Keyvault oct hsm#29579
Open
MaddyMicrosoft wants to merge 25 commits into
Open
Conversation
| Thanks for your contribution! The pull request validation has started. Please revisit this comment for updated status. |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR enables creation of AES (oct-HSM) keys in Azure Key Vault Premium (in addition to Managed HSM) by removing the explicit blocker in Track2 vault key creation, adding cmdlet-layer kty rewriting (oct → oct-HSM when -Destination HSM is used), and updating help/changelog and unit tests to cover the new behavior.
Changes:
- Allow
oct/oct-HSMkey creation through Track2 vault client and route toKeyClient.CreateOctKey. - Rewrite
-KeyType oct -Destination HSMtooct-HSMinAdd-AzKeyVaultKey, and extend the key operation-Algorithmargument completer with AES algorithm identifiers. - Add/extend documentation (help + changelog) and add unit tests for the cmdlet plumbing behavior.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| src/KeyVault/KeyVault/Track2Models/Track2VaultClient.cs | Enables Track2 vault-side creation for oct/oct-HSM via CreateOctKey. |
| src/KeyVault/KeyVault/Track2Models/Track2HsmClient.cs | Refactors/aligns Managed HSM key creation to use CreateOctKey for oct types. |
| src/KeyVault/KeyVault/Commands/Key/AddAzureKeyVaultKey.cs | Rewrites oct → oct-HSM when creating vault keys with -Destination HSM. |
| src/KeyVault/KeyVault/Commands/Key/InvokeAzureKeyVaultKeyOperation.cs | Expands the -Algorithm argument completer to include AES algorithms. |
| src/KeyVault/KeyVault/help/Add-AzKeyVaultKey.md | Adds a new example documenting AES (oct-HSM) key creation in Premium Key Vault. |
| src/KeyVault/KeyVault/ChangeLog.md | Adds an Upcoming Release note for Premium Key Vault AES (oct-HSM) creation support. |
| src/KeyVault/KeyVault.Test/UnitTests/AddKeyVaultOctKeyTests.cs | Adds unit tests pinning the cmdlet contract around oct/oct-HSM creation routing and rewrite behavior. |
Member
|
@MaddyMicrosoft Are we doing a general release or public preview? If public preview, we should not target |
This reverts commit 7c5b21b.
| Vault/HSM Name : MyPremiumVault | ||
| Name : aesKey | ||
| Key Type : oct-HSM | ||
| Key Size : 256 |
| ``` | ||
|
|
||
| Creates an AES (symmetric) HSM-protected key named `aesKey` in the Premium-SKU Azure Key Vault `MyPremiumVault`. | ||
| The `-Destination HSM` switch is required because symmetric (oct) keys in Azure Key Vault are always HSM-backed, |
…azure-powershell into keyvault-oct-hsm
|
|
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
src/KeyVault/KeyVault.Test/ScenarioTests/OctHsmKeyTests.cs:51
- This scenario test class has mismatched/extra closing braces at the end of the file, which will prevent the test project from compiling. Please remove the stray braces so the class and namespace close cleanly (compare with other ScenarioTests/*.cs files).
{
TestRunner.RunTestScript("Test-CreateOctHsmKeyAllSizes");
}
}
}
| ## Upcoming Release | ||
| * Added support for creating AES (Advanced Encryption Standard, `oct`) HSM (hardware security module) keys in Azure Key Vault Premium via `Add-AzKeyVaultKey -KeyType oct -Destination HSM` (resulting `KeyType` is `oct-HSM`). | ||
| * Fixed `New-AzKeyVault` `RequestDisallowedByPolicy` error by explicitly setting `enableSoftDelete` in the request body to satisfy Azure Policy checks | ||
| * Fixed `New-AzKeyVault` `RequestDisallowedByPolicy` error by setting `enableSoftDelete` in request body |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Enable Azure Key Vault (AKV Premium) support for AES (
oct-HSM) keys in Azure PowerShell. Managed HSM (MHSM) already supported AES; AKV was explicitly blocked inTrack2VaultClient.CreateKey. This PR removes that blocker, plumbs theoct-HSMkty rewrite at the cmdlet layer, exercises AES values in the algorithm completer, and refactors the option-building insideTrack2HsmClientbehind a unit-test safety net.What changed
Track2VaultClient.CreateKey— acceptsoct/oct-HSMand routes toKeyClient.CreateOctKey. Removes theNotSupportedExceptionand the hardcoded "oct (AES) is only supported by managed HSM" assumption.AddAzureKeyVaultKey— when called with-KeyType oct -Destination HSMagainst a vault, rewrites ktyoct → oct-HSM(matches the existingRSA → RSA-HSM/EC → EC-HSMrewrite). No new parameters; behavior on MHSM is unchanged.InvokeAzureKeyVaultKeyOperation— extends the-Algorithmargument completer with AES values (A128CBC,A192CBC,A256CBC,*CBCPAD,*GCM).Track2HsmClient.CreateKey— small refactor of the per-key-type dispatch, behavior preserved.Tests
AddKeyVaultOctKeyTests.cs— 8 cmdlet plumbing tests covering oct/RSA on vault and HSM, with/without-Destination HSM. Pins thektyrewrite contract.dotnet testfor the KeyVault test project.Mandatory Checklist
Please choose the target release of Azure PowerShell. (⚠️ Target release is a different concept from API readiness. Please click below links for details.)
Check this box to confirm: I have read the Submitting Changes section of
CONTRIBUTING.mdand reviewed the following information:ChangeLog.mdfile(s) appropriately — ✅src/KeyVault/KeyVault/ChangeLog.mdupdated under## Upcoming Release(past tense).src/KeyVault/KeyVault/help/Add-AzKeyVaultKey.mdupdated to document-KeyType oct -Destination HSMon AKV. No new parameters or output types.AddKeyVaultOctKeyTests,Track2HsmClientOptionsTests).Az.KeyVault.psd1version not touched.