Skip to content

Commit 60844c7

Browse files
niteshvijay1995anujtoshniwal
niteshvijay1995
and
anujtoshniwal
authored
Antoshni cosmos db 2021 10 15 preview cek management (#1)
* Adds base for updating Microsoft.DocumentDB from version preview/2021-07-01-preview to version 2021-10-15-preview * Updates readme * Updates API version in new specs and examples * ClientEncryptionKey management API changes * Address semantics validation errors * Fix representation of wrappedDek * fix Swagger prettier formatting check * minor edits to address comments" * fix LintDiff error * Adds base for updating Microsoft.DocumentDB from version preview/2021-07-01-preview to version 2021-10-15-preview * Updates readme * Updates API version in new specs and examples * remove CreateUpdateOptions as they arent applicable for CEK * fix Model validation check Co-authored-by: anujtoshniwal <[email protected]> Co-authored-by: Anuj Toshniwal <[email protected]>
1 parent 1db5652 commit 60844c7

File tree

5 files changed

+377
-0
lines changed

5 files changed

+377
-0
lines changed

‎custom-words.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -352,6 +352,7 @@ classificationrules
352352
clfs
353353
Clickthrough
354354
clientaccesspolicy
355+
ClientEncryptionKeys
355356
clienterror
356357
clientgroup
357358
clientlib

‎specification/cosmos-db/resource-manager/Microsoft.DocumentDB/preview/2021-10-15-preview/cosmos-db.json‎

