DataMigration Security Fix

src/DataMigration/DataMigration.Autorest/Properties/AssemblyInfo.cs

@@ -20,7 +20,7 @@
 [assembly: System.Reflection.AssemblyCopyrightAttribute("Copyright © Microsoft")]
 [assembly: System.Reflection.AssemblyProductAttribute("Microsoft Azure PowerShell")]
 [assembly: System.Reflection.AssemblyTitleAttribute("Microsoft Azure PowerShell - DataMigration")]
-[assembly: System.Reflection.AssemblyFileVersionAttribute("1.0.0")]
-[assembly: System.Reflection.AssemblyVersionAttribute("1.0.0")]
+[assembly: System.Reflection.AssemblyFileVersionAttribute("1.1.0")]
+[assembly: System.Reflection.AssemblyVersionAttribute("1.1.0")]
 [assembly: System.Runtime.InteropServices.ComVisibleAttribute(false)]
 [assembly: System.CLSCompliantAttribute(false)]

src/DataMigration/DataMigration.Autorest/UX/Microsoft.Sql/servers-databaseMigrations.json

@@ -0,0 +1,52 @@
+{
+  "resourceType": "servers/databaseMigrations",
+  "apiVersion": "2025-06-30",
+  "learnMore": {
+    "url": "https://learn.microsoft.com/powershell/module/az.datamigration"
+  },
+  "commands": [
+    {
+      "name": "Invoke-AzDataMigrationRetryToSqlDb",
+      "description": "Retry on going migration for the database.",
+      "path": "/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.Sql/servers/{sqlDbInstanceName}/providers/Microsoft.DataMigration/databaseMigrations/{targetDbName}/retry",
+      "help": {
+        "learnMore": {
+          "url": "https://learn.microsoft.com/powershell/module/az.datamigration/invoke-azdatamigrationretrytosqldb"
+        },
+        "parameterSets": [
+          {
+            "parameters": [
+              "-ResourceGroupName <String>",
+              "-SqlDbInstanceName <String>",
+              "[-SubscriptionId <String>]",
+              "-TargetDbName <String>"
+            ]
+          }
+        ]
+      },
+      "examples": [
+        {
+          "description": "Retry on going migration for the database.",
+          "parameters": [
+            {
+              "name": "-ResourceGroupName",
+              "value": "[Path.resourceGroupName]"
+            },
+            {
+              "name": "-SqlDbInstanceName",
+              "value": "[Path.sqlDbInstanceName]"
+            },
+            {
+              "name": "-SubscriptionId",
+              "value": "[Path.subscriptionId]"
+            },
+            {
+              "name": "-TargetDbName",
+              "value": "[Path.targetDbName]"
+            }
+          ]
+        }
+      ]
+    }
+  ]
+}

src/DataMigration/DataMigration.Autorest/custom/Cmdlets/Get-AzDataMigrationAssessment.ps1

@@ -93,29 +93,25 @@ function Get-AzDataMigrationAssessment
             #Running Assessment
             if(('CommandLine') -contains $PSCmdlet.ParameterSetName)
             {
-                if(($PSBoundParameters.ContainsKey("OutputFolder")))
-                {
-                    if($PSBoundParameters.ContainsKey("Overwrite"))
-                    {
-                        & $ExePath Assess --sqlConnectionStrings $PSBoundParameters.ConnectionString --outputFolder $PSBoundParameters.OutputFolder; 
-                    }
-                    else
-                    {
-                        & $ExePath Assess --sqlConnectionStrings $PSBoundParameters.ConnectionString --outputFolder $PSBoundParameters.OutputFolder --overwrite False;
-
-                    }
+                # Use a secure temp config file to avoid exposing secrets in command-line arguments
+                $configParams = [ordered]@{
+                    action = "Assess"
+                    sqlConnectionStrings = $PSBoundParameters.ConnectionString
+                }
+
+                if ($PSBoundParameters.ContainsKey('OutputFolder')) {
+                    $configParams['outputFolder'] = $PSBoundParameters.OutputFolder
+                }
+                if (-not $PSBoundParameters.ContainsKey('Overwrite')) {
+                    $configParams['overwrite'] = "False"
+                }
+
+                $configFilePath = . "$PSScriptRoot/../../utils/New-SecureConfigFile.ps1" $configParams
+                try {
+                    & $ExePath --configFile $configFilePath
+                } finally {
+                    Remove-Item -Path $configFilePath -Force -ErrorAction SilentlyContinue
                 }
-                else
-                {
-                    if(($PSBoundParameters.ContainsKey("Overwrite")))
-                    {
-                        & $ExePath Assess --sqlConnectionStrings $PSBoundParameters.ConnectionString;
-                    }
-                    else 
-                    {
-                        & $ExePath Assess --sqlConnectionStrings $PSBoundParameters.ConnectionString --overwrite False;
-                    }
-                } 
             }
             else
             {   

src/DataMigration/DataMigration.Autorest/custom/Cmdlets/Get-AzDataMigrationPerformanceDataCollection.ps1

