Supporting Customer managed key

src/Automation/Automation.Test/Automation.Test.csproj

@@ -13,7 +13,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Azure.Management.Automation" Version="3.8.1-preview" />
+    <PackageReference Include="Microsoft.Azure.Management.Automation" Version="3.8.3-preview" />
     <PackageReference Include="MSTest.TestAdapter" Version="1.2.1" />
     <PackageReference Include="MSTest.TestFramework" Version="1.2.1" />
   </ItemGroup>

src/Automation/Automation.Test/UnitTests/NewAzureAutomationAccountTest.cs

@@ -50,7 +50,7 @@ public void NewAzureAutomationAccountByNameSuccessfull()
             string location = "East US";
             string plan = "Free";
 
-            this.mockAutomationClient.Setup(f => f.CreateAutomationAccount(resourceGroupName, accountName, location, plan, null));
+            this.mockAutomationClient.Setup(f => f.CreateAutomationAccount(resourceGroupName, accountName, location, plan, null, false, false, false, null, null, null));
 
             // Test
             this.cmdlet.ResourceGroupName = resourceGroupName;
@@ -60,7 +60,7 @@ public void NewAzureAutomationAccountByNameSuccessfull()
             this.cmdlet.ExecuteCmdlet();
 
             // Assert
-            this.mockAutomationClient.Verify(f => f.CreateAutomationAccount(resourceGroupName, accountName, location, plan, null), Times.Once());
+            this.mockAutomationClient.Verify(f => f.CreateAutomationAccount(resourceGroupName, accountName, location, plan, null, false, false, false, null, null, null), Times.Once());
         }
     }
 }

src/Automation/Automation.sln

@@ -1,6 +1,6 @@
 Microsoft Visual Studio Solution File, Format Version 12.00
-# Visual Studio 15
-VisualStudioVersion = 15.0.27703.2042
+# Visual Studio Version 16
+VisualStudioVersion = 16.0.31129.286
 MinimumVisualStudioVersion = 10.0.40219.1
 Project("{9A19103F-16F7-4668-BE54-9A1E7A4F7556}") = "Automation", "Automation\Automation.csproj", "{90DEF35A-F7FF-40D0-B008-F489A4C092DB}"
 EndProject
@@ -38,6 +38,10 @@ Global
 		{142D7B0B-388A-4CEB-A228-7F6D423C5C2E}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{142D7B0B-388A-4CEB-A228-7F6D423C5C2E}.Release|Any CPU.ActiveCfg = Release|Any CPU
 		{142D7B0B-388A-4CEB-A228-7F6D423C5C2E}.Release|Any CPU.Build.0 = Release|Any CPU
+		{6BD6B80A-06AF-4B5B-9230-69CCFC6C8D64}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{6BD6B80A-06AF-4B5B-9230-69CCFC6C8D64}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{6BD6B80A-06AF-4B5B-9230-69CCFC6C8D64}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{6BD6B80A-06AF-4B5B-9230-69CCFC6C8D64}.Release|Any CPU.Build.0 = Release|Any CPU
 		{FF81DC73-B8EC-4082-8841-4FBF2B16E7CE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{FF81DC73-B8EC-4082-8841-4FBF2B16E7CE}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{FF81DC73-B8EC-4082-8841-4FBF2B16E7CE}.Release|Any CPU.ActiveCfg = Release|Any CPU

src/Automation/Automation/Automation.csproj

@@ -11,7 +11,7 @@
   </PropertyGroup>
 
   <ItemGroup>
-    <PackageReference Include="Microsoft.Azure.Management.Automation" Version="3.8.1-preview" />
+    <PackageReference Include="Microsoft.Azure.Management.Automation" Version="3.8.3-preview" />
     <PackageReference Include="System.Security.Permissions" Version="4.5.0" />
   </ItemGroup>
 

src/Automation/Automation/ChangeLog.md

@@ -18,11 +18,12 @@
         - Additional information about change #1
 -->
 ## Upcoming Release
-* Fixed issue that disables the schedule for update deployment if schedule was re-created with same name
+* Added support for Customer Managed Key Encryption with System Assigned Identity
 
 ## Version 1.5.2
 * Fixed the issue for starting Python3 runbooks with parameters
 * Fixed time zone issue while creating an update deployment schedule.
+* Fixed issue that disables the schedule for update deployment if schedule was re-created with same name
 