Lines changed: 242 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1932,6 +1932,130 @@
19321932
}
19331933
}
19341934
},
1935+
"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DocumentDB/databaseAccounts/{accountName}/sqlDatabases/{databaseName}/clientEncryptionKeys": {
1936+
"get": {
1937+
"operationId": "SqlResources_ListClientEncryptionKeys",
1938+
"x-ms-examples": {
1939+
"CosmosDBClientEncryptionKeysList": {
1940+
"$ref": "./examples/CosmosDBSqlClientEncryptionKeysList.json"
1941+
}
1942+
},
1943+
"description": "Lists the ClientEncryptionKeys under an existing Azure Cosmos DB SQL database.",
1944+
"parameters": [
1945+
{
1946+
"$ref": "../../../../../common-types/resource-management/v1/types.json#/parameters/SubscriptionIdParameter"
1947+
},
1948+
{
1949+
"$ref": "../../../../../common-types/resource-management/v1/types.json#/parameters/ResourceGroupNameParameter"
1950+
},
1951+
{
1952+
"$ref": "#/parameters/accountNameParameter"
1953+
},
1954+
{
1955+
"$ref": "#/parameters/databaseNameParameter"
1956+
},
1957+
{
1958+
"$ref": "../../../../../common-types/resource-management/v1/types.json#/parameters/ApiVersionParameter"
1959+
}
1960+
],
1961+
"responses": {
1962+
"200": {
1963+
"description": "The ClientEncryptionKeys were retrieved successfully.",
1964+
"schema": {
1965+
"$ref": "#/definitions/ClientEncryptionKeysListResult"
1966+
}
1967+
}
1968+
},
1969+
"x-ms-pageable": {
1970+
"nextLinkName": null
1971+
}
1972+
}
1973+
},
1974+
"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DocumentDB/databaseAccounts/{accountName}/sqlDatabases/{databaseName}/clientEncryptionKeys/{clientEncryptionKeyName}": {
1975+
"get": {
1976+
"operationId": "SqlResources_GetClientEncryptionKey",
1977+
"x-ms-examples": {
1978+
"CosmosDBClientEncryptionKeyGet": {
1979+
"$ref": "./examples/CosmosDBSqlClientEncryptionKeyGet.json"
1980+
}
1981+
},
1982+
"description": "Gets the ClientEncryptionKey under an existing Azure Cosmos DB SQL database.",
1983+
"parameters": [
1984+
{
1985+
"$ref": "../../../../../common-types/resource-management/v1/types.json#/parameters/SubscriptionIdParameter"
1986+
},
1987+
{
1988+
"$ref": "../../../../../common-types/resource-management/v1/types.json#/parameters/ResourceGroupNameParameter"
1989+
},
1990+
{
1991+
"$ref": "#/parameters/accountNameParameter"
1992+
},
1993+
{
1994+
"$ref": "#/parameters/databaseNameParameter"
1995+
},
1996+
{
1997+
"$ref": "#/parameters/clientEncryptionKeyNameParameter"
1998+
},
1999+
{
2000+
"$ref": "../../../../../common-types/resource-management/v1/types.json#/parameters/ApiVersionParameter"
2001+
}
2002+
],
2003+
"responses": {
2004+
"200": {
2005+
"description": "The ClientEncryptionKey was retrieved successfully.",
2006+
"schema": {
2007+
"$ref": "#/definitions/ClientEncryptionKeyGetResults"
2008+
}
2009+
}
2010+
}
2011+
},
2012+
"put": {
2013+
"operationId": "SqlResources_CreateUpdateClientEncryptionKey",
2014+
"x-ms-examples": {
2015+
"CosmosDBClientEncryptionKeyCreateUpdate": {
2016+
"$ref": "./examples/CosmosDBSqlClientEncryptionKeyCreateUpdate.json"
2017+
}
2018+
},
2019+
"description": "Create or update a ClientEncryptionKey. This API is meant to be invoked via tools such as the Azure Powershell (instead of directly).",
2020+
"parameters": [
2021+
{
2022+
"$ref": "../../../../../common-types/resource-management/v1/types.json#/parameters/SubscriptionIdParameter"
2023+
},
2024+
{
2025+
"$ref": "../../../../../common-types/resource-management/v1/types.json#/parameters/ResourceGroupNameParameter"
2026+
},
2027+
{
2028+
"$ref": "#/parameters/accountNameParameter"
2029+
},
2030+
{
2031+
"$ref": "#/parameters/databaseNameParameter"
2032+
},
2033+
{
2034+
"$ref": "#/parameters/clientEncryptionKeyNameParameter"
2035+
},
2036+
{
2037+
"$ref": "../../../../../common-types/resource-management/v1/types.json#/parameters/ApiVersionParameter"
2038+
},
2039+
{
2040+
"name": "createUpdateClientEncryptionKeyParameters",
2041+
"in": "body",
2042+
"required": true,
2043+
"schema": {
2044+
"$ref": "#/definitions/ClientEncryptionKeyCreateUpdateParameters"
2045+
},
2046+
"description": "The parameters to provide for the client encryption key."
2047+
}
2048+
],
2049+
"responses": {
2050+
"200": {
2051+
"description": "The client encryption key create or update operation was completed successfully.",
2052+
"schema": {
2053+
"$ref": "#/definitions/ClientEncryptionKeyGetResults"
2054+
}
2055+
}
2056+
}
2057+
}
2058+
},
19352059
"/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.DocumentDB/databaseAccounts/{accountName}/sqlDatabases/{databaseName}/containers": {