@@ -101,72 +101,37 @@ function Get-AzDataMigrationPerformanceDataCollection
             #Collecting performance data
             if(('CommandLine') -contains $PSCmdlet.ParameterSetName)
             {
-                # The array list $splat contains all the parameters that will be passed to '.\SqlAssessment.exe PerfDataCollection'
-                [System.Collections.ArrayList] $splat = @(
-                '--sqlConnectionStrings', $SqlConnectionStrings
-                '--outputfolder', $OutputFolder
-                '--perfQueryIntervalInSec', $PerfQueryInterval
-                '--staticQueryIntervalInSec', $StaticQueryInterval
-                '--numberOfIterations', $NumberOfIterations
-                )
-
-                # Removing the parameters for which the user did not provide any values
-                for($i = $splat.Count-1; $i -gt -1; $i = $i-2)
-                { 
-                   $currVal = $splat[$i]
-                    if($currVal -ne "")
-                    {
+                # Use a secure temp config file to avoid exposing secrets in command-line arguments
+                $configParams = [ordered]@{
+                    action = "PerfDataCollection"
+                    sqlConnectionStrings = $SqlConnectionStrings
+                }
 
-                    }
-                    else {
-                        $splat.RemoveAt($i)
-                        $i2 = $i -1
-                        $splat.RemoveAt($i2)
-                    }                     
+                if ($PSBoundParameters.ContainsKey('OutputFolder') -and $OutputFolder -ne "") {
+                    $configParams['outputfolder'] = $OutputFolder
                 }
-
-                # Running PerfDataCollection
-                If($PSBoundParameters.ContainsKey("Time"))
-                {   
-                    #this is used to create a json file in case the perf collection is to be time based
-                    $jsonHash = [Ordered]@{
-                    'action' = "PerfDataCollection"
-                    'sqlConnectionStrings'= $SqlConnectionStrings
-                    'outputfolder'= $OutputFolder
-                    'perfQueryIntervalInSec'= $PerfQueryInterval
-                    'staticQueryIntervalInSec'= $StaticQueryInterval
-                    'numberOfIterations'= $NumberOfIterations
-                    }
-                    # removing empty key,value pairs from $jsonHash
-                    if($OutputFolder -eq "")
-                    {
-                        $jsonHash.Remove('outputfolder')
-                    }
-                    if($PerfQueryInterval -eq "")
-                    {
-                        $jsonHash.Remove('perfQueryIntervalInSec')
-                    }
-                    if($StaticQueryInterval -eq "")
-                    {
-                        $jsonHash.Remove('staticQueryIntervalInSec')
+                if ($PSBoundParameters.ContainsKey('PerfQueryInterval') -and $PerfQueryInterval -ne "") {
+                    $configParams['perfQueryIntervalInSec'] = $PerfQueryInterval
+                }
+                if ($PSBoundParameters.ContainsKey('StaticQueryInterval') -and $StaticQueryInterval -ne "") {
+                    $configParams['staticQueryIntervalInSec'] = $StaticQueryInterval
+                }
+                if ($PSBoundParameters.ContainsKey('NumberOfIterations') -and $NumberOfIterations -ne "") {
+                    $configParams['numberOfIterations'] = $NumberOfIterations
+                }
+
+                $configFilePath = . "$PSScriptRoot/../../utils/New-SecureConfigFile.ps1" $configParams
+                try {
+                    if ($PSBoundParameters.ContainsKey("Time")) {
+                        $pro = Start-Process -FilePath $ExePath -ArgumentList "--configFile ""$configFilePath""" -PassThru -NoNewWindow
+                        Start-Sleep -Seconds $Time
+                        $pro | Stop-Process
+                    } else {
+                        & $ExePath --configFile $configFilePath
                     }
-                    if($NumberOfIterations -eq "")
-                    {
-                        $jsonHash.Remove('numberOfIterations')
-                    } 
-
-                    $saveAt = Join-Path -Path $DefaultOutputFolder -ChildPath Downloads;
-                    $saveas = Join-Path -Path $saveAt -ChildPath "tempConfigFileForPerf.json"
-                    $jsonHash | ConvertTo-Json -depth 100 | Set-Content $saveas
-                    $pro = Start-Process -FilePath $ExePath -ArgumentList "--configFile ""$saveas"""  -PassThru -NoNewWindow
-                    Start-Sleep -Seconds $Time
-                    $pro | stop-process  
-                    Remove-Item -Path $saveas       
+                } finally {
+                    Remove-Item -Path $configFilePath -Force -ErrorAction SilentlyContinue
                 }
-                else
-                {
-                    & $ExePath PerfDataCollection @splat
-                }                 
             }
             else
             {   

