[EventGrid] Support user identity and mixed mode

src/azure-cli/azure/cli/command_modules/eventgrid/_params.py

@@ -21,6 +21,7 @@
 from .event_channel_filter import EventChannelAddFilter
 from .inbound_ip_rules import AddInboundIpRule
 from .delivery_attribute_mapping import AddDeliveryAttributeMapping
+from .user_assigned import AddUserAssignedIdentities
 
 included_event_types_type = CLIArgumentType(
     help="A space-separated list of event types (e.g., Microsoft.Storage.BlobCreated and Microsoft.Storage.BlobDeleted). In order to subscribe to all default event types, do not specify any value for this argument. For event grid topics, event types are customer defined. For Azure events, e.g., Storage Accounts, IoT Hub, etc., you can query their event types using this CLI command 'az eventgrid topic-type list-event-types'.",
@@ -56,7 +57,7 @@
 )
 
 identity_type = CLIArgumentType(
-    help="The managed identity type for the resource.",
+    help="The managed identity type for the resource. Will be deprecated and replaced by --mi-system-assigned-identity in future",
     arg_type=get_enum_type(['noidentity', 'systemassigned']),
     options_list=['--identity'],
     is_preview=True
@@ -86,6 +87,7 @@
     arg_type=tags_type
 )
 
+
 odata_query_type = CLIArgumentType(
     help="The OData query used for filtering the list results. Filtering is currently allowed on the Name property only. The supported operations include: CONTAINS, eq (for equal), ne (for not equal), AND, OR and NOT.",
     options_list=['--odata-query']
@@ -144,6 +146,7 @@
     arg_type=name_type,
     options_list=['--partner-topic-source'])
 
+
 phone_number_type = CLIArgumentType(
     help='The customer service number of the publisher. The expected phone format should start with a \'+\' sign'
          ' followed by the country code. The remaining digits are then followed. Only digits and spaces are allowed and its'
@@ -204,7 +207,7 @@ def load_arguments(self, _):    # pylint: disable=too-many-statements
         c.argument('public_network_access', arg_type=public_network_access_type)
         c.argument('inbound_ip_rules', action=AddInboundIpRule, nargs='+')
         c.argument('sku', arg_type=sku_type)
-        c.argument('identity', arg_type=identity_type)
+        c.argument('identity', arg_type=identity_type, deprecate_info=c.deprecate(expiration='2.46.0'))
         c.argument('delivery_identity', arg_type=delivery_identity_type)
         c.argument('deadletter_identity', arg_type=deadletter_identity_type)
         c.argument('partner_registration_name', arg_type=partner_registration_name_type)
@@ -224,6 +227,13 @@ def load_arguments(self, _):    # pylint: disable=too-many-statements
         c.argument('destination_resource_group_name', help="Azure Resource Group of the customer creating the event channel. The partner topic associated with the event channel will be created under this resource group.")
         c.argument('destination_subscription_id', help="Azure subscription Id of the customer creating the event channel. The partner topic associated with the event channel will be created under this Azure subscription.")
         c.argument('topic_type', help="Name of the topic type.", completer=get_resource_name_completion_list('Microsoft.EventGrid/topictypes'))
+        c.argument('system_assigned', options_list=['--mi-system-assigned'], action='store_true', help='Presence of this param indicates that SystemAssigned managed identity will be used')
+        c.argument('user_assigned',
+                   action=AddUserAssignedIdentities,
+                   nargs='+',
+                   is_preview=True,
+                   help='Add user assigned identities when identityType is user or mixed. This attribute is valid for all destination types except StorageQueue. Multiple attributes can be specified by using more than one `--mi-user-assigned` argument',
+                   options_list=['--mi-user-assigned'])
 
     with self.argument_context('eventgrid topic') as c:
         c.argument('topic_name', arg_type=name_type, help='Name of the topic.', id_part='name', completer=get_resource_name_completion_list('Microsoft.EventGrid/topics'))

src/azure-cli/azure/cli/command_modules/eventgrid/custom.py

@@ -11,6 +11,7 @@
 from msrestazure.tools import parse_resource_id
 from dateutil.parser import parse   # pylint: disable=import-error,relative-import
 
