Skip to content

[Security] az security va sql: Migrate to aaz with API 2026-04-01-preview#33482

Open
GalGoldi72 wants to merge 3 commits into
Azure:devfrom
GalGoldi72:feature-security-aaz
Open

[Security] az security va sql: Migrate to aaz with API 2026-04-01-preview#33482
GalGoldi72 wants to merge 3 commits into
Azure:devfrom
GalGoldi72:feature-security-aaz

Conversation

@GalGoldi72
Copy link
Copy Markdown

@GalGoldi72 GalGoldi72 commented Jun 2, 2026

Summary

[BREAKING CHANGE] Migrates az security va sql from hand-authored SDK-based commands to atomic aaz-generated commands targeting Microsoft.Security 2026-04-01-preview.

Companion PRs

Breaking changes

Before After
--vm-resource-id + --workspace-id + --server-name + --database-name + --vm-name + --agent-id + --vm-uuid (mash-up of 7 args) Single --resource-id (plus optional --database-name for server-level scopes)
az security va sql baseline set az security va sql baseline add

The 7-arg approach hard-coded resource-id assembly for two scopes (Azure VM and OMS-monitored on-prem). The new API natively supports 7+ scopes via a generic --resource-id.

New commands

Group Commands
security va sql create, delete, show, update (manage settings)
security va sql baseline add, create, delete, list, show, update
security va sql results list, show
security va sql scans initiate-scan, list, show
security va sql scans scan-operation-result show

Scopes supported

  • Azure SQL Server / SQL Managed Instance
  • Synapse Workspace
  • Azure VM (SQL on VM)
  • Arc-enabled SQL Server
  • Server-level variants of each (with --database-name)

Stage

All new commands are Preview (matching API version 2026-04-01-preview). The parent security va group is also Preview since SQL VA is its only content.

Diff summary

  • +28 generated aaz files under security/aaz/latest/security/va/
  • −799 lines of hand-authored code across commands.py, custom.py, _help.py, _params.py, actions.py, _client_factory.py
  • −1 test file + recording (test_va_sql_scenario.py + YAML)

Validation

  • azdev style security: 9.88/10 (only pre-existing line-too-long in unrelated custom.py automation code; score improved from baseline)
  • azdev linter security: PASSED
  • azdev test security: 30 passed, 1 skipped, 0 failed — zero regressions in other security commands

TODO (this PR, before merge)

  • Add a new scenario test for security va sql commands (placeholder — see PR comments for design)
  • Test recording with LiveScenarioTest against a real Azure SQL DB or recorded ScenarioTest with playback

@GalGoldi72
[Security] az security va sql: Migrate to aaz with API 2026-04-01-pre…
f08ec1f 
…view

[BREAKING CHANGE] Replace hand-authored SQL Vulnerability Assessment commands with atomic aaz-generated commands.

- Single --resource-id replaces 7-arg combo (--vm-resource-id, --workspace-id, --server-name, --database-name, --vm-name, --agent-id, --vm-uuid).
- New 'security va sql {create, delete, show, update}' settings commands.
- New 'security va sql baseline {add, create, update}' (replaces 'set').
- New 'security va sql scans initiate-scan' + 'scan-operation-result show'.
- All commands tagged Preview.

Supported scopes: Azure SQL Server, Azure SQL MI, Synapse, Azure VM (SQL on VM), Arc-enabled SQL Server.

Companion aaz PR: Azure/aaz#1021

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings June 2, 2026 14:08
@azure-client-tools-bot-prd
Copy link
Copy Markdown

azure-client-tools-bot-prd Bot commented Jun 2, 2026

Validation for Azure CLI Full Test Starting...

Thanks for your contribution!

@azure-client-tools-bot-prd
Copy link
Copy Markdown

azure-client-tools-bot-prd Bot commented Jun 2, 2026

Validation for Breaking Change Starting...

Thanks for your contribution!

Copilot AI reviewed Jun 2, 2026
View reviewed changes
Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

This PR migrates az security va sql (SQL Vulnerability Assessment) from hand-authored command implementations to AAZ-generated atomic commands targeting 2026-04-01-preview, removing the legacy SDK wiring, custom argument actions, help entries, and live scenario tests.

Changes:

  • Replace legacy security va sql commands (custom.py/commands.py/_params.py/_help.py/_client_factory.py) with AAZ-generated command implementations under aaz/latest/security/va/sql/....
  • Introduce new command surface (va sql create/show/update/delete, scans initiate-scan, scans scan-operation-result show, and baseline add/create/update).
  • Remove the legacy live scenario test and its recording for test_va_sql_scenario.

Reviewed changes

Copilot reviewed 37 out of 37 changed files in this pull request and generated 6 comments.

