|
| 1 | +# ------------------------------------ |
| 2 | +# Copyright (c) Microsoft Corporation. |
| 3 | +# Licensed under the MIT License. |
| 4 | +# ------------------------------------ |
| 5 | +from typing import Any |
| 6 | + |
| 7 | +from azure.core.tracing.decorator import distributed_trace |
| 8 | + |
| 9 | +from ._internal import KeyVaultClientBase |
| 10 | +from ._models import KeyVaultEkmConnection, KeyVaultEkmProxyClientCertificateInfo, KeyVaultEkmProxyInfo |
| 11 | + |
| 12 | + |
| 13 | +class KeyVaultEkmClient(KeyVaultClientBase): |
| 14 | + """Provides methods to manage Managed HSM External Key Manager (EKM) connections. |
| 15 | +
|
| 16 | + :param str vault_url: URL of the vault on which the client will operate. This is also called the vault's "DNS Name". |
| 17 | + You should validate that this URL references a valid Key Vault or Managed HSM resource. |
| 18 | + See https://aka.ms/azsdk/blog/vault-uri for details. |
| 19 | + :param credential: An object which can provide an access token for the vault, such as a credential from |
| 20 | + :mod:`azure.identity` |
| 21 | + :type credential: ~azure.core.credentials.TokenCredential |
| 22 | +
|
| 23 | + :keyword api_version: Version of the service API to use. EKM operations require service API version |
| 24 | + ``2026-01-01-preview`` or later. |
| 25 | + :paramtype api_version: ~azure.keyvault.administration.ApiVersion or str |
| 26 | + :keyword bool verify_challenge_resource: Whether to verify the authentication challenge resource matches the Key |
| 27 | + Vault or Managed HSM domain. Defaults to True. |
| 28 | + """ |
| 29 | + |
| 30 | + # pylint:disable=protected-access |
| 31 | + |
| 32 | + @distributed_trace |
| 33 | + def get_ekm_connection(self, **kwargs: Any) -> KeyVaultEkmConnection: |
| 34 | + """Gets the configured EKM connection. |
| 35 | +
|
| 36 | + :returns: The configured EKM connection. |
| 37 | + :rtype: ~azure.keyvault.administration.KeyVaultEkmConnection |
| 38 | + :raises ~azure.core.exceptions.HttpResponseError: |
| 39 | + """ |
| 40 | + result = self._client.get_ekm_connection(**kwargs) |
| 41 | + return KeyVaultEkmConnection._from_generated(result) |
| 42 | + |
| 43 | + @distributed_trace |
| 44 | + def create_ekm_connection(self, connection: KeyVaultEkmConnection, **kwargs: Any) -> KeyVaultEkmConnection: |
| 45 | + """Creates the EKM connection. |
| 46 | +
|
| 47 | + If an EKM connection already exists, this operation fails. |
| 48 | +
|
| 49 | + :param connection: The EKM connection to create. |
| 50 | + :type connection: ~azure.keyvault.administration.KeyVaultEkmConnection |
| 51 | +
|
| 52 | + :returns: The created EKM connection. |
| 53 | + :rtype: ~azure.keyvault.administration.KeyVaultEkmConnection |
| 54 | + :raises ~azure.core.exceptions.HttpResponseError: |
| 55 | + """ |
| 56 | + result = self._client.create_ekm_connection(ekm_connection=connection._to_generated(), **kwargs) |
| 57 | + return KeyVaultEkmConnection._from_generated(result) |
| 58 | + |
| 59 | + @distributed_trace |
| 60 | + def update_ekm_connection(self, connection: KeyVaultEkmConnection, **kwargs: Any) -> KeyVaultEkmConnection: |
| 61 | + """Updates the existing EKM connection. |
| 62 | +
|
| 63 | + If no EKM connection exists, this operation fails. |
| 64 | +
|
| 65 | + :param connection: The EKM connection to update. |
| 66 | + :type connection: ~azure.keyvault.administration.KeyVaultEkmConnection |
| 67 | +
|
| 68 | + :returns: The updated EKM connection. |
| 69 | + :rtype: ~azure.keyvault.administration.KeyVaultEkmConnection |
| 70 | + :raises ~azure.core.exceptions.HttpResponseError: |
| 71 | + """ |
| 72 | + result = self._client.update_ekm_connection(ekm_connection=connection._to_generated(), **kwargs) |
| 73 | + return KeyVaultEkmConnection._from_generated(result) |
| 74 | + |
| 75 | + @distributed_trace |
| 76 | + def delete_ekm_connection( # pylint:disable=bad-option-value,delete-operation-wrong-return-type |
| 77 | + self, **kwargs: Any |
| 78 | + ) -> KeyVaultEkmConnection: |
| 79 | + """Deletes the existing EKM connection. |
| 80 | +
|
| 81 | + If no EKM connection exists, this operation fails. |
| 82 | +
|
| 83 | + :returns: The deleted EKM connection. |
| 84 | + :rtype: ~azure.keyvault.administration.KeyVaultEkmConnection |
| 85 | + :raises ~azure.core.exceptions.HttpResponseError: |
| 86 | + """ |
| 87 | + result = self._client.delete_ekm_connection(**kwargs) |
| 88 | + return KeyVaultEkmConnection._from_generated(result) |
| 89 | + |
| 90 | + @distributed_trace |
| 91 | + def get_ekm_certificate(self, **kwargs: Any) -> KeyVaultEkmProxyClientCertificateInfo: |
| 92 | + """Gets the EKM proxy client certificate information used to authenticate to the EKM proxy. |
| 93 | +
|
| 94 | + :returns: The EKM proxy client certificate information. |
| 95 | + :rtype: ~azure.keyvault.administration.KeyVaultEkmProxyClientCertificateInfo |
| 96 | + :raises ~azure.core.exceptions.HttpResponseError: |
| 97 | + """ |
| 98 | + result = self._client.get_ekm_certificate(**kwargs) |
| 99 | + return KeyVaultEkmProxyClientCertificateInfo._from_generated(result) |
| 100 | + |
| 101 | + @distributed_trace |
| 102 | + def check_ekm_connection(self, **kwargs: Any) -> KeyVaultEkmProxyInfo: |
| 103 | + """Checks the EKM connection by pinging the EKM proxy. |
| 104 | +
|
| 105 | + :returns: Information about the EKM proxy returned by the connectivity check. |
| 106 | + :rtype: ~azure.keyvault.administration.KeyVaultEkmProxyInfo |
| 107 | + :raises ~azure.core.exceptions.HttpResponseError: |
| 108 | + """ |
| 109 | + result = self._client.check_ekm_connection(**kwargs) |
| 110 | + return KeyVaultEkmProxyInfo._from_generated(result) |
| 111 | + |
| 112 | + def __enter__(self) -> "KeyVaultEkmClient": |
| 113 | + self._client.__enter__() |
| 114 | + return self |
0 commit comments