Skip to content

Commit eac2801

Browse files
markcowlCopilot
markcowl
and
Copilot
committed
Hide CustomerManagedKeyEncryption types as internal; add V4 Foundations replacements
Mark CustomerManagedKeyEncryption, KeyEncryptionKeyIdentity, and KeyEncryptionKeyIdentityType as internal in the CommonTypes namespace, preventing direct use in service specifications. Add CustomerManagedKeyEncryptionV4, KeyEncryptionKeyIdentityV4, and KeyEncryptionKeyIdentityTypeV4 in Azure.ResourceManager.Foundations as public replacement types. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent efeb962 commit eac2801

8 files changed

Lines changed: 222 additions & 22 deletions

File tree

‎.chronus/changes/hide-cmk-internal-2026-6-12-17-1-0.md‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
---
2+
changeKind: feature
3+
packages:
4+
- "@azure-tools/typespec-azure-resource-manager"
5+
---
6+
7+
Hide `CustomerManagedKeyEncryption`, `KeyEncryptionKeyIdentity`, and `KeyEncryptionKeyIdentityType` common types by marking them `internal`. Add public replacement types `CustomerManagedKeyEncryptionV4`, `KeyEncryptionKeyIdentityV4`, and `KeyEncryptionKeyIdentityTypeV4` in the `Azure.ResourceManager.Foundations` namespace.
8+
9+
```tsp
10+
// Use the new Foundations types instead of the internal CommonTypes types:
11+
model EncryptionConfig {
12+
customerManagedKey?: Azure.ResourceManager.Foundations.CustomerManagedKeyEncryptionV4;
13+
}
14+
```

‎packages/typespec-azure-resource-manager/lib/backcompat.tsp‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ namespace Azure.ResourceManager;
66
alias InfrastructureEncryption = CommonTypes.InfrastructureEncryption;
77
alias KeyEncryptionIdentity = CommonTypes.KeyEncryptionKeyIdentity;
88
alias KeyEncryptionKeyIdentity = CommonTypes.KeyEncryptionKeyIdentity;
9-
alias CustomerManagedKeyEncryption = CommonTypes.CustomerManagedKeyEncryption;
109
alias EncryptionConfiguration = CommonTypes.Encryption;
1110

1211
// private-links

‎packages/typespec-azure-resource-manager/lib/common-types/customer-managed-keys.tsp‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,8 @@ model KeyEncryptionKeyIdentity {
4949

5050
/** Customer-managed key encryption properties for the resource. */
5151
@added(Versions.v4)
52-
model CustomerManagedKeyEncryption {
52+
#suppress "experimental-feature" "internal is intentional for this type"
53+
internal model CustomerManagedKeyEncryption {
5354
/** All identity configuration for Customer-managed key settings defining which identity should be used to auth to Key Vault. */
5455
keyEncryptionKeyIdentity?: KeyEncryptionKeyIdentity;
5556

‎packages/typespec-azure-resource-manager/lib/foundations/arm.foundations.tsp‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ import "@typespec/rest";
33

44
import "./backcompat.tsp";
55
import "./deprecation.tsp";
6+
import "./encryption.tsp";
67
import "../common-types/common-types.tsp";
78
import "../decorators.tsp";
89
import "../responses.tsp";