Show a summary per file
File Description
src/azure-cli/azure/cli/command_modules/security/tests/latest/test_va_sql_scenario.py Removes legacy live scenario coverage for VA SQL commands.
src/azure-cli/azure/cli/command_modules/security/tests/latest/recordings/test_va_sql_scenario.yaml Removes recorded HTTP interactions for the deleted scenario.
src/azure-cli/azure/cli/command_modules/security/custom.py Deletes hand-authored VA SQL command implementations and related imports.
src/azure-cli/azure/cli/command_modules/security/commands.py Removes legacy VA SQL command groups and SDK command types wiring.
src/azure-cli/azure/cli/command_modules/security/actions.py Removes baseline argparse actions used by legacy VA SQL baseline commands.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/scans/scan_operation_result/_show.py Adds AAZ command to show scan operation result by operation id.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/scans/scan_operation_result/init.py Exposes the scan-operation-result command group commands.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/scans/scan_operation_result/__cmd_group.py Registers the scan-operation-result command group.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/scans/_show.py Adds AAZ command to show a single scan record.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/scans/_list.py Adds AAZ command to list scan records with pagination support.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/scans/_initiate_scan.py Adds AAZ command to initiate a scan (LRO/no-wait).
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/scans/init.py Exposes the scans command group commands.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/scans/__cmd_group.py Registers the scans command group.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/results/_show.py Adds AAZ command to show a single scan result.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/results/_list.py Adds AAZ command to list scan results with pagination support.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/results/init.py Exposes the results command group commands.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/results/__cmd_group.py Registers the results command group.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/baseline/_update.py Adds AAZ command to update a baseline rule (generic update flow).
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/baseline/_show.py Adds AAZ command to show a baseline rule.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/baseline/_list.py Adds AAZ command to list baseline rules with pagination support.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/baseline/_delete.py Adds AAZ command to delete a baseline rule with confirmation prompt.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/baseline/_create.py Adds AAZ command to create/replace a baseline rule.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/baseline/_add.py Adds AAZ command to set/replace baseline rules collection (POST).
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/baseline/init.py Exposes the baseline command group commands.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/baseline/__cmd_group.py Registers the baseline command group.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/_update.py Adds AAZ command to update VA SQL settings (generic update flow).
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/_show.py Adds AAZ command to show VA SQL settings.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/_delete.py Adds AAZ command to delete VA SQL settings with confirmation prompt.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/_create.py Adds AAZ command to create VA SQL settings.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/init.py Exposes security va sql commands.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/__cmd_group.py Registers the security va sql command group.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/init.py Exposes the security va command group.
src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/__cmd_group.py Registers the security va command group.
src/azure-cli/azure/cli/command_modules/security/_params.py Removes legacy VA SQL parameters/actions; relies on AAZ args schemas.
src/azure-cli/azure/cli/command_modules/security/_help.py Removes legacy hand-authored help for VA SQL commands.
src/azure-cli/azure/cli/command_modules/security/_client_factory.py Removes legacy VA SQL client factories.
src/azure-cli/HISTORY.rst Documents the breaking changes and new AAZ-based command surface.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comment thread src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/results/_show.py
Comment on lines +61 to +65
_args_schema.scan_result_id = AAZStrArg(
options=["--scan-result-id"],
help="The rule Id of the results.",
required=True,
)
Comment thread src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/baseline/_create.py
Comment on lines +69 to +78
_args_schema.latest_scan = AAZBoolArg(
options=["--latest-scan"],
arg_group="Resource",
help="Take results from latest scan.",
)
_args_schema.results = AAZListArg(
options=["--results"],
arg_group="Resource",
help="Expected results to be inserted into the baseline. Leave this field empty if latestScan == true.",
)
Comment thread src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/baseline/_add.py
Comment on lines +14 to +19
@register_command(
"security va sql baseline add",
is_preview=True,
)
class Add(AAZCommand):
"""Set a list of baseline rules. Will overwrite any previously existing results (for all rules).
Comment thread src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/baseline/_update.py Outdated
Comment on lines +95 to +103
def _execute_operations(self):
self.pre_operations()
self.SqlVulnerabilityAssessmentBaselineRulesGet(ctx=self.ctx)()
self.pre_instance_update(self.ctx.vars.instance)
self.InstanceUpdateByJson(ctx=self.ctx)()
self.InstanceUpdateByGeneric(ctx=self.ctx)()
self.post_instance_update(self.ctx.vars.instance)
self.SqlVulnerabilityAssessmentBaselineRulesCreateOrUpdate(ctx=self.ctx)()
self.post_operations()
Comment thread src/azure-cli/azure/cli/command_modules/security/aaz/latest/security/va/sql/baseline/_add.py Outdated
Comment on lines +24 to +25
:example: Set baseline for multiple rules with explicit results on a SQL DB hosted on an Azure VM.
az security va sql baseline add --resource-id /subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Compute/virtualMachines/{vm} --database-name MyDb --results "{VA1234:[[col1,col2],[col3,col4]],VA5678:[[user1,SELECT]]}"
Comment thread src/azure-cli/HISTORY.rst Outdated
Comment on lines +97 to +99
* `az security va sql`: [BREAKING CHANGE] Replaced hand-authored SQL Vulnerability Assessment commands with atomic aaz-generated commands targeting API version `2026-04-01-preview`. A single `--resource-id` argument now identifies the assessed resource, replacing the previous combination of `--vm-resource-id`, `--workspace-id`, `--server-name`, `--database-name`, `--vm-name`, `--agent-id`, and `--vm-uuid`. Optional `--database-name` is used only for server-level scopes (e.g. `master`). Supported scopes include Azure SQL Server, Azure SQL Managed Instance, Synapse, Azure VM (SQL on VM), and Arc-enabled SQL servers.
* `az security va sql`: Add new SQL Vulnerability Assessment settings commands: `create`, `delete`, `show`, `update` for enabling/disabling SQL VA on a resource.
* `az security va sql baseline`: Add `add` (set baseline for all rules), `create` (single-rule baseline), and `update` commands. Remove `set` command (use `add` instead).
GalGoldi72 added a commit to GalGoldi72/aaz that referenced this pull request Jun 2, 2026
@GalGoldi72
[Security] Add --rule-id alias to security va sql results show
b751eb4 
Adds `rule-id` as a primary option for the scanResultId argument on
`az security va sql results show`, with `scan-result-id` kept as a
secondary alias. This aligns with the `baseline` commands which use
`--rule-id` for the same logical concept and matches Copilot review
feedback on Azure/azure-cli#33482.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
GalGoldi72 and others added 2 commits June 2, 2026 21:41
@GalGoldi72
[Security] az security va sql: Address PR feedback
c699974 
Addresses Copilot review comments on Azure#33482:

- `security va sql results show`: Accept both `--rule-id`
  (preferred, consistent with `baseline` commands) and
  `--scan-result-id` (alias). Examples updated to use `--rule-id`.
- `security va sql baseline add/create/update`: Reject mutually
  exclusive `--latest-scan` and `--results` arguments with a
  clear error message, matching the legacy behavior.
- `security va sql baseline set`: Re-added as a deprecated alias of
  `baseline add` for backwards compatibility with the legacy CLI.
- `security va sql baseline update`: Behaves as a true upsert -- if
  no baseline exists yet for the specified rule, an empty instance is
  initialized so the subsequent PUT creates one (instead of 404).
- `security va sql baseline add`: Fixed example to use valid JSON
  for the `--results` argument.
- HISTORY.rst updated to document the rule-id alias, deprecated `set`
  alias, and upsert behavior of `baseline update`.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
@GalGoldi72
[Security] Remove security va sql baseline update
160a1b0 
The AAZ-generated `update` command uses the standard GET -> patch instance ->
PUT flow. The Microsoft.Security
`sqlVulnerabilityAssessments/default/baselineRules` service has an asymmetric
request/response shape: PUT accepts only a flat `{ latestScan, results }` body,
but GET returns the ARM-canonical `{ properties: { latestScan, results }, ... }`
shape. The generic-update flow therefore PUTs a mixed payload that the service
rejects with `400 UnsupportedProperties: 'properties'`.

Verified directly against the live API:
  PUT { latestScan: true }                  -> 200 OK
  PUT { properties: { latestScan: true } }  -> 400 UnsupportedProperties

Because `baseline create` is the same PUT endpoint and is a full upsert,
removing `update` does not reduce functionality.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot Copilot left review comments

@necusjz necusjz Awaiting requested review from necusjz necusjz is a code owner

@DanielMicrosoft DanielMicrosoft Awaiting requested review from DanielMicrosoft DanielMicrosoft is a code owner

@yonzhan yonzhan Awaiting requested review from yonzhan yonzhan is a code owner

@bebound bebound Awaiting requested review from bebound bebound is a code owner

@jiasli jiasli Awaiting requested review from jiasli jiasli is a code owner

@evelyn-ys evelyn-ys Awaiting requested review from evelyn-ys

@calvinhzy calvinhzy Awaiting requested review from calvinhzy

@jsntcy jsntcy Awaiting requested review from jsntcy

At least 1 approving review is required to merge this pull request.

Assignees

@evelyn-ys evelyn-ys

Labels

act-codegen-extensibility-squad Auto-Assign Auto assign by bot SQL az sql Synapse

Projects

None yet

Milestone

July 2026 (2026-07-07)

Development

Successfully merging this pull request may close these issues.

3 participants

@GalGoldi72 @evelyn-ys