+from azure.cli.core.azclierror import MutuallyExclusiveArgumentError
 from azure.mgmt.eventgrid.models import (
     EventSubscription,
     EventSubscriptionUpdateParameters,
@@ -70,6 +71,8 @@
 IDENTITY_NO_IDENTITY = "NoIdentity"
 IDENTITY_NONE = "None"
 IDENTITY_SYSTEM_ASSIGNED = "SystemAssigned"
+IDENTITY_USER_ASSIGNED = "UserAssigned"
+IDENTITY_MIXED_MODE = "SystemAssigned, UserAssigned"
 
 WEBHOOK_DESTINATION = "webhook"
 EVENTHUB_DESTINATION = "eventhub"
@@ -130,9 +133,11 @@ def cli_topic_create_or_update(
         inbound_ip_rules=None,
         sku=SKU_BASIC,
         identity=None,
+        user_assigned=None,
         kind=KIND_AZURE,
         extended_location_name=None,
-        extended_location_type=None):
+        extended_location_type=None,
+        system_assigned=None):
 
     final_input_schema, input_schema_mapping = _get_input_schema_and_mapping(
         input_schema,
@@ -144,8 +149,8 @@ def cli_topic_create_or_update(
 
     kind_name = _get_kind(kind)
     extended_location = _get_extended_location(kind, extended_location_name, extended_location_type)
+    identity_info = _get_identity_info(identity, kind, user_assigned, system_assigned)
 
-    identity_info = _get_identity_info(identity, kind)
     topic_info = Topic(
         location=location,
         tags=tags,
@@ -172,13 +177,15 @@ def cli_topic_update(
         public_network_access=None,
         inbound_ip_rules=None,
         sku=None,
-        identity=None):
+        identity=None,
+        user_assigned=None,
+        system_assigned=None):
     sku_info = None
     if sku is not None:
         sku_name = _get_sku(sku)
         sku_info = ResourceSku(name=sku_name)
 
-    identity_info = _get_identity_info_only_if_not_none(identity)
+    identity_info = _get_identity_info_only_if_not_none(identity, user_assigned, system_assigned)
     topic_update_parameters = TopicUpdateParameters(
         tags=tags,
         public_network_access=public_network_access,
@@ -214,13 +221,15 @@ def cli_domain_update(
         public_network_access=None,
         inbound_ip_rules=None,
         sku=None,
-        identity=None):
+        identity=None,
+        user_assigned=None,
+        system_assigned=None):
     sku_info = None
     if sku is not None:
         sku_name = _get_sku(sku)
         sku_info = ResourceSku(name=sku_name)
 
-    identity_info = _get_identity_info_only_if_not_none(identity)
+    identity_info = _get_identity_info_only_if_not_none(identity, user_assigned, system_assigned)
     domain_update_parameters = DomainUpdateParameters(
         tags=tags,
         public_network_access=public_network_access,
@@ -271,7 +280,9 @@ def cli_domain_create_or_update(
         public_network_access=None,
         inbound_ip_rules=None,
         sku=SKU_BASIC,
-        identity=None):
+        identity=None,
+        user_assigned=None,
+        system_assigned=None):
     final_input_schema, input_schema_mapping = _get_input_schema_and_mapping(
         input_schema,
         input_mapping_fields,
@@ -281,7 +292,7 @@ def cli_domain_create_or_update(
 
     identity_info = None
 
-    identity_info = _get_identity_info(identity)
+    identity_info = _get_identity_info(identity, user_assigned, system_assigned)
     domain_info = Domain(
         location=location,
         tags=tags,
@@ -638,9 +649,11 @@ def cli_system_topic_create_or_update(
         source,
         location=None,
         tags=None,
-        identity=None):
+        identity=None,
+        user_assigned=None,
+        system_assigned=None):
 
