
122 changes: 122 additions & 0 deletions ...1-preview/examples/StorageAccountCreateOrUpdateUserAssignedEncryptionIdentityWithCMK.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,122 @@
{
"parameters": {
"subscriptionId": "{subscription-id}",
"resourceGroupName": "res9101",
"accountName": "sto4445",
"api-version": "2020-08-01-preview",
"parameters": {
"identity": {
"type": "UserAssigned",
"userAssignedIdentities": {
"/subscriptions/{subscription-id}/resourceGroups/res9101/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{managed-identity-name}": {
}
}
},
"sku": {
"name": "Standard_LRS"
},
"kind": "Storage",
"location": "eastus",
dhanvia marked this conversation as resolved.
Show resolved Hide resolved
"properties": {
"encryption": {
"services": {
"file": {
"keyType": "Account",
"enabled": true
},
"blob": {
"keyType": "Account",
"enabled": true
}
},
"keyvaultproperties": {
"keyvaulturi": "https://myvault8569.vault.azure.net",
"keyname": "wrappingKey",
"keyversion": ""
},
"keySource": "Microsoft.Keyvault",
"identity":{
"type": "ManagedServiceIdentity",
"userAssignedIdentity": "/subscriptions/{subscription-id}/resourceGroups/res9101/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{managed-identity-name}"
}
}
}
}
},
"responses": {
"200": {
"body": {
"identity": {
"userAssignedIdentities": {
"/subscriptions/{subscription-id}/resourceGroups/res9101/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{managed-identity-name}": {
"principalId": "8d823284-1060-42a5-9ec4-ed3d831e24d7",
"tenantId": "f14da12a-1e85-4c31-ae98-bcf5608d2266",
"clientId": "fbaa6278-1ecc-415c-819f-6e2058d3acb5"
}
},
"type": "UserAssigned"
},
"sku": {
"name": "Standard_LRS",
"tier": "Standard"
},
"kind": "StorageV2",
"id": "/subscriptions/{subscription-id}/resourceGroups/res9101/providers/Microsoft.Storage/storageAccounts/sto4445",
"name": "sto4445",
"type": "Microsoft.Storage/storageAccounts",
"location": "eastus",
"tags": {},
"properties": {
"privateEndpointConnections": [],
"networkAcls": {
"bypass": "AzureServices",
"virtualNetworkRules": [],
"ipRules": [],
"defaultAction": "Allow"
},
"supportsHttpsTrafficOnly": true,
"encryption": {
"identity": {
"type": "ManagedServiceIdentity",
"userAssignedIdentity": "/subscriptions/{subscription-id}/resourcegroups/res9101/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{managed-identity-name}"
},
"keyvaultproperties": {
"keyvaulturi": "https://myvault8569.vault.azure.net",
"keyname": "wrappingKey",
"keyversion": "",
"currentVersionedKeyIdentifier": "https://myvault8569.vault.azure.net/keys/wrappingKey/0682afdd9c104f4285df20107e956cad",
"lastKeyRotationTimestamp": "2019-12-13T20:36:23.7023290Z"
},
"services": {
"file": {
"keyType": "Account",
"enabled": true,
"lastEnabledTime": "2020-12-15T00:43:14.1739587Z"
},
"blob": {
"keyType": "Account",
"enabled": true,
"lastEnabledTime": "2020-12-15T00:43:14.1739587Z"
}
},
"keySource": "Microsoft.Keyvault"
},
"accessTier": "Hot",
"provisioningState": "Succeeded",
"creationTime": "2020-12-15T00:43:14.0839093Z",
"primaryEndpoints": {
"web": "https://sto4445.web.core.windows.net/",
"dfs": "https://sto4445.dfs.core.windows.net/",
"blob": "https://sto4445.blob.core.windows.net/",
"file": "https://sto4445.file.core.windows.net/",
"queue": "https://sto4445.queue.core.windows.net/",
"table": "https://sto4445.table.core.windows.net/"
},
"primaryLocation": "eastus",
"statusOfPrimary": "available"
}
}
},
"202": {}
dhanvia marked this conversation as resolved.
Show resolved Hide resolved
}
}
71 changes: 67 additions & 4 deletions ...cation/storage/resource-manager/Microsoft.Storage/preview/2020-08-01-preview/storage.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,6 +128,9 @@
"x-ms-examples": {
"StorageAccountCreate": {
"$ref": "./examples/StorageAccountCreate.json"
},
"StorageAccountCreateUserAssignedEncryptionIdentityWithCMK": {
dhanvia marked this conversation as resolved.
Show resolved Hide resolved
"$ref": "./examples/StorageAccountCreateOrUpdateUserAssignedEncryptionIdentityWithCMK.json"
}
},
"parameters": [
Expand Down Expand Up @@ -267,6 +270,9 @@
},
"StorageAccountEnableCMK": {
"$ref": "./examples/StorageAccountEnableCMK.json"
},
"StorageAccountUpdateUserAssignedEncryptionIdentityWithCMK": {
"$ref": "./examples/StorageAccountCreateOrUpdateUserAssignedEncryptionIdentityWithCMK.json"
}
},
"parameters": [
Expand Down Expand Up @@ -2132,6 +2138,28 @@
}
}
},
"EncryptionIdentity":{
blueww marked this conversation as resolved.
Show resolved Hide resolved
Copy link
Member

