Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Model role scope, permissions, and role type as enum values #12414

Merged
merged 18 commits into from
Jan 25, 2021
Merged

Model role scope, permissions, and role type as enum values #12414

Changes from 17 commits
Commits
Show all changes
18 commits
Select commit Hold shift + click to select a range
44ab208
define permissions enums
christothes Jan 12, 2021
9d76004
anyOf
christothes Jan 12, 2021
55363c7
fixup schema
christothes Jan 12, 2021
5ff40f3
Merge remote-tracking branch 'upstream/master' into users/chriss/KV-RBAC
christothes Jan 12, 2021
c69fd38
add enums for roleType and roleDefinitionType
christothes Jan 13, 2021
81a41f3
add roleScope enum
christothes Jan 13, 2021
ce25ca9
scope names
christothes Jan 13, 2021
1c0fc6b
set name for enum
christothes Jan 13, 2021
d7657f1
consolidate DataActions
christothes Jan 13, 2021
646d819
revert consolidation
christothes Jan 13, 2021
1be7282
enum names and desscriptions
christothes Jan 13, 2021
c948507
fix ReadDeletedHsmKey
christothes Jan 13, 2021
4bd8acb
ReadHsmSecurityDomainTransferKey
christothes Jan 13, 2021
1323b51
spellcheck
christothes Jan 13, 2021
c9ccfcb
pr comments
christothes Jan 14, 2021
ad6dcfd
renames and description changes
christothes Jan 14, 2021
6d63c69
Update specification/keyvault/data-plane/Microsoft.KeyVault/preview/7…
christothes Jan 14, 2021
d5d9907
renames
christothes Jan 21, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
266 changes: 251 additions & 15 deletions specification/keyvault/data-plane/Microsoft.KeyVault/preview/7.2-preview/rbac.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -443,8 +443,7 @@
"RoleAssignmentPropertiesWithScope": {
"properties": {
"scope": {
"type": "string",
"description": "The role assignment scope."
"$ref": "#/definitions/RoleScope"
},
"roleDefinitionId": {
"type": "string",
Expand Down Expand Up @@ -551,31 +550,32 @@
"properties": {
"actions": {
"type": "array",
"description": "Action permissions that are granted.",
"items": {
"type": "string"
},
"description": "Allowed actions."
}
},
"notActions": {
"type": "array",
"description": "Action permissions that are excluded but not denied. They may be granted by other role definitions assigned to a principal.",
"items": {
"type": "string"
},
"description": "Denied actions."
"type": "string",
"description": "Not actions."
}
},
"dataActions": {
"type": "array",
"description": "Data action permissions that are granted.",
"items": {
"type": "string"
},
"description": "Allowed Data actions."
"$ref": "#/definitions/DataActionPermission"
}
},
"notDataActions": {
"type": "array",
"description": "Data action permissions that are excluded but not denied. They may be granted by other role definitions assigned to a principal.",
"items": {
"type": "string"
},
"description": "Denied Data actions."
"$ref": "#/definitions/DataActionPermission"
}
}
},
"description": "Role definition permissions."
Expand All @@ -593,6 +593,25 @@
"type": {
"type": "string",
"description": "The role type.",
"enum": [
"AKVBuiltInRole",
"CustomRole"
],
"x-ms-enum": {
"name": "RoleType",
"modelAsString": true,
"values": [
{
"name": "BuiltInRole",
"value": "AKVBuiltInRole",
"description": "Built in role."
},
{
"value": "CustomRole",
"description": "Custom role."
}
]
},
"x-ms-client-name": "roleType"
},
"permissions": {
Expand All @@ -605,7 +624,7 @@
"assignableScopes": {
"type": "array",
"items": {
"type": "string"
"$ref": "#/definitions/RoleScope"
},
"description": "Role definition assignable scopes."
}
Expand All @@ -626,8 +645,15 @@
},
"type": {
"type": "string",
"description": "The role definition type.",
"readOnly": true,
"description": "The role definition type."
"enum": [
"Microsoft.Authorization/roleDefinitions"
],
"x-ms-enum": {
"name": "RoleDefinitionType",
"modelAsString": true
}
},
"properties": {
"x-ms-client-flatten": true,
Expand All @@ -652,6 +678,216 @@
}
},
"description": "Role definition list operation result."
},
"RoleScope": {
"type": "string",
"description": "The role scope.",
"enum": [
"/",
"/keys"
],
"x-ms-enum": {
"name": "RoleScope",
"modelAsString": true,
"values": [
{
"name": "Global",
"value": "/",
"description": "Global scope"
},
{
"name": "Keys",
"value": "/keys",
"description": "Keys scope"
}
]
}
},
"DataActionPermission": {
Copy link
Member

