1

我编写了一个 PowerShell 5.1 脚本，用于从启用了软删除的 Azure Key Vault 中删除机密。我了解到，要成功清除此类 Key Vault 中的机密，您必须：

  1. 删除秘密。
  2. 再次删除密钥，这次指定 -InRemovedState 参数。

我的脚本是：

[CmdletBinding()]
Param(
    [Parameter(Mandatory = $True)]
    [string]$keyvaultName
)

#Remove assorted security items from Key Vault

# Shut up blather about deprecated features
 Set-Item -Path Env:\SuppressAzurePowerShellBreakingChangeWarnings -Value 'true'

Write-Output "Starting Removal"

### Remove Secrets
$secrets = Get-AzKeyVaultSecret -VaultName $keyvaultName

### Delete the secrets

foreach ($secret in $secrets) {
   Write-Output "Removing $($secret.Name)"
   Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Name -Force | Wait-Process

   if($?) {
      Write-Host "Removal of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Removal of $($secret.Name) $vaultName failed."
   }
}

### Go back around and purge the secrets

foreach ($secret in $secrets) {
   Write-Output "Purging $($secret.Name)"
   Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Name -InRemovedState -Force | Wait-Process

   if($?) {
      Write-Host "Purge of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Purge of $($secret.Name) $vaultName failed."
   }
}

Write-Output "Remove Complete"

但是，当脚本运行时，偶尔会出现“冲突”错误。出现的错误数量各不相同。我还得到了一个突然出现在这个过程中的证书，我怀疑这是由于我的 Key Vault 中的某种损坏。这是输出，脚本test-run.ps1调用上面显示的清除脚本代码：

> .\test-run
Starting Removal
Removing QA-testing-certificate
Remove-AzKeyVaultSecret : Operation returned an invalid status code 'Forbidden'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:25
char:4
+    Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzKeyVaultSecret], KeyVaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.RemoveAzureKeyVaultSecret

Removal of QA-testing-certificate  failed.
Removing QA-testing-secret
Removal of QA-testing-secret succeeded.
Removing QA-testing-secrets2
Removal of QA-testing-secrets2 succeeded.
Removing QA-testing-secrets3
Removal of QA-testing-secrets3 succeeded.
Purging QA-testing-certificate
Remove-AzKeyVaultSecret : Operation returned an invalid status code 'Forbidden'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:39
char:4
+    Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzKeyVaultSecret], KeyVaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.RemoveAzureKeyVaultSecret

Purge of QA-testing-certificate  failed.
Purging QA-testing-secret
Remove-AzKeyVaultSecret : Operation returned an invalid status code 'Conflict'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:39
char:4
+    Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzKeyVaultSecret], KeyVaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.RemoveAzureKeyVaultSecret

Purge of QA-testing-secret  failed.
Purging QA-testing-secrets2
Remove-AzKeyVaultSecret : Operation returned an invalid status code 'Conflict'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:39
char:4
+    Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzKeyVaultSecret], KeyVaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.RemoveAzureKeyVaultSecret

Purge of QA-testing-secrets2  failed.
Purging QA-testing-secrets3
Purge of QA-testing-secrets3 succeeded.
Remove Complete

任何人都可以就发生的事情提供一些建议吗？我忽略了什么？

4

2 回答 2

1

谢谢大家的帮助。事实证明，真正的问题是竞争条件。-InRemovedState在使用参数集发出相同的删除命令之前，您必须给 Azure 时间来实际完成删除。我添加了一个Start-Sleep命令，命令之间有 15 秒的延迟，从而解决了问题。我的最终工作代码是：

[CmdletBinding()]
Param(

    [Parameter(Mandatory = $True)]
    [string]$keyvaultName,
)

#Remove assorted security items from Key Vault

# Shut up blather about deprecated features
 Set-Item -Path Env:\SuppressAzurePowerShellBreakingChangeWarnings -Value 'true'

Write-Output "Starting Removal"

### Remove Secrets
$secrets = Get-AzKeyVaultSecret -VaultName $keyvaultName

### Delete the secrets

foreach ($secret in $secrets) {
   Write-Output "Removing $($secret.Name)"
   Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Name -Force

   if($?) {
      Write-Host "Removal of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Removal of $($secret.Name) $vaultName failed."
   }
}

### Wait for changes to settle

Start-Sleep -s 15

### Go back around and purge the secrets

foreach ($secret in $secrets) {
   Write-Output "Purging $($secret.Name)"
   Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Name -InRemovedState -Force

   if($?) {
      Write-Host "Purge of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Purge of $($secret.Name) $vaultName failed."
   }
}


Write-Output "Remove Complete"

感谢所有回答的人。

于 2020-10-22T13:08:50.183 回答
0

这是您看到与某些证书发生冲突的原因。

在后台，密钥库将证书的私钥存储为具有相同名称的隐藏秘密对象。

例如，如果我在我的密钥保管库中创建一个名为“cert1”的证书，则密钥保管库会创建一个名为“cert1”的隐藏机密。尽管这个隐藏的秘密在 Azure 门户中对您不可见，但在您使用 powershell / CLI 时它会显示出来。

您很可能试图删除/清除仍然具有与之关联的证书的机密，从而导致冲突错误。

看起来您正在使用 for 循环遍历所有秘密，这可能是造成这种情况的原因。

于 2020-10-21T21:23:20.313 回答