19362060
"get": {
19372061
"operationId": "SqlResources_ListSqlContainers",
@@ -5636,6 +5760,20 @@
56365760
}
56375761
},
56385762
"definitions": {
5763+
"ClientEncryptionKeysListResult": {
5764+
"type": "object",
5765+
"properties": {
5766+
"value": {
5767+
"readOnly": true,
5768+
"type": "array",
5769+
"items": {
5770+
"$ref": "#/definitions/ClientEncryptionKeyGetResults"
5771+
},
5772+
"description": "List of client encryption keys and their properties."
5773+
}
5774+
},
5775+
"description": "The List operation response, that contains the client encryption keys and their properties."
5776+
},
56395777
"DatabaseAccountsListResult": {
56405778
"properties": {
56415779
"value": {
@@ -5990,6 +6128,65 @@
59906128
},
59916129
"x-ms-azure-resource": true
59926130
},
6131+
"ClientEncryptionKeyCreateUpdateParameters": {
6132+
"description": "Parameters to create and update ClientEncryptionKey.",
6133+
"type": "object",
6134+
"properties": {
6135+
"properties": {
6136+
"x-ms-client-flatten": true,
6137+
"description": "Properties to create and update ClientEncryptionKey.",
6138+
"$ref": "#/definitions/ClientEncryptionKeyCreateUpdateProperties"
6139+
}
6140+
},
6141+
"required": [
6142+
"properties"
6143+
]
6144+
},
6145+
"ClientEncryptionKeyCreateUpdateProperties": {
6146+
"description": "Properties to create and update ClientEncryptionKey.",
6147+
"type": "object",
6148+
"properties": {
6149+
"resource": {
6150+
"description": "The standard JSON format of a ClientEncryptionKey",
6151+
"$ref": "#/definitions/ClientEncryptionKeyResource"
6152+
}
6153+
},
6154+
"required": [
6155+
"resource"
6156+
]
6157+
},
6158+
"ClientEncryptionKeyGetResults": {
6159+
"description": "Client Encryption Key.",
6160+
"type": "object",
6161+
"properties": {
6162+
"properties": {
6163+
"x-ms-client-flatten": true,
6164+
"description": "The properties of a ClientEncryptionKey",
6165+
"$ref": "#/definitions/ClientEncryptionKeyGetProperties"
6166+
}
6167+
},
6168+
"allOf": [
6169+
{
6170+
"$ref": "#/definitions/ARMProxyResource"
6171+
}
6172+
]
6173+
},
6174+
"ClientEncryptionKeyGetProperties": {
6175+
"description": "The properties of a ClientEncryptionKey resource",
6176+
"type": "object",
6177+
"properties": {
6178+
"resource": {
6179+
"allOf": [
6180+
{
6181+
"$ref": "#/definitions/ClientEncryptionKeyResource"
6182+
},
6183+
{
6184+
"$ref": "#/definitions/ExtendedResourceProperties"
6185+
}
6186+
]
6187+
}
6188+
}
6189+
},
59936190
"DatabaseAccountGetResults": {
59946191
"description": "An Azure Cosmos DB database account.",
59956192
"type": "object",
@@ -7917,6 +8114,43 @@
79178114
}
79188115
}
79198116
},
8117+
"ClientEncryptionKeyResource": {
8118+
"type": "object",
8119+
"description": "Cosmos DB client encryption key resource object.",
8120+
"properties": {
8121+
"encryptionAlgorithm": {
8122+
"type": "string",
8123+
"description": "Encryption algorithm that will be used along with this client encryption key to encrypt/decrypt data."
8124+
},
8125+
"wrappedDataEncryptionKey": {
8126+
"type": "string",
8127+
"format": "byte",
8128+
"description": "Wrapped (encrypted) form of the key represented as a byte array."
8129+
},
8130+
"keyWrapMetadata": {
8131+
"description": "Metadata for the wrapping provider that can be used to unwrap the wrapped client encryption key.",
8132+
"$ref": "#/definitions/KeyWrapMetadata"
8133+
}
8134+
}
8135+
},
8136+
"KeyWrapMetadata": {
8137+
"type": "object",
8138+
"description": "Represents key wrap metadata that a key wrapping provider can use to wrap/unwrap a client encryption key.",
8139+
"properties": {
8140+
"name": {
8141+
"type": "string",
8142+
"description": "The name of associated KeyEncryptionKey (aka CustomerManagedKey)."
8143+
},
8144+
"type": {
8145+
"type": "string",
8146+
"description": "ProviderName of KeyStoreProvider."
8147+
},
8148+
"value": {
8149+
"type": "string",
8150+
"description": "Reference / link to the KeyEncryptionKey."
8151+
}
8152+
}
8153+
},
79208154
"SqlDatabaseResource": {
79218155
"type": "object",
79228156
"description": "Cosmos DB SQL database resource object",
@@ -9601,6 +9835,14 @@
96019835
"x-ms-parameter-location": "method",
96029836
"description": "Cosmos DB database name."
96039837
},
9838+
"clientEncryptionKeyNameParameter": {
9839+
"name": "clientEncryptionKeyName",
9840+
"in": "path",
9841+
"required": true,
9842+
"type": "string",
9843+
"x-ms-parameter-location": "method",
9844+
"description": "Cosmos DB ClientEncryptionKey name."
9845+
},
96049846
"containerNameParameter": {
96059847
"name": "containerName",
96069848
"in": "path",

