[Cosmos DB] az cosmosdb create/update: Add support for minimum allowed TLS version and burst capacity configuration

src/azure-cli/azure/cli/command_modules/cosmosdb/_help.py

@@ -180,6 +180,13 @@
     short-summary: Add table names to restore
     long-summary: |
         Usage:          --tables-to-restore tables=table1 [table2 ...]
+  -name: --minimal-tls-version
+    short-summary: Indicate the minimum allowed TLS version
+    long-summary: |
+      Usage:    --minimal-tls-version TLSVersion
+      Default:  Tls, except for Cassandra and Mongo APIs, which only work with Tls12
+      The accepted values for the minimal TLS version are 'Tls', 'Tls11', and 'Tls12', which correspond to the
+      TLS versions 1.0, 1.1, and 1.2. 
 examples:
   - name: Creates a new Azure Cosmos DB database account. (autogenerated)
     text: az cosmosdb create --name MyCosmosDBDatabaseAccount --resource-group MyResourceGroup --subscription MySubscription
@@ -927,6 +934,13 @@
         Default:        single region account in the location of the specified resource group.
         Failover priority values are 0 for write regions and greater than 0 for read regions. A failover priority value must be unique and less than the total number of regions.
         Multiple locations can be specified by using more than one `--locations` argument.
+  -name: --minimal-tls-version
+    short-summary: Indicate the minimum allowed TLS version
+    long-summary: |
+      Usage:    --minimal-tls-version TLSVersion
+      Default:  Tls, except for Cassandra and Mongo APIs, which only work with Tls12
+      The accepted values for the minimal TLS version are 'Tls', 'Tls11', and 'Tls12', which correspond to the
+      TLS versions 1.0, 1.1, and 1.2. 
 examples:
   - name: Update an Azure Cosmos DB database account. (autogenerated)
     text: az cosmosdb update --capabilities EnableGremlin --name MyCosmosDBDatabaseAccount --resource-group MyResourceGroup

src/azure-cli/azure/cli/command_modules/cosmosdb/_params.py

@@ -81,15 +81,16 @@ def load_arguments(self, _):
     with self.argument_context('cosmosdb create') as c:
         c.argument('account_name', completer=None)
         c.argument('enable_free_tier', arg_type=get_three_state_flag(), help="If enabled the account is free-tier.", is_preview=True)
-        c.argument('assign_identity', nargs='*', help="Assign system or user assigned identities separated by spaces. Use '[system]' to refer system assigned identity.", is_preview=True)
+        c.argument('assign_identity', nargs='*', help="Assign system or user assigned identities separated by spaces. Use '[system]' to refer system assigned identity.")
         c.argument('is_restore_request', options_list=['--is-restore-request', '-r'], arg_type=get_three_state_flag(), help="Restore from an existing/deleted account.", arg_group='Restore')
         c.argument('restore_source', help="The restorable-database-account Id of the source account from which the account has to be restored. Required if --is-restore-request is set to true.", arg_group='Restore')
         c.argument('restore_timestamp', action=UtcDatetimeAction, help="The timestamp to which the account has to be restored to. Required if --is-restore-request is set to true.", arg_group='Restore')
         c.argument('databases_to_restore', nargs='+', action=CreateDatabaseRestoreResource, arg_group='Restore')
         c.argument('gremlin_databases_to_restore', nargs='+', action=CreateGremlinDatabaseRestoreResource, arg_group='Restore')
         c.argument('tables_to_restore', nargs='+', action=CreateTableRestoreResource, arg_group='Restore')
         c.argument('enable_partition_merge', arg_type=get_three_state_flag(), help="Flag to enable partition merge on the account.")
-
+        c.argument('key_uri', help="The URI of the key vault")
+
     for scope in ['cosmosdb create', 'cosmosdb update']:
         with self.argument_context(scope) as c:
             c.ignore('resource_group_location')
@@ -106,7 +107,6 @@ def load_arguments(self, _):
             c.argument('virtual_network_rules', nargs='+', validator=validate_virtual_network_rules, help='ACL\'s for virtual network')
             c.argument('enable_multiple_write_locations', arg_type=get_three_state_flag(), help="Enable Multiple Write Locations")
             c.argument('disable_key_based_metadata_write_access', arg_type=get_three_state_flag(), help="Disable write operations on metadata resources (databases, containers, throughput) via account keys")
-            c.argument('key_uri', help="The URI of the key vault", is_preview=True)
             c.argument('public_network_access', options_list=['--public-network-access', '-p'], arg_type=get_enum_type(['ENABLED', 'DISABLED', 'SECUREDBYPERIMETER']), help="Sets public network access in server to either Enabled, Disabled, or SecuredByPerimeter.")
             c.argument('enable_analytical_storage', arg_type=get_three_state_flag(), help="Flag to enable log storage on the account.")
             c.argument('network_acl_bypass', arg_type=get_enum_type(NetworkAclBypass), options_list=['--network-acl-bypass'], help="Flag to enable or disable Network Acl Bypass.")
@@ -115,12 +115,16 @@ def load_arguments(self, _):
             c.argument('backup_retention', type=int, help="the time(in hours) for which each backup is retained (only for accounts with periodic mode backups)", arg_group='Backup Policy')
             c.argument('backup_redundancy', arg_type=get_enum_type(BackupStorageRedundancy), help="The redundancy type of the backup Storage account", arg_group='Backup Policy')
             c.argument('server_version', arg_type=get_enum_type(ServerVersion), help="Valid only for MongoDB accounts.")
-            c.argument('default_identity', help="The primary identity to access key vault in CMK related features. e.g. 'FirstPartyIdentity', 'SystemAssignedIdentity' and more. User-assigned identities are specified in format 'UserAssignedIdentity=<resource ID of the user-assigned identity>'.", is_preview=True)
+            c.argument('default_identity', help="The primary identity to access key vault in CMK related features. e.g. 'FirstPartyIdentity', 'SystemAssignedIdentity' and more. User-assigned identities are specified in format 'UserAssignedIdentity=<resource ID of the user-assigned identity>'.")
             c.argument('analytical_storage_schema_type', options_list=['--analytical-storage-schema-type', '--as-schema'], arg_type=get_enum_type(AnalyticalStorageSchemaType), help="Schema type for analytical storage.", arg_group='Analytical Storage Configuration')
             c.argument('backup_policy_type', arg_type=get_enum_type(BackupPolicyType), help="The type of backup policy of the account to create", arg_group='Backup Policy')
             c.argument('enable_partition_merge', arg_type=get_three_state_flag(), help="Flag to enable partition merge on the account.")
             c.argument('continuous_tier', arg_type=get_enum_type(ContinuousTier), help="The tier of Continuous backup", arg_group='Backup Policy')
+            c.argument('minimal_tls_version', arg_type=get_enum_type(MinimalTlsVersion), help="Indicates the minimum allowed TLS version")
 