src/DataMigration/DataMigration.Autorest/custom/Cmdlets/New-AzDataMigrationLoginsMigration.ps1

@@ -137,36 +137,36 @@ function New-AzDataMigrationLoginsMigration
             #Collecting data
             if(('CommandLine') -contains $PSCmdlet.ParameterSetName)
             {
-                # The array list $splat contains all the parameters that will be passed to '.\Microsoft.SqlServer.Migration.Logins.ConsoleApp.exe LoginsMigration'
-
+                # Use a secure temp config file to avoid exposing secrets in command-line arguments
                 $LoginsListArray = $($ListOfLogin -split " ")
-                [System.Collections.ArrayList] $splat = @(
-                    '--sourceSqlConnectionString', $SourceSqlConnectionString
-                    '--targetSqlConnectionString', $TargetSqlConnectionString
-                    '--csvFilePath', $CSVFilePath
-                    '--listOfLogin', $LoginsListArray
-                    '--outputFolder', $OutputFolder
-                    '--aadDomainName', $AADDomainName
-                )
-                # Removing the parameters for which the user did not provide any values
-                for($i = $splat.Count-1; $i -gt -1; $i = $i-2)
-                {
-                    $currVal = $splat[$i]
-                    if($currVal -ne "")
-                    {
-                    }
-                    else {
-                        $splat.RemoveAt($i)
-                        $i2 = $i -1
-                        $splat.RemoveAt($i2)
-
-                    }                       
+                $configParams = [ordered]@{
+                    action = "LoginsMigration"
+                    sourceSqlConnectionString = $SourceSqlConnectionString
+                    targetSqlConnectionString = $TargetSqlConnectionString
+                }
+
+                if ($PSBoundParameters.ContainsKey('CSVFilePath') -and $CSVFilePath -ne "") {
+                    $configParams['csvFilePath'] = $CSVFilePath
+                }
+                if ($PSBoundParameters.ContainsKey('ListOfLogin') -and $ListOfLogin -ne "") {
+                    $configParams['listOfLogin'] = $LoginsListArray
+                }
+                if ($PSBoundParameters.ContainsKey('OutputFolder') -and $OutputFolder -ne "") {
+                    $configParams['outputFolder'] = $OutputFolder
+                }
+                if ($PSBoundParameters.ContainsKey('AADDomainName') -and $AADDomainName -ne "") {
+                    $configParams['aadDomainName'] = $AADDomainName
                 }
 
                 $ExePath = Join-Path -Path $LatestNugetFolder -ChildPath $ExePath;
-                # Running LoginsMigration
-                Write-Host "Starting Execution..."
-                & $ExePath LoginsMigration @splat
+                $configFilePath = . "$PSScriptRoot/../../utils/New-SecureConfigFile.ps1" $configParams
+                try {
+                    # Running LoginsMigration
+                    Write-Host "Starting Execution..."
+                    & $ExePath --configFile $configFilePath
+                } finally {
+                    Remove-Item -Path $configFilePath -Force -ErrorAction SilentlyContinue
+                }
             }
             else
             {   

src/DataMigration/DataMigration.Autorest/custom/Cmdlets/New-AzDataMigrationSqlServerSchema.ps1