@mccoyp mccoyp Jan 21, 2021 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Another naming question: should this be changed to DataAction since it'll be prefixed with "KeyVault" in the SDK (and they describe action permissions in the same way KeyOperation describes operation permissions)?

"type": "string",
"description": "Supported permissions for data actions.",
"enum": [
"Microsoft.KeyVault/managedHsm/keys/read/action",
"Microsoft.KeyVault/managedHsm/keys/write/action",
"Microsoft.KeyVault/managedHsm/keys/deletedKeys/read/action",
"Microsoft.KeyVault/managedHsm/keys/deletedKeys/recover/action",
"Microsoft.KeyVault/managedHsm/keys/backup/action",
"Microsoft.KeyVault/managedHsm/keys/restore/action",
"Microsoft.KeyVault/managedHsm/roleAssignments/delete/action",
"Microsoft.KeyVault/managedHsm/roleAssignments/read/action",
"Microsoft.KeyVault/managedHsm/roleAssignments/write/action",
"Microsoft.KeyVault/managedHsm/roleDefinitions/read/action",
"Microsoft.KeyVault/managedHsm/keys/encrypt/action",
"Microsoft.KeyVault/managedHsm/keys/decrypt/action",
"Microsoft.KeyVault/managedHsm/keys/wrap/action",
"Microsoft.KeyVault/managedHsm/keys/unwrap/action",
"Microsoft.KeyVault/managedHsm/keys/sign/action",
"Microsoft.KeyVault/managedHsm/keys/verify/action",
"Microsoft.KeyVault/managedHsm/keys/create",
"Microsoft.KeyVault/managedHsm/keys/delete",
"Microsoft.KeyVault/managedHsm/keys/export/action",
"Microsoft.KeyVault/managedHsm/keys/import/action",
"Microsoft.KeyVault/managedHsm/keys/deletedKeys/delete",
"Microsoft.KeyVault/managedHsm/securitydomain/download/action",
"Microsoft.KeyVault/managedHsm/securitydomain/upload/action",
"Microsoft.KeyVault/managedHsm/securitydomain/upload/read",
"Microsoft.KeyVault/managedHsm/securitydomain/transferkey/read",
"Microsoft.KeyVault/managedHsm/backup/start/action",
"Microsoft.KeyVault/managedHsm/restore/start/action",
"Microsoft.KeyVault/managedHsm/backup/status/action",
"Microsoft.KeyVault/managedHsm/restore/status/action"
],
"x-ms-enum": {
"name": "DataActionPermission",
"modelAsString": true,
"values": [
{
"name": "ReadHsmKey",
"value": "Microsoft.KeyVault/managedHsm/keys/read/action",
"description": "Read HSM key metadata."
},
{
"name": "WriteHsmKey",
"value": "Microsoft.KeyVault/managedHsm/keys/write/action",
"description": "Update an HSM key."
},
{
"name": "ReadDeletedHsmKey",
"value": "Microsoft.KeyVault/managedHsm/keys/deletedKeys/read/action",
"description": "Read deleted HSM key."
},
{
"name": "RecoverDeletedHsmKey",
"value": "Microsoft.KeyVault/managedHsm/keys/deletedKeys/recover/action",
"description": "Recover deleted HSM key."
},
{
"name": "BackupHsmKeys",
"value": "Microsoft.KeyVault/managedHsm/keys/backup/action",
"description": "Backup HSM keys."
},
{
"name": "RestoreHsmKey",
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should this be RestoreHsmKeys to align with BackupHsmKeys?