‎packages/typespec-azure-resource-manager/lib/foundations/encryption.tsp‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
using Azure.Core;
2+
3+
namespace Azure.ResourceManager.Foundations;
4+
5+
/** The type of identity to use. */
6+
union KeyEncryptionKeyIdentityTypeV4 {
7+
/** System assigned identity */
8+
SystemAssignedIdentity: "systemAssignedIdentity",
9+
10+
/** User assigned identity */
11+
UserAssignedIdentity: "userAssignedIdentity",
12+
13+
/** Delegated identity */
14+
DelegatedResourceIdentity: "delegatedResourceIdentity",
15+
16+
string,
17+
}
18+
19+
/** All identity configuration for Customer-managed key settings defining which identity should be used to auth to Key Vault. */
20+
model KeyEncryptionKeyIdentityV4 {
21+
/** The type of identity to use. Values can be systemAssignedIdentity, userAssignedIdentity, or delegatedResourceIdentity. */
22+
identityType?: KeyEncryptionKeyIdentityTypeV4;
23+
24+
/** User assigned identity to use for accessing key encryption key Url. Ex: /subscriptions/fa5fc227-a624-475e-b696-cdd604c735bc/resourceGroups/<resource group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myId. Mutually exclusive with identityType systemAssignedIdentity. */
25+
userAssignedIdentityResourceId?: Azure.Core.armResourceIdentifier;
26+
27+
/** application client identity to use for accessing key encryption key Url in a different tenant. Ex: f83c6b1b-4d34-47e4-bb34-9d83df58b540 */
28+
federatedClientId?: uuid;
29+
30+
/** delegated identity to use for accessing key encryption key Url. Ex: /subscriptions/fa5fc227-a624-475e-b696-cdd604c735bc/resourceGroups/<resource group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myId. Mutually exclusive with identityType systemAssignedIdentity and userAssignedIdentity - internal use only. */
31+
delegatedIdentityClientId?: uuid;
32+
}
33+
34+
/** Customer-managed key encryption properties for the resource. */
35+
model CustomerManagedKeyEncryptionV4 {
36+
/** All identity configuration for Customer-managed key settings defining which identity should be used to auth to Key Vault. */
37+
keyEncryptionKeyIdentity?: KeyEncryptionKeyIdentityV4;
38+
39+
/** key encryption key Url, versioned or non-versioned. Ex: https://contosovault.vault.azure.net/keys/contosokek/562a4bb76b524a1493a6afe8e536ee78 or https://contosovault.vault.azure.net/keys/contosokek. */
40+
keyEncryptionKeyUrl?: string;
41+
}

‎packages/typespec-azure-resource-manager/test/foundations-encryption.test.ts‎

Lines changed: 110 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,110 @@
1+
import { Tester } from "#test/tester.js";
2+
import { TesterInstance } from "@typespec/compiler/testing";
3+
import { beforeEach, describe, it } from "vitest";
4+
5+
let runner: TesterInstance;
6+
7+
beforeEach(async () => {
8+
runner = await Tester.createInstance();
9+
});
10+
11+
describe("CustomerManagedKeyEncryptionV4 foundations type", () => {
12+
it("can be used in a service spec as a property type", async () => {
13+
const diagnostics = await runner.diagnose(
14+
`
15+
@armProviderNamespace
16+
@service
17+
namespace Microsoft.Contoso;
18+
19+
model EncryptionConfig {
20+
customerManagedKey?: Azure.ResourceManager.Foundations.CustomerManagedKeyEncryptionV4;
21+
}
22+
`,
23+
);
24+
expectDiagnosticEmpty(diagnostics);
25+
});
26+
27+
it("exposes keyEncryptionKeyIdentity and keyEncryptionKeyUrl properties", async () => {
28+
const diagnostics = await runner.diagnose(
29+
`
30+
@armProviderNamespace
31+
@service
32+
namespace Microsoft.Contoso;
33+
34+
model EncryptionConfig {
35+
customerManagedKey?: Azure.ResourceManager.Foundations.CustomerManagedKeyEncryptionV4;
36+
}
37+
38+
model UsesIdentity {
39+
identity?: Azure.ResourceManager.Foundations.KeyEncryptionKeyIdentityV4;
40+
}
41+
`,
42+
);
43+
expectDiagnosticEmpty(diagnostics);
44+
});
45+
46+
it("KeyEncryptionKeyIdentityTypeV4 union can be referenced", async () => {
47+
const diagnostics = await runner.diagnose(
48+
`
49+
@armProviderNamespace
50+
@service
51+
namespace Microsoft.Contoso;
52+
53+
model IdentityConfig {
54+
identityType?: Azure.ResourceManager.Foundations.KeyEncryptionKeyIdentityTypeV4;
55+
}
56+
`,
57+
);
58+
expectDiagnosticEmpty(diagnostics);
59+
});
60+
61+
it("CustomerManagedKeyEncryption is internal and cannot be used outside Azure.ResourceManager", async () => {
62+
const diagnostics = await runner.diagnose(
63+
`
64+
@armProviderNamespace
65+
@service
66+
namespace Microsoft.Contoso;
67+
68+
model EncryptionConfig {
69+
customerManagedKey?: Azure.ResourceManager.CommonTypes.CustomerManagedKeyEncryption;
70+
}
71+
`,
72+
);
73+
expectDiagnosticNotEmpty(diagnostics);
74+
});
75+
76+
it("Encryption wrapper type remains public and usable", async () => {
77+
const diagnostics = await runner.diagnose(
78+
`
79+
@service(#{ title: "Test" })
80+
@versioned(Microsoft.Contoso.Versions)
81+
@armProviderNamespace
82+
namespace Microsoft.Contoso;
83+
84+
enum Versions {
85+
@armCommonTypesVersion(Azure.ResourceManager.CommonTypes.Versions.v4)
86+
v4;
87+
}
88+
89+
model ResourceProperties {
90+
encryption?: Azure.ResourceManager.CommonTypes.Encryption;
91+
}
92+
`,
93+
);
94+
expectDiagnosticEmpty(diagnostics);
95+
});
96+
});
97+
98+
function expectDiagnosticEmpty(diagnostics: readonly any[]) {
99+
if (diagnostics.length > 0) {
100+
throw new Error(
101+
`Expected no diagnostics but got ${diagnostics.length}: ${diagnostics.map((d) => `${d.code}: ${d.message}`).join(", ")}`,
102+
);
103+
}
104+
}
105+
106+
function expectDiagnosticNotEmpty(diagnostics: readonly any[]) {
107+
if (diagnostics.length === 0) {
108+
throw new Error("Expected diagnostics but got none");
109+
}
110+
}

