Azure resourcechanges missing KeyVault? - azure

I have to get the history of changes of the key in an Azure KeyVault, like updated expiry date via keyUpdate operation, for example.
Is there any way to get those changes? Are the KeyVault changes even stored by Azure?
Checked the resourcechanges table trough the ResourceGraphManager from the SDK and UI and there are no KeyVault entries at all.
Thanks.

Use the Azure CLI,
List of Key Vault keys will return the details of your keys.
If you want to see the versions of a key using it's ID fetched from above, Show key versions
Then if you want to see it's attributes, show key's details
First make sure you know the name of the Key Vault, have performed an az login and set the subscription az account set -s SUBSCRIPTION_ID

Related

Powershell command Azure automation

Need to fetch logic app primary and secondary access keys and store them in a variable in powershell cmdlet ,the requirement is to then update the key vault secret already holding the old versions of the access keys for that logic app and also is there a way to regenerate access keys with cmdlet
As far as I know, it is not possible to fetch the keys either through Portal or PowerShell, or CLI. If you are looking specifically to create a URL you can go with the below and this document also speaks about callback URl.
https://learn.microsoft.com/en-us/azure/logic-apps/logic-apps-securing-a-logic-app?tabs=azure-portal#generate-shared-access-signatures-sas

Azure key vault creation error: VaultAlreadyExists - I can't find the existing vault

I'm trying to create a key vault in Azure using this CLI command...
az keyvault create --location $location --name $keyVaultName --resource-group $resourceGroupMainName --output none
But this returns the error...
(VaultAlreadyExists) The vault name '[value of $keyVaultName]' is
already in use. Vault names are globaly unique so it is possible that
the name is already taken. If you are sure that the vault name was not
taken then it is possible that a vault with the same name was recently
deleted but not purged after being placed in a recoverable state. If
the vault is in a recoverable state then the vault will need to be
purged before reusing the name. For more information on soft delete
and purging a vault follow this link
https://go.microsoft.com/fwlink/?linkid=2147740.
So I ran both of these...
az keyvault list
az keyvault list-deleted
And $keyVaultName does not appear in either list. I've asked a colleague to double-check those results but it really doesn't appear. I've also looked in the Manage deleted vaults blade in the portal and that matches the results from the CLI - it's not there.
I also tried to recover the key vault with that name...
(DeletedVaultNotFound) The specified deleted vault '[value of $keyVaultName]' does not exist.
...and to purge a key vault with that name...
No deleted Vault or HSM was found with name [value of $keyVaultName]
So why does Azure think that the name is already in use?
I found an easier way, which is via UI, you can check if the deleted key vault is in the key vaults management page.
I am able to select and purge or recover deleted key vault after clicking the 'manage deleted vaults' hyperlink.
As provided in the comment, Similar to Storage Accounts in Azure, the keyvault is also unique across globally. You can check the similar error code from the docs,
Your attempt to create a new key vault with the specified name has
failed since the name is already in use. If you recently deleted a key
vault with this name, it may still be in the soft deleted state
Vault names and Managed HSM pool names are selected by the user and
are globally unique.
You can verify the existence using Powershell or Rest API
When you create an azure keyvault a soft delete feature is by default enabled which helps the customers to recover their keys and secrets which were accidentally deleted within 90days (default) and for that time period you cannot create another keyvault with the same name as that.
Once soft delete is enabled for Azure Key Vault you cannot disable the soft-delete as it's implemented as a one-way operation and cannot be changed back once enabled. However, You can use the PowerShell cmdlet Remove-AzureRmKeyVault command with the option -InRemovedState and by specifying the location of the deleted key vault with the -Location argument to permanently delete or purge the Azure Key Vault. If you want to permanently delete a key or secret you need to use Remove-AzureKeyVaultKey and Remove-AzureKeyVaultSecret with -InRemovedState parameter. Please refer to How to use Key Vault soft-delete with PowerShell for details.
You can also achieve the same using the Azure CLI. Refer to How to use Key Vault soft-delete with CLI for details.
First, I checked the deleted keyvault and purge which one is creating problem.
az keyvault list-deleted
az keyvault purge --name my-key-vault-dev01

How can I permanently purge an entire azure keyvault that's been created with soft delete enabled?