 ## Version 1.5.1
 * Fixed te issue that complex object cannot be serialized correctly. [#14431]

src/Automation/Automation/Cmdlet/NewAzureAutomationAccount.cs

@@ -29,6 +29,16 @@ namespace Microsoft.Azure.Commands.Automation.Cmdlet
     [OutputType(typeof(AutomationAccount))]
     public class NewAzureAutomationAccount : ResourceManager.Common.AzureRMCmdlet
     {
+        /// <summary>
+        /// AutomationServices Encryption parameter set name
+        /// </summary>
+        private const string AutomationServicesEncryptionParameterSet = "AutomationServicesEncryption";
+
+        /// <summary>
+        /// KeyVault Encryption parameter set name
+        /// </summary>
+        private const string KeyVaultEncryptionParameterSet = "KeyVaultEncryption";
+
         /// <summary>
         /// The automation client.
         /// </summary>
@@ -87,14 +97,64 @@ public IAutomationPSClient AutomationClient
         [Alias("Tag")]
         public IDictionary Tags { get; set; }
 
+        [Parameter(
+            Mandatory = false,
+            HelpMessage = "Generate and assign a new System Identity for this automation account")]
+        public SwitchParameter AssignSystemIdentity { get; set; }
+
+        [Parameter(HelpMessage = "Whether to set Automation Account KeySource to Microsoft.Automation or not.",
+            Mandatory = false,
+            ParameterSetName = AutomationServicesEncryptionParameterSet)]
+        public SwitchParameter AutomationServicesEncryption { get; set; }
+
+        [Parameter(HelpMessage = "Whether to set Automation Account KeySource to Microsoft.KeyVault(enable CMK) or not.",
+            Mandatory = false,
+            ParameterSetName = KeyVaultEncryptionParameterSet)]
+        public SwitchParameter KeyVaultEncryption { get; set; }
+
+        [Parameter(HelpMessage = "CMK KeyName",
+                    Mandatory = true,
+                    ParameterSetName = KeyVaultEncryptionParameterSet)]
+        [ValidateNotNullOrEmpty]
+        public string KeyName { get; set; }
+
+        [Parameter(HelpMessage = "CMK KeyVersion",
+            Mandatory = true,
+            ParameterSetName = KeyVaultEncryptionParameterSet)]
+        [ValidateNotNullOrEmpty]
+        public string KeyVersion { get; set; }
+
+        [Parameter(HelpMessage = "CMK KeyVaultUri",
+            Mandatory = true,
+            ParameterSetName = KeyVaultEncryptionParameterSet)]
+        [ValidateNotNullOrEmpty]
+        public string KeyVaultUri { get; set; }
+
         /// <summary>
         /// Execute this cmdlet.
         /// </summary>
         [PermissionSet(SecurityAction.Demand, Name = "FullTrust")]
         public override void ExecuteCmdlet()
         {
-            var account = this.AutomationClient.CreateAutomationAccount(this.ResourceGroupName, this.Name, this.Location, this.Plan, this.Tags);
-            this.WriteObject(account);
+            bool addSystemId = false;
+            if (AssignSystemIdentity.IsPresent)
+            {
+                addSystemId = true;
+            }
+            bool enableAMK = false;
+            if (AutomationServicesEncryption.IsPresent)
+            {
+                enableAMK = true;
+            }
+            bool enableCMK = false;
+            if (ParameterSetName == KeyVaultEncryptionParameterSet)
+            {
+                enableCMK = true;
+            }
+
+            var account = this.AutomationClient.CreateAutomationAccount(this.ResourceGroupName, this.Name, this.Location, this.Plan, this.Tags, addSystemId, enableAMK, enableCMK, KeyName, KeyVersion, KeyVaultUri);
+            this.WriteObject(account);               
+
         }
     }
 }

src/Automation/Automation/Cmdlet/SetAzureAutomationAccount.cs

@@ -29,6 +29,16 @@ namespace Microsoft.Azure.Commands.Automation.Cmdlet
     [OutputType(typeof(AutomationAccount))]
     public class SetAzureAutomationAccount : ResourceManager.Common.AzureRMCmdlet
     {
+        /// <summary>
+        /// AutomationServices Encryption parameter set name
+        /// </summary>
+        private const string AutomationServicesEncryptionParameterSet = "AutomationServicesEncryption";
+
+        /// <summary>
+        /// KeyVault Encryption parameter set name
+        /// </summary>
+        private const string KeyVaultEncryptionParameterSet = "KeyVaultEncryption";
+
         /// <summary>
         /// The automation client.
         /// </summary>
@@ -80,13 +90,62 @@ public IAutomationPSClient AutomationClient
         [Alias("Tag")]
         public IDictionary Tags { get; set; }
 