‎website/src/content/docs/docs/libraries/azure-resource-manager/reference/data-types.md‎

Lines changed: 52 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1979,21 +1979,6 @@ model Azure.ResourceManager.CommonTypes.CheckNameAvailabilityResponse
19791979
| reason? | [`CheckNameAvailabilityReason`](./data-types.md#Azure.ResourceManager.CommonTypes.CheckNameAvailabilityReason) | The reason why the given name is not available. |
19801980
| message? | `string` | Detailed reason why the given name is not available. |
19811981

1982-
### `CustomerManagedKeyEncryption` {#Azure.ResourceManager.CommonTypes.CustomerManagedKeyEncryption}
1983-
1984-
Customer-managed key encryption properties for the resource.
1985-
1986-
```typespec
1987-
model Azure.ResourceManager.CommonTypes.CustomerManagedKeyEncryption
1988-
```
1989-
1990-
#### Properties
1991-
1992-
| Name | Type | Description |
1993-
| ------------------------- | -------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
1994-
| keyEncryptionKeyIdentity? | [`KeyEncryptionKeyIdentity`](./data-types.md#Azure.ResourceManager.CommonTypes.KeyEncryptionKeyIdentity) | All identity configuration for Customer-managed key settings defining which identity should be used to auth to Key Vault. |
1995-
| keyEncryptionKeyUrl? | `string` | key encryption key Url, versioned or non-versioned. Ex: https://contosovault.vault.azure.net/keys/contosokek/562a4bb76b524a1493a6afe8e536ee78 or https://contosovault.vault.azure.net/keys/contosokek. |
1996-
19971982
### `DelegatedResource` {#Azure.ResourceManager.CommonTypes.DelegatedResource}
19981983

19991984
Delegated resource properties - internal use only.
@@ -2035,10 +2020,10 @@ model Azure.ResourceManager.CommonTypes.Encryption
20352020

20362021
#### Properties
20372022

2038-
| Name | Type | Description |
2039-
| ----------------------------- | ---------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- |
2040-
| infrastructureEncryption? | [`InfrastructureEncryption`](./data-types.md#Azure.ResourceManager.CommonTypes.InfrastructureEncryption) | Values are enabled and disabled. |
2041-
| customerManagedKeyEncryption? | [`CustomerManagedKeyEncryption`](./data-types.md#Azure.ResourceManager.CommonTypes.CustomerManagedKeyEncryption) | All Customer-managed key encryption properties for the resource. |
2023+
| Name | Type | Description |
2024+
| ----------------------------- | -------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------- |
2025+
| infrastructureEncryption? | [`InfrastructureEncryption`](./data-types.md#Azure.ResourceManager.CommonTypes.InfrastructureEncryption) | Values are enabled and disabled. |
2026+
| customerManagedKeyEncryption? | `Azure.ResourceManager.CommonTypes.CustomerManagedKeyEncryption` | All Customer-managed key encryption properties for the resource. |
20422027