-    identity_info = _get_identity_info_only_if_not_none(identity)
+    identity_info = _get_identity_info_only_if_not_none(identity, user_assigned, system_assigned)
 
     system_topic_info = SystemTopic(
         location=location,
@@ -660,9 +673,11 @@ def cli_system_topic_update(
         resource_group_name,
         system_topic_name,
         tags=None,
-        identity=None):
+        identity=None,
+        user_assigned=None,
+        system_assigned=None):
 
-    identity_info = _get_identity_info_only_if_not_none(identity)
+    identity_info = _get_identity_info_only_if_not_none(identity, user_assigned, system_assigned)
 
     system_topic_update_parameters = SystemTopicUpdateParameters(
         tags=tags,
@@ -1621,6 +1636,25 @@ def _get_sku(sku_name):
     return result
 
 
+def _get_identity_type_with_checks(
+        identity_type_name=IDENTITY_NONE,
+        user_identity_properties=None,
+        mi_system_assigned=None):
+    if identity_type_name is not None and user_identity_properties is None and mi_system_assigned is None:
+        result = _get_identity_type(identity_type_name)
+    elif identity_type_name is None and user_identity_properties is None and mi_system_assigned is not None:
+        result = IDENTITY_SYSTEM_ASSIGNED
+    elif identity_type_name is None and user_identity_properties is not None and mi_system_assigned is None:
+        result = IDENTITY_USER_ASSIGNED
+    elif identity_type_name is None and user_identity_properties is not None and mi_system_assigned is not None:
+        result = IDENTITY_MIXED_MODE
+    elif identity_type_name is not None and (user_identity_properties is not None or mi_system_assigned is not None):
+        raise MutuallyExclusiveArgumentError(
+            'usage error: cannot use --identity together with --mi-system-assigned or --mi-user-assigned')
+
+    return result
+
+
 def _get_identity_type(identity_type_name=IDENTITY_NONE):
     if identity_type_name.lower() == IDENTITY_NO_IDENTITY.lower():
         result = IDENTITY_NONE
@@ -1796,10 +1830,10 @@ def _validate_subscription_id_matches_default_subscription_id(
                        ' use az account set ID_OR_NAME, or use the global argument --subscription ')
 
 
-def _get_identity_info(identity=None, kind=None):
+def _get_identity_info(identity=None, kind=None, user_identity_properties=None, mi_system_assigned=None):
     if (identity is not None and identity.lower() != IDENTITY_NONE.lower()):
-        identity_type_name = _get_identity_type(identity)
-        identity_info = IdentityInfo(type=identity_type_name)
+        identity_type_name = _get_identity_type_with_checks(identity, user_identity_properties, mi_system_assigned)
+        identity_info = IdentityInfo(type=identity_type_name, user_assigned_identities=user_identity_properties)
     else:
         if kind is None or kind.lower() == KIND_AZURE.lower():
             identity_info = IdentityInfo(type=IDENTITY_NONE)
@@ -1808,11 +1842,11 @@ def _get_identity_info(identity=None, kind=None):
     return identity_info
 
 
-def _get_identity_info_only_if_not_none(identity=None):
+def _get_identity_info_only_if_not_none(identity=None, user_identity_properties=None, mi_system_assigned=None):
     identity_info = None
     if (identity is not None and identity.lower() != IDENTITY_NONE.lower()):
-        identity_type_name = _get_identity_type(identity)
-        identity_info = IdentityInfo(type=identity_type_name)
+        identity_type_name = _get_identity_type_with_checks(identity, user_identity_properties, mi_system_assigned)
+        identity_info = IdentityInfo(type=identity_type_name, user_assigned_identities=user_identity_properties)
     return identity_info