+        [Parameter(
+            Mandatory = false,
+            HelpMessage = "Generate and assign a new System Identity for this automation account")]
+        public SwitchParameter AssignSystemIdentity { get; set; }
+
+        [Parameter(HelpMessage = "Whether to set Automation Account KeySource to Microsoft.Automation or not.",
+            Mandatory = false,
+            ParameterSetName = AutomationServicesEncryptionParameterSet)]
+        public SwitchParameter AutomationServicesEncryption { get; set; }
+
+        [Parameter(HelpMessage = "Whether to set Automation Account KeySource to Microsoft.KeyVault(enable CMK) or not.",
+            Mandatory = false,
+            ParameterSetName = KeyVaultEncryptionParameterSet)]
+        public SwitchParameter KeyVaultEncryption { get; set; }
+
+        [Parameter(HelpMessage = "CMK KeyName",
+                    Mandatory = true,
+                    ParameterSetName = KeyVaultEncryptionParameterSet)]
+        [ValidateNotNullOrEmpty]
+        public string KeyName { get; set; }
+
+        [Parameter(HelpMessage = "CMK KeyVersion",
+            Mandatory = true,
+            ParameterSetName = KeyVaultEncryptionParameterSet)]
+        [ValidateNotNullOrEmpty]
+        public string KeyVersion { get; set; }
+
+        [Parameter(HelpMessage = "CMK KeyVaultUri",
+            Mandatory = true,
+            ParameterSetName = KeyVaultEncryptionParameterSet)]
+        [ValidateNotNullOrEmpty]
+        public string KeyVaultUri { get; set; }
+
         /// <summary>
         /// Execute this cmdlet.
         /// </summary>
         [PermissionSet(SecurityAction.Demand, Name = "FullTrust")]
         public override void ExecuteCmdlet()
         {
-            var account = this.AutomationClient.UpdateAutomationAccount(this.ResourceGroupName, this.Name, this.Plan, this.Tags);
+            bool addSystemId = false;
+            if (AssignSystemIdentity.IsPresent)
+            {
+                addSystemId = true;
+            }
+            bool enableAMK = false;
+            if (AutomationServicesEncryption.IsPresent)
+            {
+                enableAMK = true;
+            }
+            bool enableCMK = false;
+            if (ParameterSetName == KeyVaultEncryptionParameterSet)
+            {
+                enableCMK = true;
+            }
+
+            var account = this.AutomationClient.UpdateAutomationAccount(this.ResourceGroupName, this.Name, this.Plan, this.Tags, addSystemId, enableAMK, enableCMK, KeyName, KeyVersion, KeyVaultUri);
             this.WriteObject(account);
         }
     }

src/Automation/Automation/Common/AutomationPSClient.cs

@@ -143,7 +143,7 @@ public AutomationAccount GetAutomationAccount(string resourceGroupName, string a
         }
 
         public AutomationAccount CreateAutomationAccount(string resourceGroupName, string automationAccountName,
-            string location, string plan, IDictionary tags)
+            string location, string plan, IDictionary tags, bool addSystemId, bool enableAMK, bool enableCMK, string KeyName, string KeyVersion, string KeyVaultUri)
         {
             Requires.Argument("ResourceGroupName", resourceGroupName).NotNull();
             Requires.Argument("Location", location).NotNull();
@@ -165,13 +165,29 @@ public AutomationAccount CreateAutomationAccount(string resourceGroupName, strin
                 Tags = accountTags
             };
 
+            if (addSystemId == true)
+            {
+                accountCreateOrUpdateParameters.Identity = new Identity(null, null, ResourceIdentityType.SystemAssigned);
+            }
+            if (enableAMK == true)
+            {
+                accountCreateOrUpdateParameters.Encryption = new EncryptionProperties(null, EncryptionKeySourceType.MicrosoftAutomation);
+            }
+            if (enableCMK == true)
+            {
+                accountCreateOrUpdateParameters.Encryption = new EncryptionProperties(
+                    new KeyVaultProperties(KeyVaultUri, KeyName, KeyVersion),
+                    EncryptionKeySourceType.MicrosoftKeyvault
+                    );
+            }
+
             var account = this.automationManagementClient.AutomationAccount.CreateOrUpdate(resourceGroupName, automationAccountName, accountCreateOrUpdateParameters);
 
             return new AutomationAccount(resourceGroupName, account);
         }
 
         public AutomationAccount UpdateAutomationAccount(string resourceGroupName, string automationAccountName,
-            string plan, IDictionary tags)
+            string plan, IDictionary tags, bool addSystemId, bool enableAMK, bool enableCMK, string KeyName, string KeyVersion, string KeyVaultUri)
         {
             Requires.Argument("ResourceGroupName", resourceGroupName).NotNull();
             Requires.Argument("AutomationAccountName", automationAccountName).NotNull();
@@ -201,6 +217,22 @@ public AutomationAccount UpdateAutomationAccount(string resourceGroupName, strin
                 Tags = accountTags,
             };
 