20432028
### `EncryptionProperties` {#Azure.ResourceManager.CommonTypes.EncryptionProperties}
20442029

@@ -3792,6 +3777,21 @@ model Azure.ResourceManager.Foundations.ArmTagsProperty
37923777
| ----- | ---------------- | -------------- |
37933778
| tags? | `Record<string>` | Resource tags. |
37943779

3780+
### `CustomerManagedKeyEncryptionV4` {#Azure.ResourceManager.Foundations.CustomerManagedKeyEncryptionV4}
3781+
3782+
Customer-managed key encryption properties for the resource.
3783+
3784+
```typespec
3785+
model Azure.ResourceManager.Foundations.CustomerManagedKeyEncryptionV4
3786+
```
3787+
3788+
#### Properties
3789+
3790+
| Name | Type | Description |
3791+
| ------------------------- | ------------------------------------------------------------------------------------------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
3792+
| keyEncryptionKeyIdentity? | [`KeyEncryptionKeyIdentityV4`](./data-types.md#Azure.ResourceManager.Foundations.KeyEncryptionKeyIdentityV4) | All identity configuration for Customer-managed key settings defining which identity should be used to auth to Key Vault. |
3793+
| keyEncryptionKeyUrl? | `string` | key encryption key Url, versioned or non-versioned. Ex: https://contosovault.vault.azure.net/keys/contosokek/562a4bb76b524a1493a6afe8e536ee78 or https://contosovault.vault.azure.net/keys/contosokek. |
3794+
37953795
### `DefaultBaseParameters` {#Azure.ResourceManager.Foundations.DefaultBaseParameters}
37963796

37973797
Base parameters for a resource.
@@ -3853,6 +3853,23 @@ model Azure.ResourceManager.Foundations.ExtensionScope<Resource>
38533853
| resourceUri | `string` | The fully qualified Azure Resource manager identifier of the resource. |
38543854
| provider | `"Microsoft.ThisWillBeReplaced"` | |
38553855

3856+
### `KeyEncryptionKeyIdentityV4` {#Azure.ResourceManager.Foundations.KeyEncryptionKeyIdentityV4}
3857+
3858+
All identity configuration for Customer-managed key settings defining which identity should be used to auth to Key Vault.
3859+
3860+
```typespec
3861+
model Azure.ResourceManager.Foundations.KeyEncryptionKeyIdentityV4
3862+
```
3863+
3864+
#### Properties
3865+
3866+
| Name | Type | Description |
3867+
| ------------------------------- | -------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
3868+
| identityType? | [`KeyEncryptionKeyIdentityTypeV4`](./data-types.md#Azure.ResourceManager.Foundations.KeyEncryptionKeyIdentityTypeV4) | The type of identity to use. Values can be systemAssignedIdentity, userAssignedIdentity, or delegatedResourceIdentity. |
3869+
| userAssignedIdentityResourceId? | `Azure.Core.armResourceIdentifier` | User assigned identity to use for accessing key encryption key Url. Ex: /subscriptions/fa5fc227-a624-475e-b696-cdd604c735bc/resourceGroups/<resource group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myId. Mutually exclusive with identityType systemAssignedIdentity. |
3870+
| federatedClientId? | `Azure.Core.uuid` | application client identity to use for accessing key encryption key Url in a different tenant. Ex: f83c6b1b-4d34-47e4-bb34-9d83df58b540 |
3871+
| delegatedIdentityClientId? | `Azure.Core.uuid` | delegated identity to use for accessing key encryption key Url. Ex: /subscriptions/fa5fc227-a624-475e-b696-cdd604c735bc/resourceGroups/<resource group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/myId. Mutually exclusive with identityType systemAssignedIdentity and userAssignedIdentity - internal use only. |
3872+
38563873
### `LocationBaseParameters` {#Azure.ResourceManager.Foundations.LocationBaseParameters}
38573874

