Skip to content

Commit f4a4bad

Browse files
qinl-lijlichwaheaths
authored
Key rotation swagger change (Azure#11965)
* Key rotation swagger change * Run PrettierCheck * fixed spellcheck error * Update specification/keyvault/data-plane/Microsoft.KeyVault/preview/7.3-preview/keys.json Co-authored-by: Heath Stewart <heaths@microsoft.com> * Update based on comments * fix prettier failure * Update Api names * Add custom words * Update to key rotation policy * Remove key rotation policy from response * Remove required * fix validation error * remove parameter force * Rotate api should be post * udpate description * Update UpdateKeyRotationPolicy-example * Update names * Microsoft.KeyVault-DP-7.3-preview-KeyAutoRotation * Update Co-authored-by: Jack Lichwa <52512203+jlichwa@users.noreply.github.com> Co-authored-by: Heath Stewart <heaths@microsoft.com>
1 parent 822c826 commit f4a4bad

File tree

5 files changed

+361
-0
lines changed

5 files changed

+361
-0
lines changed

‎custom-words.txt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1593,6 +1593,7 @@ rolloverdetails
15931593
rootfs
15941594
rosettanetprocessconfigurations
15951595
rotatediskencryptionkey
1596+
rotationpolicy
15961597
routable
15971598
routingendpointhealth
15981599
rpki

‎specification/keyvault/data-plane/Microsoft.KeyVault/preview/7.3-preview/examples/GetKeyRotationPolicy-example.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"parameters": {
3+
"vaultBaseUrl": "https://myvault.vault.azure.net/",
4+
"key-name": "key01",
5+
"api-version": "7.3-preview"
6+
},
7+
"responses": {
8+
"200": {
9+
"body": {
10+
"id": "https://myvault.vault.azure.net/keys/key01/rotationpolicy",
11+
"lifetimeActions": [
12+
{
13+
"trigger": {
14+
"timeAfterCreate": "P90D"
15+
},
16+
"action": {
17+
"type": "rotate"
18+
}
19+
},
20+
{
21+
"trigger": {
22+
"timeBeforeExpiry": "P30D"
23+
},
24+
"action": {
25+
"type": "notify"
26+
}
27+
}
28+
],
29+
"attributes": {
30+
"expiryTime": "P2Y",
31+
"created": 1482188947,
32+
"updated": 1482188948
33+
}
34+
}
35+
}
36+
}
37+
}

‎specification/keyvault/data-plane/Microsoft.KeyVault/preview/7.3-preview/examples/RotateKey-example.json‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
{
2+
"parameters": {
3+
"vaultBaseUrl": "https://myvault.vault.azure.net/",
4+
"key-name": "Key01",
5+
"api-version": "7.3-preview"
6+
},
7+
"responses": {
8+
"200": {
9+
"body": {
10+
"key": {
11+
"kid": "https://myvault.vault.azure.net/keys/CreateSoftKeyTest/78deebed173b48e48f55abf87ed4cf71",
12+
"kty": "RSA",
13+
"key_ops": [
14+
"encrypt",
15+
"decrypt",
16+
"sign",
17+
"verify",
18+
"wrapKey",
19+
"unwrapKey"
20+
],
21+
"n": "2HJAE5fU3Cw2Rt9hEuq-F6XjINKGa-zskfISVqopqUy60GOs2eyhxbWbJBeUXNor_gf-tXtNeuqeBgitLeVa640UDvnEjYTKWjCniTxZRaU7ewY8BfTSk-7KxoDdLsPSpX_MX4rwlAx-_1UGk5t4sQgTbm9T6Fm2oqFd37dsz5-Gj27UP2GTAShfJPFD7MqU_zIgOI0pfqsbNL5xTQVM29K6rX4jSPtylZV3uWJtkoQIQnrIHhk1d0SC0KwlBV3V7R_LVYjiXLyIXsFzSNYgQ68ZjAwt8iL7I8Osa-ehQLM13DVvLASaf7Jnu3sC3CWl3Gyirgded6cfMmswJzY87w",
22+
"e": "AQAB"
23+
},
24+
"attributes": {
25+
"enabled": true,
26+
"created": 1493942451,
27+
"updated": 1493942451,
28+
"recoveryLevel": "Recoverable+Purgeable"
29+
},
30+
"tags": {
31+
"purpose": "unit test",
32+
"test name ": "CreateGetDeleteKeyTest"
33+
}
34+
}
35+
}
36+
}
37+
}

‎specification/keyvault/data-plane/Microsoft.KeyVault/preview/7.3-preview/examples/UpdateKeyRotationPolicy-example.json‎

Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
{
2+
"parameters": {
3+
"vaultBaseUrl": "https://myvault.vault.azure.net/",
4+
"key-name": "updateKey01",
5+
"api-version": "7.3-preview",
6+
"keyRotationPolicy": {
7+
"lifetimeActions": [
8+
{
9+
"trigger": {
10+
"timeAfterCreate": "P90D"
11+
},
12+
"action": {
13+
"type": "rotate"
14+
}
15+
},
16+
{
17+
"trigger": {
18+
"timeBeforeExpiry": "P30D"
19+
},
20+
"action": {
21+
"type": "notify"
22+
}
23+
}
24+
],
25+
"attributes": {
26+
"expirationTime": "P2Y"
27+
}
28+
}
29+
},
30+
"responses": {
31+
"200": {
32+
"body": {
33+
"id": "https://myvault.vault.azure.net/keys/updateKey01/rotationpolicy",
34+
"lifetimeActions": [
35+
{
36+
"trigger": {
37+
"timeAfterCreate": "P90D"
38+
},
39+
"action": {
40+
"type": "rotate"
41+
}
42+
},
43+
{
44+
"trigger": {
45+
"timeBeforeExpiry": "P30D"
46+
},
47+
"action": {
48+
"type": "notify"
49+
}
50+
}
51+
],
52+
"attributes": {
53+
"expiryTime": "P2Y",
54+
"created": 1482188947,
55+
"updated": 1482188948
56+
}
57+
}
58+
}
59+
}
60+
}

‎specification/keyvault/data-plane/Microsoft.KeyVault/preview/7.3-preview/keys.json‎

