Update Set-AzSynapseSqlPoolAuditSetting.md

[sravanisaluru]

updating the audit action groups that we support for synapse

Description

Checklist

• I have read the Submitting Changes section of CONTRIBUTING.md
• The title of the PR is clear and informative
• The appropriate ChangeLog.md file(s) has been updated:
  • For any service, the ChangeLog.md file can be found at src/{{SERVICE}}/{{SERVICE}}/ChangeLog.md
  • A snippet outlining the change(s) made in the PR should be written under the ## Upcoming Release header -- no new version header should be added
• The PR does not introduce breaking changes
• If applicable, the changes made in the PR have proper test coverage
• For public API changes to cmdlets:
  • a cmdlet design review was approved for the changes in this repository (Microsoft internal only)
    • {Please put the link here}
  • the markdown help files have been regenerated using the commands listed here

[ghost]

Thank you for your contribution sravanisaluru! We will review the pull request and get back to you soon.

[sravanisaluru]

#sign-off

[sravanisaluru]

#sign-off

[VeryEarly]

please also update this string:
https://github.com/Azure/azure-powershell/blob/main/src/Synapse/Synapse/Common/HelpMessages.cs#L244
otherwise your change will be overwrite next time doc was generated

[sravanisaluru]

Hi Yabo , could you please help me with this , regards sravani

…

On Thu, Jun 30, 2022 at 11:40 AM Yabo Hu ***@***.***> wrote: please also update this string: https://github.com/Azure/azure-powershell/blob/main/src/Synapse/Synapse/Common/HelpMessages.cs#L244 otherwise your change will be overwrite next time doc was generated — Reply to this email directly, view it on GitHub <#18839 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHMY2KRZN4HYELE7QWU5KDLVRU25BANCNFSM52IBLIHA> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[BethanyZhou]

@sravanisaluru , as you're intend to reduce the accepted value of AuditActionGroup, we need to update the Enum value below as well. I'm afraid that these changes will cause breaking changes as well. And breaking change is not allowed in current release. Could you raise the request by email and send it to our PM @dcaro ?

azure-powershell/src/Synapse/Synapse/Models/ManagementModels/Auditing/WorkspaceAuditModel.cs

Lines 17 to 39 in 175bb06

	public enum AuditActionGroups
	{
	BATCH_STARTED_GROUP,
	BATCH_COMPLETED_GROUP,
	APPLICATION_ROLE_CHANGE_PASSWORD_GROUP,
	BACKUP_RESTORE_GROUP,
	DATABASE_LOGOUT_GROUP,
	DATABASE_OBJECT_CHANGE_GROUP,
	DATABASE_OBJECT_OWNERSHIP_CHANGE_GROUP,
	DATABASE_OBJECT_PERMISSION_CHANGE_GROUP,
	DATABASE_OPERATION_GROUP,
	DATABASE_PERMISSION_CHANGE_GROUP,
	DATABASE_PRINCIPAL_CHANGE_GROUP,
	DATABASE_PRINCIPAL_IMPERSONATION_GROUP,
	DATABASE_ROLE_MEMBER_CHANGE_GROUP,
	FAILED_DATABASE_AUTHENTICATION_GROUP,
	SCHEMA_OBJECT_ACCESS_GROUP,
	SCHEMA_OBJECT_CHANGE_GROUP,
	SCHEMA_OBJECT_OWNERSHIP_CHANGE_GROUP,
	SCHEMA_OBJECT_PERMISSION_CHANGE_GROUP,
	SUCCESSFUL_DATABASE_AUTHENTICATION_GROUP,
	USER_CHANGE_PASSWORD_GROUP
	}

[Rupp29]

Reviewed. The enum changes make this update complicated. Not sure how to proceed.

[dcaro]

@sravanisaluru has the list of accepted values already been changed on the API?
What happens today if DATABASE_LOGOUT_GROUP value is passed?

[sravanisaluru]

This enum is it applicable for all like azure database azure synapse ? , for azure synapse today we support only 3 action groups so in the accepted values we cannot specify other action groups. but if this used across other services then it can break things. let me know how to proceed.

customer cannot pass other action groups as its not supported for synapse

[sravanisaluru]

this change is applicable only for synapse and it will fail if database_logout_group is passed as a parameter. i assume this update will not change anything for azuresql or MI. let me know if it can be updated only for synapse or will effect other services like azure sql or MI

…

On Tue, Jul 5, 2022 at 11:56 AM Damien Caro ***@***.***> wrote: @sravanisaluru <https://github.com/sravanisaluru> have the accepted values already been changed on the API? What happens today if DATABASE_LOGOUT_GROUP value is passed? — Reply to this email directly, view it on GitHub <#18839 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHMY2KSHEAXNTEKLSYF3CH3VSPIRHANCNFSM52IBLIHA> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[isra-fel]

Sorry for the late response @sravanisaluru
If the service only accepts 3 values, it makes sense to update the document. This is not a breaking change.
However I think this only solves part of the problem, as the parameter is sharing a enum definition with others, so it's still possible to pass in a value that is invalid.

I will merge this PR. Your next step should be to update the code to limit the options, either by defining a new enum with the three values, or validaing the input value using ValidateSetAttribute.

[isra-fel]

/azp run azure-powershell - security-tools

[azure-pipelines]

Azure Pipelines successfully started running 1 pipeline(s).