@@ -144,30 +144,26 @@ function New-AzDataMigrationSqlServerSchema
             #Collecting data
             if($PSCmdlet.ParameterSetName -eq 'CommandLine')
             {   
-                # The array list $splat contains all the parameters that will be passed to '.\SqlSchemaMigration.exe'
-                [System.Collections.ArrayList] $splat = @(
-                    '--sourceConnectionString', $SourceConnectionString
-                    '--targetConnectionString', $TargetConnectionString
-                    '--inputScriptFilePath', $InputScriptFilePath
-                    '--outputFolder', $OutputFolder
-                )
-
-                # Removing the parameters for which the user did not provide any values
-                for($i = $splat.Count-1; $i -gt -1; $i = $i-2)
-                {
-                    $currVal = $splat[$i]
-                    if($currVal -ne "")
-                    {
-                    }
-                    else {
-                        $splat.RemoveAt($i)
-                        $i2 = $i -1
-                        $splat.RemoveAt($i2)
-
-                    }                       
+                # Use a secure temp config file to avoid exposing secrets in command-line arguments
+                $configParams = [ordered]@{
+                    action = $Action
+                    sourceConnectionString = $SourceConnectionString
+                    targetConnectionString = $TargetConnectionString
+                }
+
+                if ($PSBoundParameters.ContainsKey('InputScriptFilePath') -and $InputScriptFilePath -ne "") {
+                    $configParams['inputScriptFilePath'] = $InputScriptFilePath
+                }
+                if ($PSBoundParameters.ContainsKey('OutputFolder') -and $OutputFolder -ne "") {
+                    $configParams['outputFolder'] = $OutputFolder
+                }
+
+                $configFilePath = . "$PSScriptRoot/../../utils/New-SecureConfigFile.ps1" $configParams
+                try {
+                    & $ExePath --configFile $configFilePath
+                } finally {
+                    Remove-Item -Path $configFilePath -Force -ErrorAction SilentlyContinue
                 }
-                # Running Action                
-                & $ExePath $Action @splat
             }
             else
             {   

src/DataMigration/DataMigration.Autorest/custom/Cmdlets/New-AzDataMigrationTdeCertificateMigration.ps1

@@ -196,8 +196,17 @@ function New-AzDataMigrationTdeCertificateMigration
                 return
             }
 
+            $ExePath = Join-Path -Path $LatestNugetFolder -ChildPath $ExePath;
+
+            # NOTE: The TDE Console App does not support --configFile, so credentials must be
+            # passed as command-line arguments. This is a known limitation - secrets may be
+            # visible in process telemetry (Event ID 4688, Sysmon). Plaintext variables are
+            # cleared immediately after use to minimize in-memory exposure.
             $SourceSqlConnectionStringParam = . "$PSScriptRoot/../../utils/Unprotect-SecureString.ps1" $SourceSqlConnectionString
-            $NetworkSharePasswordParam = . "$PSScriptRoot/../../utils/Unprotect-SecureString.ps1" $NetworkSharePassword
+            $NetworkSharePasswordParam = ""
+            if ($PSBoundParameters.ContainsKey('NetworkSharePassword')) {
+                $NetworkSharePasswordParam = . "$PSScriptRoot/../../utils/Unprotect-SecureString.ps1" $NetworkSharePassword
+            }
 
             [System.Collections.ArrayList] $parameterArray = @(
                 "--sourceSqlConnectionString", $SourceSqlConnectionStringParam,
@@ -212,12 +221,18 @@ function New-AzDataMigrationTdeCertificateMigration
                 "--databaseName"
             )
 
-            $ExePath = Join-Path -Path $LatestNugetFolder -ChildPath $ExePath;
             foreach($Name in $DatabaseName) {
                 $parameterArray.Add($Name) | Out-Null;
             }
 
-            & $ExePath $parameterArray
+            try {
+                & $ExePath $parameterArray
+            } finally {
+                # Clear plaintext secrets from memory
+                $SourceSqlConnectionStringParam = $null
+                $NetworkSharePasswordParam = $null
+                $parameterArray = $null
+            }
 
             if($PSBoundParameters.ContainsKey("PassThru"))
             {

src/DataMigration/DataMigration.Autorest/docs/Az.DataMigration.md

@@ -1,6 +1,6 @@
 ---
 Module Name: Az.DataMigration
-Module Guid: f79aec38-81ce-4472-8da4-c1da574b41d2
+Module Guid: b92b8d4e-0b2d-4276-b447-254c17b97d3a
 Download Help Link: https://learn.microsoft.com/powershell/module/az.datamigration
 Help Version: 1.0.0.0
 Locale: en-US

src/DataMigration/DataMigration.Autorest/generate-info.json

@@ -1,3 +1,3 @@
 {
-  "generate_Id": "ff05d861-a3e2-4daf-be3e-6ad389d8ed28"
+  "generate_Id": "0df0b1e5-2b43-42e9-9bba-c1097b647850"
 }