+    for scope in ['cosmosdb update']:
+        c.argument('key_uri', help="The URI of the key vault", is_preview=True)
+
     for scope in ['cosmosdb regenerate-key', 'cosmosdb keys regenerate']:
         with self.argument_context(scope) as c:
             c.argument('key_kind', arg_type=get_enum_type(KeyKind), help="The access key to regenerate.")

src/azure-cli/azure/cli/command_modules/cosmosdb/custom.py

@@ -135,7 +135,8 @@ def cli_cosmosdb_create(cmd,
                         is_restore_request=None,
                         restore_source=None,
                         restore_timestamp=None,
-                        enable_partition_merge=None):
+                        enable_partition_merge=None,
+                        minimal_tls_version=None):
     """Create a new Azure Cosmos DB database account."""
 
     from azure.cli.core.commands.client_factory import get_mgmt_service_client
@@ -188,7 +189,8 @@ def cli_cosmosdb_create(cmd,
                                     gremlin_databases_to_restore=gremlin_databases_to_restore,
                                     tables_to_restore=tables_to_restore,
                                     arm_location=resource_group_location,
-                                    enable_partition_merge=enable_partition_merge)
+                                    enable_partition_merge=enable_partition_merge,
+                                    minimal_tls_version=minimal_tls_version)
 
 
 # pylint: disable=too-many-statements
@@ -231,7 +233,8 @@ def _create_database_account(client,
                              restore_source=None,
                              restore_timestamp=None,
                              arm_location=None,
-                             enable_partition_merge=None):
+                             enable_partition_merge=None,
+                             minimal_tls_version=None):
 
     consistency_policy = None
     if default_consistency_level is not None:
@@ -363,7 +366,8 @@ def _create_database_account(client,
         analytical_storage_configuration=analytical_storage_configuration,
         create_mode=create_mode,
         restore_parameters=restore_parameters,
-        enable_partition_merge=enable_partition_merge
+        enable_partition_merge=enable_partition_merge,
+        minimal_tls_version=minimal_tls_version
     )
 
     async_docdb_create = client.begin_create_or_update(resource_group_name, account_name, params)
@@ -401,7 +405,8 @@ def cli_cosmosdb_update(client,
                         analytical_storage_schema_type=None,
                         backup_policy_type=None,
                         continuous_tier=None,
-                        enable_partition_merge=None):
+                        enable_partition_merge=None,
+                        minimal_tls_version=None):
     """Update an existing Azure Cosmos DB database account. """
     existing = client.get(resource_group_name, account_name)
 