When you create an azure keyvault with soft delete enabled that keyvault persists even if you delete it and re-create it from scratch.
When soft-delete is enabled, resources marked as deleted resources are retained for a specified period (90 days by default). The service further provides a mechanism for recovering the deleted object, essentially undoing the deletion.
You also get this error message when you try and delete the keyvault though the UI:
The soft delete feature has been enabled on this key vault. After you
soft delete this key vault, it will remain in your subscription as a
hidden vault. It will get purged after the retention period you
specified. You may purge it sooner, or restore the vault, using Azure
Portal, Azure PowerShell, or Azure CLI. See this page for reference:
https://learn.microsoft.com/azure/key-vault/key-vault-ovw-soft-delete
This is causing me issues in dev. I created a keyvault with soft delete enabled (by accident) and now I want to completely remove that keyvault and re-create it with different settings. Everytime I delete it and re-create it, it includes all the previous settings, keys, etc. I also can't create a keyvault, with the same name, with soft delete disabled. It complains that a keyvault with that name already exists (VaultAlreadyExists exception) and that the settings are not compatible.
The keyvault docs on MSDN(the link from the above message in Azure) mention how to permanently purge a soft delete but it's slightly euphemistic sentence isn't that helpful to me:
Permanently deleting, purging, a key vault is possible via a POST
operation on the proxy resource and requires special privileges.
So how do I get rid of this thing?
First thing to note, as I've subsequently found out, is that soft delete will be enabled by default by any time now. So the disabling of soft delete is now effectively deprecated. But I still wanted to completely delete my keyvault.
After doing a bit of digging in the azure cli I stumbled across this command:
az keyvault purge --name
[--location]
[--no-wait]
[--subscription]
So providing you are logged in with a user that has enough privilages to run this you can permanatly delete the entire key vault using the command:
az keyvault purge --name keyvaultname
This permanently and irrevocably removes the keyvault, all it's keys and settings. There doesn't seem to be a way in the Azure UI to do this without using the CLI or some other tool. It seems this is supported in the UI as well now, see here:
Log in to the Azure portal.
Click on the search bar at the top of the page.
Under "Recent Services" click "Key Vault". Do not click an
individual key vault.
At the top of the screen click the option to "Manage deleted vaults"
A context pane will open on the right side of your screen.
Select your subscription.
If your key vault has been soft deleted it will appear in the
context pane on the right.
If there are too many vaults, you can either click "Load More" at
the bottom of the context pane or use CLI or PowerShell to get the
results.
Once you find the vault you wish to recover or purge, select the
checkbox next to it.
Select the recover option at the bottom of the context pane if you
would like to recover the key vault.
Select the purge option if you would like to permanently delete the
key vault.
You can also use Az PS.
As per previous answer, this is assuming you have sufficient permissions to the subscription:
Remove-AzKeyVault -VaultName kvname -InRemovedState -Force -Location "Location"
Please see this for reference:
https://learn.microsoft.com/en-us/powershell/module/az.keyvault/remove-azkeyvault?view=azps-5.7.0
Also, I used this reference to get the proper order of the parameters as I wasn't familiar with switch parameters and where they go.
https://github.com/Azure/azure-powershell/issues/14012

Azure function ZIP Deployment using terraform

I am looking to deploy Azure function by using Terraform, in the same way which is mentioned here in the Ms docs.
https://learn.microsoft.com/en-us/azure/azure-functions/deployment-zip-push
One of my need to store and Storage SAS key to Key Vault. I have seen some exmaple where we can below setting is used, but I can't use sas key without storing to Key Vault.
WEBSITE_RUN_FROM_ZIP = "https://${azurerm_storage_account.this.name}.blob.core.windows.net/${azurerm_storage_container.this.name}/${azurerm_storage_blob.this.name}${data.azurerm_storage_account_sas.this.sas}"
Any suggestion?
Thank you !
For this requirement, you can use the Key Vault reference to get the secrets to the Azure Function like this:
#Microsoft.KeyVault(SecretUri=https://myvault.vault.azure.net/secrets/mysecret/ec96f02080254f109c51a1f14cdb1931)
Or
#Microsoft.KeyVault(VaultName=myvault;SecretName=mysecret;SecretVersion=ec96f02080254f109c51a1f14cdb1931)
But this means only support system-assigned managed identities. So you need to enable the system-assigned managed identity and assign the right role of the Key Vault to it. Here is more details.

How to create key vault secret with multiple values in one secret?

I want to create a secret in the azure key vault which will be having multiple keys (like JSON).
e.g-
{
"storageAccountKey":"XXXXX",
"CognitiveServicesKey":"XXXX",
"XXXXXx":"XXXX",
}
is it possible to create?
And then by using PowerShell script, I want to update a particular key in the above-created secret with a new one. Please help me.
Yes, it is possible. You will need to upload the content of a file as a secret. It can be done via the Azure CLI as follow:
az keyvault secret set --name [SECRET-NAME] --vault-name [VAULT_NAME] --file C:\path\to\file.txt --subscription [AZURE-SUBSCRIPTION-ID]
If we will do that....it will reduce large number of calls to the KeyVault services.
I didn't understand how it will be a security threat if we use multiple keys in single secret.

Resources