38583875
The static parameters for a location-based resource
@@ -4106,6 +4123,22 @@ model Azure.ResourceManager.Foundations.TenantScope<Resource>
41064123
| apiVersion | `string` | The API version to use for this operation. |
41074124
| provider | `"Microsoft.ThisWillBeReplaced"` | |
41084125

4126+
### `KeyEncryptionKeyIdentityTypeV4` {#Azure.ResourceManager.Foundations.KeyEncryptionKeyIdentityTypeV4}
4127+
4128+
The type of identity to use.
4129+
4130+
```typespec
4131+
union Azure.ResourceManager.Foundations.KeyEncryptionKeyIdentityTypeV4
4132+
```
4133+
4134+
#### Variants
4135+
4136+
| Name | Type | Description |
4137+
| ------------------------- | ----------------------------- | ------------------------ |
4138+
| SystemAssignedIdentity | `"systemAssignedIdentity"` | System assigned identity |
4139+
| UserAssignedIdentity | `"userAssignedIdentity"` | User assigned identity |
4140+
| DelegatedResourceIdentity | `"delegatedResourceIdentity"` | Delegated identity |
4141+
41094142
## Azure.ResourceManager.Legacy
41104143

41114144
### `ArmFeatureOptions` {#Azure.ResourceManager.Legacy.ArmFeatureOptions}

‎website/src/content/docs/docs/libraries/azure-resource-manager/reference/index.mdx‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -227,7 +227,6 @@ npm install --save-peer @azure-tools/typespec-azure-resource-manager
227227
- [`AzureEntityResource`](./data-types.md#Azure.ResourceManager.CommonTypes.AzureEntityResource)
228228
- [`CheckNameAvailabilityRequest`](./data-types.md#Azure.ResourceManager.CommonTypes.CheckNameAvailabilityRequest)
229229
- [`CheckNameAvailabilityResponse`](./data-types.md#Azure.ResourceManager.CommonTypes.CheckNameAvailabilityResponse)
230-
- [`CustomerManagedKeyEncryption`](./data-types.md#Azure.ResourceManager.CommonTypes.CustomerManagedKeyEncryption)
231230
- [`DelegatedResource`](./data-types.md#Azure.ResourceManager.CommonTypes.DelegatedResource)
232231
- [`DelegatedResources`](./data-types.md#Azure.ResourceManager.CommonTypes.DelegatedResources)
233232
- [`Encryption`](./data-types.md#Azure.ResourceManager.CommonTypes.Encryption)
@@ -344,9 +343,11 @@ npm install --save-peer @azure-tools/typespec-azure-resource-manager
344343
### Models
345344

346345
- [`ArmTagsProperty`](./data-types.md#Azure.ResourceManager.Foundations.ArmTagsProperty)
346+
- [`CustomerManagedKeyEncryptionV4`](./data-types.md#Azure.ResourceManager.Foundations.CustomerManagedKeyEncryptionV4)
347347
- [`DefaultBaseParameters`](./data-types.md#Azure.ResourceManager.Foundations.DefaultBaseParameters)
348348
- [`ExtensionBaseParameters`](./data-types.md#Azure.ResourceManager.Foundations.ExtensionBaseParameters)
349349
- [`ExtensionScope`](./data-types.md#Azure.ResourceManager.Foundations.ExtensionScope)
350+
- [`KeyEncryptionKeyIdentityV4`](./data-types.md#Azure.ResourceManager.Foundations.KeyEncryptionKeyIdentityV4)
350351
- [`LocationBaseParameters`](./data-types.md#Azure.ResourceManager.Foundations.LocationBaseParameters)
351352
- [`LocationScope`](./data-types.md#Azure.ResourceManager.Foundations.LocationScope)
352353
- [`ProxyResourceUpdateModel`](./data-types.md#Azure.ResourceManager.Foundations.ProxyResourceUpdateModel)

0 commit comments

Comments
 (0)