‎specification/cosmos-db/resource-manager/Microsoft.DocumentDB/preview/2021-10-15-preview/examples/CosmosDBSqlClientEncryptionKeyCreateUpdate.json‎

Lines changed: 46 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-10-15-preview",
4+
"subscriptionId": "subId",
5+
"resourceGroupName": "rgName",
6+
"accountName": "accountName",
7+
"databaseName": "databaseName",
8+
"clientEncryptionKeyName": "cekName",
9+
"createUpdateClientEncryptionKeyParameters": {
10+
"properties": {
11+
"resource": {
12+
"encryptionAlgorithm": "AEAD_AES_256_CBC_HMAC_SHA256",
13+
"wrappedDataEncryptionKey": "This is actually an array of bytes. This request/response is being presented as a string for readability in the example",
14+
"keyWrapMetadata": {
15+
"name": "customerManagedKey",
16+
"type": "AzureKeyVault",
17+
"value": "AzureKeyVault Key URL"
18+
}
19+
}
20+
}
21+
}
22+
},
23+
"responses": {
24+
"200": {
25+
"body": {
26+
"id": "/subscriptions/subId/resourceGroups/rgName/providers/Microsoft.DocumentDB/databaseAccounts/accountName/sqlDatabases/databaseName/clientEncryptionKeys/cekName",
27+
"name": "cekName",
28+
"type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/clientEncryptionKey",
29+
"properties": {
30+
"resource": {
31+
"encryptionAlgorithm": "AEAD_AES_256_CBC_HMAC_SHA256",
32+
"wrappedDataEncryptionKey": "This is actually an array of bytes. This request/response is being presented as a string for readability in the example",
33+
"keyWrapMetadata": {
34+
"name": "customerManagedKey",
35+
"type": "AzureKeyVault",
36+
"value": "AzureKeyVault Key URL"
37+
},
38+
"_rid": "tNc4AAAAAAAQkjzWAgAAAA==",
39+
"_ts": 1626425552,
40+
"_etag": "00000000-0000-0000-7a1f-bc0828e801d7"
41+
}
42+
}
43+
}
44+
}
45+
}
46+
}

‎specification/cosmos-db/resource-manager/Microsoft.DocumentDB/preview/2021-10-15-preview/examples/CosmosDBSqlClientEncryptionKeyGet.json‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
{
2+
"parameters": {
3+
"api-version": "2021-10-15-preview",
4+
"subscriptionId": "subId",
5+
"resourceGroupName": "rgName",
6+
"accountName": "accountName",
7+
"databaseName": "databaseName",
8+
"clientEncryptionKeyName": "cekName"
9+
},
10+
"responses": {
11+
"200": {
12+
"body": {
13+
"id": "/subscriptions/subId/resourceGroups/rgName/providers/Microsoft.DocumentDB/databaseAccounts/accountName/sqlDatabases/databaseName/clientEncryptionKeys/cekName",
14+
"name": "cekName",
15+
"type": "Microsoft.DocumentDB/databaseAccounts/sqlDatabases/clientEncryptionKey",
16+
"properties": {
17+
"resource": {
18+
"encryptionAlgorithm": "AEAD_AES_256_CBC_HMAC_SHA256",
19+
"wrappedDataEncryptionKey": "This is actually an array of bytes. This request/response is being presented as a string for readability in the example",
20+
"keyWrapMetadata": {
21+
"name": "customerManagedKey",
22+
"type": "AzureKeyVault",
23+
"value": "AzureKeyVault Key URL"
24+
},
25+
"_rid": "tNc4AAAAAAAQkjzWAgAAAA==",
26+
"_ts": 1626425552,
27+
"_etag": "00000000-0000-0000-7a1f-bc0828e801d7"
28+
}
29+
}
30+
}
31+
}
32+
}
33+
}

0 commit comments

Comments
 (0)