+            if (addSystemId == true)
+            {
+                accountUpdateParameters.Identity = new Identity(null, null, ResourceIdentityType.SystemAssigned);
+            }
+            if (enableAMK == true)
+            {
+                accountUpdateParameters.Encryption = new EncryptionProperties(null, EncryptionKeySourceType.MicrosoftAutomation);
+            }
+            if (enableCMK == true)
+            {
+                accountUpdateParameters.Encryption = new EncryptionProperties(
+                    new KeyVaultProperties(KeyVaultUri, KeyName, KeyVersion),
+                    EncryptionKeySourceType.MicrosoftKeyvault
+                    );
+            }
+
             var account = this.automationManagementClient.AutomationAccount.Update(resourceGroupName, automationAccountName, accountUpdateParameters);
 
             return new AutomationAccount(resourceGroupName, account);

src/Automation/Automation/Common/AutomationPSClientSoftwareUpdateConfiguration.cs

@@ -79,7 +79,7 @@ public SoftwareUpdateConfiguration CreateSoftwareUpdateConfiguration(string reso
 
                 var sucParameters = new Sdk.SoftwareUpdateConfiguration()
                 {
-                    ScheduleInfo = new Sdk.ScheduleProperties()
+                    ScheduleInfo = new Sdk.SUCScheduleProperties()
                     {
                         StartTime = configuration.ScheduleConfiguration.StartTime,
                         ExpiryTime = configuration.ScheduleConfiguration.ExpiryTime,

src/Automation/Automation/Common/IAutomationPSClient.cs

@@ -33,9 +33,9 @@ public interface IAutomationPSClient
 
         AutomationAccount GetAutomationAccount(string resourceGroupName, string automationAccountName);
 
-        AutomationAccount CreateAutomationAccount(string resourceGroupName, string automationAccountName, string location, string plan, IDictionary tags);
+        AutomationAccount CreateAutomationAccount(string resourceGroupName, string automationAccountName, string location, string plan, IDictionary tags, bool addSystemId, bool enableAMK, bool enableCMK, string KeyName, string KeyVersion, string KeyVaultUri);
 
-        AutomationAccount UpdateAutomationAccount(string resourceGroupName, string automationAccountName, string plan, IDictionary tags);
+        AutomationAccount UpdateAutomationAccount(string resourceGroupName, string automationAccountName, string plan, IDictionary tags, bool addSystemId, bool enableAMK, bool enableCMK, string KeyName, string KeyVersion, string KeyVaultUri);
 
         void DeleteAutomationAccount(string resourceGroupName, string automationAccountName);
 

src/Automation/Automation/Model/AutomationAccount.cs

@@ -13,6 +13,7 @@
 // ----------------------------------------------------------------------------------
 
 using Microsoft.Azure.Commands.Automation.Common;
+using Microsoft.Azure.Management.Automation.Models;
 using System;
 using System.Collections;
 
@@ -67,6 +68,8 @@ public AutomationAccount(string resourceGroupName, AutomationManagement.Models.A
             this.LastModifiedTime = automationAccount.LastModifiedTime.ToLocalTime();
             this.State = automationAccount.State;
             this.LastModifiedBy = automationAccount.LastModifiedBy;
+            this.Identity = automationAccount.Identity;
+            this.Encryption = automationAccount.Encryption;
         }
 
         /// <summary>
@@ -125,5 +128,15 @@ public AutomationAccount()
         /// Gets or sets the tags.
         /// </summary>
         public Hashtable Tags { get; set; }
+
+        /// <summary>
+        /// Gets or sets the identity.
+        /// </summary>
+        public Identity Identity { get; private set; }
+
+        /// <summary>
+        /// Gets or sets the encryption properties.
+        /// </summary>
+        public EncryptionProperties Encryption { get; private set; }
     }
 }

src/Automation/Automation/Model/UpdateManagement/SoftwareUpdateRun.cs

@@ -57,6 +57,6 @@ internal SoftwareUpdateRun(string resourceGroupName, string automationAccountNam
 
         public SoftwareUpdateRunStatus Status { get; set; }
 
-        public SoftareUpdateConfigurationRunTasks Tasks { get; set; }
+        public SoftwareUpdateConfigurationRunTasks Tasks { get; set; }
     }
 }