feat(graph): add ManagedHSM (#15)

docs/analysis/arm-nodes/keyvault/managed-hsm.md

@@ -0,0 +1,31 @@
+# ManagedHSM
+
+Represents Azure Key Vault Managed HSM resources.
+
+**Labels:** `:ManagedHSM`
+
+**Properties:**
+
+- `id` - Managed HSM resource ID (primary key)
+- `enablePurgeProtection` - Whether purge protection is enabled
+- `enableSoftDelete` - Whether soft delete is enabled
+- `hsmUri` - Managed HSM URI
+- `publicNetworkAccess` - Public network access setting
+- `activationStatus` - Security domain activation status
+- `activationStatusMessage` - Security domain activation status message
+- `softDeleteRetentionInDays` - Soft delete retention period
+- `statusMessage` - Service status message
+
+## Relationships
+
+### Incoming
+
+- **GraphObject** → `IS_ADMIN` → **ManagedHSM** - Directory object configured as initial HSM administrator
+
+## Examples
+
+```cypher
+// Find Managed HSM resources and their administrators
+MATCH (go:GraphObject)-[:IS_ADMIN]->(hsm:ManagedHSM)
+RETURN hsm.id, hsm.hsmUri, go.id
+```

docs/analysis/edges/is-admin.md

@@ -4,11 +4,12 @@ Represents an administrative relationship where a principal administers a target
 
 ## Usage
 
-This relationship is used to connect principals to Analysis Services servers they administer:
+This relationship is used to connect principals to resources they administer:
 
 - **GraphServicePrincipal** → `IS_ADMIN` → **AnalysisServiceServer** - Service principal administrator
 - **GraphObject** → `IS_ADMIN` → **AnalysisServiceServer** - Object-based administrator reference
 - **GraphUser** → `IS_ADMIN` → **AnalysisServiceServer** - User administrator
+- **GraphObject** → `IS_ADMIN` → **ManagedHSM** - Initial Managed HSM administrator
 
 ## Properties
 
@@ -20,4 +21,8 @@ No additional properties on the relationship.
 // Find principals that administer Analysis Services servers
 MATCH (p)-[:IS_ADMIN]->(s:AnalysisServiceServer)
 RETURN labels(p), p, s.serverFullName
+
+// Find GraphObjects that administer Managed HSM resources
+MATCH (go:GraphObject)-[:IS_ADMIN]->(hsm:ManagedHSM)
+RETURN go.id, hsm.id, hsm.hsmUri
 ```

mkdocs.yml

@@ -147,6 +147,7 @@ nav:
           - analysis/arm-nodes/insights/activity-log-alert.md
         - Key Vault:
           - analysis/arm-nodes/keyvault/keyvault.md
+          - analysis/arm-nodes/keyvault/managed-hsm.md
         - Network:
           - analysis/arm-nodes/network/bastion-host.md
           - analysis/arm-nodes/network/dns-zone.md

src/graph/config/azure/arm/keyvault/managed_hsm.tera.yaml

@@ -0,0 +1,28 @@
+name: "Key Vault Managed HSMs"
+label: "{{ LABELS.ManagedHSM }}"
+table_name: "resources"
+resource_type: "microsoft.keyvault/managedhsms"
+properties:
+  - "/id"
+  - "/properties"
+index_properties:
+  - "{{ LABELS.ManagedHSM }}:hsmUri"
+cypher: |
+  UNWIND $batch AS row
+  MERGE (obj:{{ LABELS.ManagedHSM }} {id: toLower(row.id)})
+  SET obj += {
+      enablePurgeProtection: row.properties.enablePurgeProtection,
+      enableSoftDelete: row.properties.enableSoftDelete,
+      hsmUri: row.properties.hsmUri,
+      publicNetworkAccess: row.properties.publicNetworkAccess,
+      activationStatus: row.properties.securityDomainProperties.activationStatus,
+      activationStatusMessage: row.properties.securityDomainProperties.activationStatusMessage,
+      softDeleteRetentionInDays: row.properties.softDeleteRetentionInDays,
+      statusMessage: row.properties.statusMessage
+  }
+
+  CALL (obj, row) {
+    UNWIND coalesce(row.properties.initialAdminObjectIds, []) AS adminId
+    MERGE (go:{{ LABELS.GraphObject }} {id: toLower(adminId)})
+    MERGE (go)-[:{{ REL.IS_ADMIN }}]->(obj)
+  }

src/graph/config/constants.yaml

@@ -137,6 +137,7 @@ LABELS:
   KeyVaultCertificate: "KeyVaultCertificate"
   KeyVaultCertificateValue: "KeyVaultCertificateValue"
   ManagementGroup: "ManagementGroup"
+  ManagedHSM: "ManagedHSM"
   MLWorkspace: "MLWorkspace"
   NetAppAccount: "NetAppAccount"
   NetAppCapacityPool: "NetAppCapacityPool"