"value": "Microsoft.KeyVault/managedHsm/keys/restore/action",
"description": "Restore HSM keys."
},
{
"name": "DeleteRoleAssignment",
"value": "Microsoft.KeyVault/managedHsm/roleAssignments/delete/action",
"description": "Delete role assignment."
},
{
"name": "GetRoleAssignment",
"value": "Microsoft.KeyVault/managedHsm/roleAssignments/read/action",
"description": "Get role assignment."
},
{
"name": "WriteRoleAssignment",
"value": "Microsoft.KeyVault/managedHsm/roleAssignments/write/action",
"description": "Create or update role assignment."
},
{
"name": "ReadRoleDefinition",
"value": "Microsoft.KeyVault/managedHsm/roleDefinitions/read/action",
"description": "Get role definition."
},
{
"name": "EncryptHsmKey",
"value": "Microsoft.KeyVault/managedHsm/keys/encrypt/action",
"description": "Encrypt using an HSM key."
},
{
"name": "DecryptHsmKey",
"value": "Microsoft.KeyVault/managedHsm/keys/decrypt/action",
"description": "Decrypt using an HSM key."
},
{
"name": "WrapHsmKey",
"value": "Microsoft.KeyVault/managedHsm/keys/wrap/action",
"description": "Wrap using an HSM key."
},
{
"name": "UnwrapHsmKey",
"value": "Microsoft.KeyVault/managedHsm/keys/unwrap/action",
"description": "Unwrap using an HSM key."
},
{
"name": "SignHsmKey",
"value": "Microsoft.KeyVault/managedHsm/keys/sign/action",
"description": "Sign using an HSM key."
},
{
"name": "VerifyHsmKey",
"value": "Microsoft.KeyVault/managedHsm/keys/verify/action",
"description": "Verify using an HSM key."
},
{
"name": "CreateHsmKey",
"value": "Microsoft.KeyVault/managedHsm/keys/create",
"description": "Create an HSM key."
},
{
"name": "DeleteHsmKey",
"value": "Microsoft.KeyVault/managedHsm/keys/delete",
"description": "Delete an HSM key."
},
{
"name": "ExportHsmKey",
"value": "Microsoft.KeyVault/managedHsm/keys/export/action",
"description": "Export an HSM key."
},
{
"name": "ImportHsmKey",
"value": "Microsoft.KeyVault/managedHsm/keys/import/action",
"description": "Import an HSM key."
},
{
"name": "PurgeDeletedHsmKey",
"value": "Microsoft.KeyVault/managedHsm/keys/deletedKeys/delete",
"description": "Purge a deleted HSM key."
},
{
"name": "DownloadHsmSecurityDomain",
"value": "Microsoft.KeyVault/managedHsm/securitydomain/download/action",
"description": "Download an HSM security domain."
},
{
"name": "UploadHsmSecurityDomain",
"value": "Microsoft.KeyVault/managedHsm/securitydomain/upload/action",
"description": "Upload an HSM security domain."
},
{
"name": "ReadHsmSecurityDomainStatus",
"value": "Microsoft.KeyVault/managedHsm/securitydomain/upload/read",
"description": "Check the status of the HSM security domain exchange file."
},
{
"name": "ReadHsmSecurityDomainTransferKey",
"value": "Microsoft.KeyVault/managedHsm/securitydomain/transferkey/read",
"description": "Download an HSM security domain transfer key."
},
{
"name": "StartHsmBackup",
"value": "Microsoft.KeyVault/managedHsm/backup/start/action",
"description": "Start an HSM backup."
},
{
"name": "StartHsmRestore",
"value": "Microsoft.KeyVault/managedHsm/restore/start/action",
"description": "Start an HSM restore."
},
{
"name": "ReadHsmBackupStatus",
"value": "Microsoft.KeyVault/managedHsm/backup/status/action",
"description": "Read an HSM backup status."
},
{
"name": "ReadHsmRestoreStatus",
"value": "Microsoft.KeyVault/managedHsm/restore/status/action",
"description": "Read an HSM restore status."
}
]
}
}
},
"parameters": {
Expand Down