@@ -496,7 +501,8 @@ def cli_cosmosdb_update(client,
         backup_policy=backup_policy,
         default_identity=default_identity,
         analytical_storage_configuration=analytical_storage_configuration,
-        enable_partition_merge=enable_partition_merge)
+        enable_partition_merge=enable_partition_merge,
+        minimal_tls_version=minimal_tls_version)
 
     async_docdb_update = client.begin_update(resource_group_name, account_name, params)
     docdb_account = async_docdb_update.result()

src/azure-cli/azure/cli/command_modules/cosmosdb/tests/latest/test_cosmosdb_commands.py

@@ -48,7 +48,7 @@ def test_create_database_account(self, resource_group):
             'network_acl_bypass_resource_id': network_acl_bypass_resource_id
         })
 
-        self.cmd('az cosmosdb create -n {acc} -g {rg} --enable-automatic-failover --default-consistency-level ConsistentPrefix --network-acl-bypass AzureServices --network-acl-bypass-resource-ids {network_acl_bypass_resource_id} --backup-interval 480 --backup-retention 8')
+        self.cmd('az cosmosdb create -n {acc} -g {rg} --enable-automatic-failover --default-consistency-level ConsistentPrefix --network-acl-bypass AzureServices --network-acl-bypass-resource-ids {network_acl_bypass_resource_id} --backup-interval 480 --backup-retention 8 --minimal-tls-version Tls11')
         self.cmd('az cosmosdb show -n {acc} -g {rg}', checks=[
             self.check('enableAutomaticFailover', True),
             self.check('consistencyPolicy.defaultConsistencyLevel', 'ConsistentPrefix'),
@@ -58,6 +58,7 @@ def test_create_database_account(self, resource_group):
             self.check('backupPolicy.periodicModeProperties.backupIntervalInMinutes', '480'),
             self.check('backupPolicy.periodicModeProperties.backupRetentionIntervalInHours', '8'),
             self.check('backupPolicy.type', 'Periodic'),
+            self.check('minimalTlsVersion', 'Tls11'),
         ])
 
         self.cmd('az cosmosdb update -n {acc} -g {rg} --enable-automatic-failover false --default-consistency-level Session --disable-key-based-metadata-write-access --public-network-access "DISABLED" --network-acl-bypass None')
@@ -98,11 +99,12 @@ def test_update_database_account(self, resource_group):
             self.check('enableFreeTier', 'False'),
         ])
 
-        self.cmd('az cosmosdb update -n {acc} -g {rg} --capabilities EnableAggregationPipeline --server-version 3.2')
+        self.cmd('az cosmosdb update -n {acc} -g {rg} --capabilities EnableAggregationPipeline --server-version 3.2 --minimal-tls-version Tls12')
         account = self.cmd('az cosmosdb show -n {acc} -g {rg}', checks=[
             JMESPathCheck('kind', 'MongoDB'),
             self.check('ipRules[0].ipAddressOrRange', "20.10.10.10"),
-            self.check('apiProperties.serverVersion', '3.2')
+            self.check('apiProperties.serverVersion', '3.2'),
+            self.check('minimalTlsVersion', 'Tls12')
         ]).get_output_in_json()
         assert len(account['capabilities']) == 1
         assert account['capabilities'][0]['name'] == "EnableAggregationPipeline"
@@ -1507,10 +1509,13 @@ def test_cosmosdb_key_vault_key_uri(self, resource_group, key_vault):
         self.cmd('az keyvault set-policy -n {kv_name} -g {rg} --spn a232010e-820c-4083-83bb-3ace5fc29d0b --key-permissions get unwrapKey wrapKey')
         self.cmd('az keyvault key create -n {key_name} --kty RSA --size 3072 --vault-name {kv_name}')
 
-        cmk_output = self.cmd('az cosmosdb create -n {acc} -g {rg} --locations regionName={location} failoverPriority=0 --key-uri {key_uri}').get_output_in_json()
-
+        cmk_output = self.cmd('az cosmosdb create -n {acc} -g {rg} --locations regionName={location} failoverPriority=0 --key-uri {key_uri}').get_output_in_json()        
         assert cmk_output["keyVaultKeyUri"] == key_uri
 
+        self.cmd('az cosmosdb show -n {acc} -g {rg}', checks=[
+            self.check('customerManagedKeyStatus', "Access to the configured customer managed key confirmed. ")
+        ])
+
     @unittest.skip('Cannot record due to https://github.com/Azure/azure-cli/issues/22174')
     @ResourceGroupPreparer(name_prefix='cli_test_cosmosdb_managed_service_identity')
     @KeyVaultPreparer(name_prefix='cli', name_len=15, location='eastus2', additional_params='--enable-purge-protection')