Lines changed: 226 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -79,6 +79,48 @@
7979
}
8080
}
8181
},
82+
"/keys/{key-name}/rotate": {
83+
"post": {
84+
"tags": [
85+
"Keys"
86+
],
87+
"operationId": "RotateKey",
88+
"summary": "Creates a new key version, stores it, then returns key parameters, attributes and policy to the client.",
89+
"description": "The operation will rotate the key based on the key policy. It requires the keys/rotate permission.",
90+
"parameters": [
91+
{
92+
"name": "key-name",
93+
"in": "path",
94+
"required": true,
95+
"type": "string",
96+
"pattern": "^[0-9a-zA-Z-]+$",
97+
"description": "The name of key to be rotated. The system will generate a new version in the specified key."
98+
},
99+
{
100+
"$ref": "#/parameters/ApiVersionParameter"
101+
}
102+
],
103+
"responses": {
104+
"200": {
105+
"description": "A key bundle containing the result of the rotate key request.",
106+
"schema": {
107+
"$ref": "#/definitions/KeyBundle"
108+
}
109+
},
110+
"default": {
111+
"description": "Key Vault error response describing why the operation failed.",
112+
"schema": {
113+
"$ref": "common.json#/definitions/KeyVaultError"
114+
}
115+
}
116+
},
117+
"x-ms-examples": {
118+
"Rotate key": {
119+
"$ref": "./examples/RotateKey-example.json"
120+
}
121+
}
122+
}
123+
},
82124
"/keys/{key-name}": {
83125
"put": {
84126
"tags": [
@@ -1089,6 +1131,95 @@
10891131
}
10901132
}
10911133
},
1134+
"/keys/{key-name}/rotationpolicy": {
1135+
"get": {
1136+
"tags": [
1137+
"Keys"
1138+
],
1139+
"operationId": "GetKeyRotationPolicy",
1140+
"summary": "Lists the policy for a key.",
1141+
"description": "The GetKeyRotationPolicy operation returns the specified key policy resources in the specified key vault. This operation requires the keys/get permission.",
1142+
"parameters": [
1143+
{
1144+
"name": "key-name",
1145+
"in": "path",
1146+
"required": true,
1147+
"type": "string",
1148+
"description": "The name of the key in a given key vault."
1149+
},
1150+
{
1151+
"$ref": "#/parameters/ApiVersionParameter"
1152+
}
1153+
],
1154+
"responses": {
1155+
"200": {
1156+
"description": "The key rotation policy.",
1157+
"schema": {
1158+
"$ref": "#/definitions/KeyRotationPolicy"
1159+
}
1160+
},
1161+
"default": {
1162+
"description": "Key Vault error response describing why the operation failed.",
1163+
"schema": {
1164+
"$ref": "common.json#/definitions/KeyVaultError"
1165+
}
1166+
}
1167+
},
1168+
"x-ms-examples": {
1169+
"GetKeyRotationPolicy": {
1170+
"$ref": "./examples/GetKeyRotationPolicy-example.json"
1171+
}
1172+
}
1173+
},
1174+
"put": {
1175+
"tags": [
1176+
"keys"
1177+
],
1178+
"operationId": "UpdateKeyRotationPolicy",
1179+
"summary": "Updates the rotation policy for a key.",
1180+
"description": "Set specified members in the key policy. Leave others as undefined. This operation requires the keys/update permission.",
1181+
"parameters": [
1182+
{
1183+
"name": "key-name",
1184+
"in": "path",
1185+
"required": true,
1186+
"type": "string",
1187+
"description": "The name of the key in the given vault."
1188+
},
1189+
{
1190+
"name": "keyRotationPolicy",
1191+
"in": "body",
1192+
"required": true,
1193+
"schema": {
1194+
"$ref": "#/definitions/KeyRotationPolicy"
1195+
},
1196+
"description": "The policy for the key."
1197+
},
1198+
{
1199+
"$ref": "#/parameters/ApiVersionParameter"
1200+
}
1201+
],
1202+
"responses": {
1203+
"200": {
1204+
"description": "The policy for the key.",
1205+
"schema": {
1206+
"$ref": "#/definitions/KeyRotationPolicy"
1207+
}
1208+
},
1209+
"default": {
1210+
"description": "Key Vault error response describing why the operation failed.",
1211+
"schema": {
1212+
"$ref": "common.json#/definitions/KeyVaultError"
1213+
}
1214+
}
1215+
},
1216+
"x-ms-examples": {
1217+
"UpdateKeyRotationPolicy": {
1218+
"$ref": "./examples/UpdateKeyRotationPolicy-example.json"
1219+
}
1220+
}
1221+
}
1222+
},
10921223
"/rng": {
10931224
"post": {
10941225
"tags": [
@@ -2060,6 +2191,101 @@
20602191
},
20612192
"description": "The backup key result, containing the backup blob."
20622193
},
2194+
"KeyRotationPolicy": {
2195+
"properties": {
2196+
"id": {
2197+
"type": "string",
2198+
"description": "The key policy id.",
2199+
"readOnly": true
2200+
},
2201+
"lifetimeActions": {
2202+
"type": "array",
2203+
"items": {
2204+
"$ref": "#/definitions/LifetimeActions"
2205+
},
2206+
"description": "Actions that will be performed by Key Vault over the lifetime of a key. For preview, lifetimeActions can only have two items at maximum: one for rotate, one for notify. Notification time would be default to 30 days before expiry and it is not configurable."
2207+
},
2208+
"attributes": {
2209+
"$ref": "#/definitions/KeyRotationPolicyAttributes",
2210+
"description": "The key rotation policy attributes."
2211+
}
2212+
},
2213+
"description": "Management policy for a key."
2214+
},
2215+
"LifetimeActions": {
2216+
"properties": {
2217+
"trigger": {
2218+
"$ref": "#/definitions/LifetimeActionsTrigger",
2219+
"description": "The condition that will execute the action."
2220+
},
2221+
"action": {
2222+
"$ref": "#/definitions/LifetimeActionsType",
2223+
"description": "The action that will be executed."
2224+
}
2225+
},
2226+
"description": "Action and its trigger that will be performed by Key Vault over the lifetime of a key."
2227+
},
2228+
"LifetimeActionsTrigger": {
2229+
"properties": {
2230+
"timeAfterCreate": {
2231+
"type": "string",
2232+
"description": "Time after creation to attempt rotate. It will be in ISO 8601 format. Example: 90 days : \"P90D\" "
2233+
},
2234+
"timeBeforeExpiry": {
2235+
"type": "string",
2236+
"description": "Time before expiry to attempt rotate. It will be in ISO 8601 format. Example: 90 days : \"P90D\""
2237+
}
2238+
},
2239+
"description": "A condition to be satisfied for an action to be executed."
2240+
},
2241+
"LifetimeActionsType": {
2242+
"properties": {
2243+
"type": {
2244+
"type": "string",
2245+
"description": "The type of the action.",
2246+
"enum": [
2247+
"rotate",
2248+
"notify"
2249+
],
2250+
"x-ms-enum": {
2251+
"name": "ActionType",
2252+
"modelAsString": false,
2253+
"values": [
2254+
{
2255+
"value": "rotate",
2256+
"description": "Rotate the key based on the key policy."
2257+
},
2258+
{
2259+
"value": "notify",
2260+
"description": "Trigger event grid events. For preview, the notification time is not configurable and it is default to 30 days before expiry."
2261+
}
2262+
]
2263+
}
2264+
}
2265+
},
2266+
"description": "The action that will be executed."
2267+
},
2268+
"KeyRotationPolicyAttributes": {
2269+
"properties": {
2270+
"expiryTime": {
2271+
"type": "string",
2272+
"description": "The expiryTime will be applied on the new key version. It should be at least 28 days. It will be in ISO 8601 Format. Examples: 90 days: P90D, 3 months: P3M, 48 hours: PT48H, 1 year and 10 days: P1Y10D"
2273+
},
2274+
"created": {
2275+
"type": "integer",
2276+
"format": "unixtime",
2277+
"readOnly": true,
2278+
"description": "The key rotation policy created time in UTC."
2279+
},
2280+
"updated": {
2281+
"type": "integer",
2282+
"format": "unixtime",
2283+
"readOnly": true,
2284+
"description": "The key rotation policy's last updated time in UTC."
2285+
}
2286+
},
2287+
"description": "The key rotation policy attributes."
2288+
},
20632289
"KeyReleaseResult": {
20642290
"properties": {
20652291
"value": {

0 commit comments

Comments
 (0)