@blueww blueww Feb 1, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

As we discussed in mail, as we don't want to expose this part in SDK, please remove it from swagger. (SDK is generated from swagger).
Please discussed with feature PM to deside which properties won't expose in swagger.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@blueww The EncryptionIdentity property is necessary in order for the user to be able to create a Storage Account with CMKL at creation time. Will update this thread after hearing back from PM.

"description": "Identity to be used for server-side encryption on the storage account",
"properties": {
"userAssignedIdentity":{
"type": "string",
"description": "ResourceID of the UserAssignedIdentity to be associated with server-side encryption on the storage account.",
"x-ms-client-name": "UserAssignedIdentity"
},
"type": {
"type": "string",
"description": "The Encryption Identity type.",
"enum": [
"ManagedServiceIdentity",
"StorageService"
],
"x-ms-enum": {
"name": "EncryptionIdentityType",
"modelAsString": true
}
}
}
},
"Encryption": {
"properties": {
"services": {
Expand Down Expand Up @@ -2160,6 +2188,11 @@
"$ref": "#/definitions/KeyVaultProperties",
"x-ms-client-name": "KeyVaultProperties",
"description": "Properties provided by key vault."
},
"identity": {
"$ref": "#/definitions/EncryptionIdentity",
"x-ms-client-name": "EncryptionIdentity",
"description": "Encryption Identity properties when storage account is associated with a UserAssignedIdentity."
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Could user both assign a user identity here, and also assign a system identity?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No. "EncryptionIdentity" property is only for UserAssignedIdentities.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Then if user try to assign system identity to an storage account which already has user assigned identity, what will happen? vise version?
It seems we didn't block user to do that from rest API definition.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the 'Identity' property you are referring to is the property on the storage account level which can be either 'SystemAssigned' and 'UserAssigned'. The changes in the current PR is not modifying that property.

The "EncryptionIdentity" here is referring to a new 'identity' property within the scope of the EncryptionProperties of the storage account. These properties only apply to UserAssignedIdentities.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the reply!
Is there any relationship of the 2 identities setting?
Is there any feature spec rest API spec for this change? After user set this identity, what will happen?

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi Sorry for the late reply. I got pulled into higher priority tasks for two weeks.

I will confirm the details with feature owner and reply here soon

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

EncryptionIdentity allows you to specify the specific user assigned identity that needs to be used for encryption. When not applied, Storage defaults to attempting to use the SystemAssigned Identity.

}
},
"required": [
Expand Down Expand Up @@ -2446,6 +2479,26 @@
},
"description": "The parameters used to create the storage account."
},
"UserAssignedIdentityType":{
"properties": {
"principalId": {
"readOnly": true,
"type": "string",
"description": "The principal ID of resource identity."
},
"tenantId": {
"readOnly": true,
"type": "string",
"description": "The tenant ID of resource."
},
"clientId": {
"readOnly": true,
"type": "string",
"description": "The identity of the client"
}
},
"description": "UserAssignedIdentity for the resource."
},
"Identity": {
"properties": {
"principalId": {
Expand All @@ -2462,14 +2515,24 @@
"type": "string",
"description": "The identity type.",
"enum": [
"SystemAssigned"
"SystemAssigned",
"UserAssigned",
"SystemAssigned,UserAssigned",
"None"
],
"x-ms-enum": {
"name": "IdentityType",
"modelAsString": false
"modelAsString": true
}
}
},
},
"userAssignedIdentities":{
"type": "object",
"description": "Dictionary to map userAssignedIdentityID strings to userAssignedIdentity properties",
"additionalProperties": {
"$ref": "#/definitions/UserAssignedIdentityType"
}
}
},
"required": [
"type"
],
Expand Down