用于删除Key Vault机密并获得409个冲突错误的PowerShell脚本

编程问答 2022-06-07

问题描述

我编写了PowerShell 5.1脚本，该脚本从启用了软删除的Azure密钥保管库中删除机密。我了解到，要成功清除此类Vault中的秘密，您必须：

  1. 删除秘密。
  2. 再次删除机密，这次指定-InRemovedState参数。

我的脚本是：

[CmdletBinding()]
Param(
    [Parameter(Mandatory = $True)]
    [string]$keyvaultName
)

#Remove assorted security items from Key Vault

# Shut up blather about deprecated features
 Set-Item -Path Env:\SuppressAzurePowerShellBreakingChangeWarnings -Value 'true'

Write-Output "Starting Removal"

### Remove Secrets
$secrets = Get-AzkeyvaultSecret -VaultName $keyvaultName

### Delete the secrets

foreach ($secret in $secrets) {
   Write-Output "Removing $($secret.Name)"
   Remove-AzkeyvaultSecret -VaultName $keyvaultName -Name $secret.Name -Force | Wait-Process

   if($?) {
      Write-Host "Removal of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Removal of $($secret.Name) $vaultName Failed."
   }
}

### Go back around and purge the secrets

foreach ($secret in $secrets) {
   Write-Output "Purging $($secret.Name)"
   Remove-AzkeyvaultSecret -VaultName $keyvaultName -Name $secret.Name -InRemovedState -Force | Wait-Process

   if($?) {
      Write-Host "Purge of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Purge of $($secret.Name) $vaultName Failed."
   }
}

Write-Output "Remove Complete"

但是，脚本运行时，偶尔会出现“冲突”错误。出现的错误数量各不相同。我还从头到尾显示了证书，我怀疑这是由于我的Key Vault中的某种损坏造成的。这是输出，脚本test-run.ps1调用上面显示的我的清除脚本代码：

> .\test-run
Starting Removal
Removing QA-testing-certificate
Remove-AzkeyvaultSecret : Operation returned an invalid status code 'Forbidden'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:25
char:4
+    Remove-AzkeyvaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzkeyvaultSecret],keyvaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.keyvault.RemoveAzurekeyvaultSecret

Removal of QA-testing-certificate  Failed.
Removing QA-testing-secret
Removal of QA-testing-secret succeeded.
Removing QA-testing-secrets2
Removal of QA-testing-secrets2 succeeded.
Removing QA-testing-secrets3
Removal of QA-testing-secrets3 succeeded.
Purging QA-testing-certificate
Remove-AzkeyvaultSecret : Operation returned an invalid status code 'Forbidden'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:39
char:4
+    Remove-AzkeyvaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzkeyvaultSecret],keyvaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.keyvault.RemoveAzurekeyvaultSecret

Purge of QA-testing-certificate  Failed.
Purging QA-testing-secret
Remove-AzkeyvaultSecret : Operation returned an invalid status code 'Conflict'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:39
char:4
+    Remove-AzkeyvaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzkeyvaultSecret],keyvaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.keyvault.RemoveAzurekeyvaultSecret

Purge of QA-testing-secret  Failed.
Purging QA-testing-secrets2
Remove-AzkeyvaultSecret : Operation returned an invalid status code 'Conflict'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:39
char:4
+    Remove-AzkeyvaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzkeyvaultSecret],keyvaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.keyvault.RemoveAzurekeyvaultSecret

Purge of QA-testing-secrets2  Failed.
Purging QA-testing-secrets3
Purge of QA-testing-secrets3 succeeded.
Remove Complete

任何人都可以对正在发生的事情提供一些建议吗？我忽略了什么？

解决方法

这是您看到与某些证书冲突的原因。

在后台，密钥库将证书的私钥存储为具有相同名称的隐藏秘密对象。

例如，如果我在密钥库中创建了一个名为“ cert1”的证书，则密钥库将创建一个名为“ cert1”的隐藏机密。尽管您无法在Azure门户中看到此隐藏的机密，但是当您使用Powershell / CLI时，它确实会显示出来。

您最有可能试图删除/清除仍与之关联的证书的机密，从而导致冲突错误。

看起来您正在使用for循环遍历所有机密，这很可能是造成这种情况的原因。

,

谢谢大家的帮助。事实证明，真正的问题是比赛条件。在发出带有-InRemovedState参数集的相同删除命令之前，您必须给Azure时间实际完成删除操作的时间。我添加了一个Start-Sleep命令，命令之间的延迟为15秒，这解决了该问题。我最后的工作代码是：

[CmdletBinding()]
Param(

    [Parameter(Mandatory = $True)]
    [string]$keyvaultName,)

#Remove assorted security items from Key Vault

# Shut up blather about deprecated features
 Set-Item -Path Env:\SuppressAzurePowerShellBreakingChangeWarnings -Value 'true'

Write-Output "Starting Removal"

### Remove Secrets
$secrets = Get-AzKeyVaultSecret -VaultName $keyvaultName

### Delete the secrets

foreach ($secret in $secrets) {
   Write-Output "Removing $($secret.Name)"
   Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Name -Force

   if($?) {
      Write-Host "Removal of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Removal of $($secret.Name) $vaultName failed."
   }
}

### Wait for changes to settle

Start-Sleep -s 15

### Go back around and purge the secrets

foreach ($secret in $secrets) {
   Write-Output "Purging $($secret.Name)"
   Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Name -InRemovedState -Force

   if($?) {
      Write-Host "Purge of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Purge of $($secret.Name) $vaultName failed."
   }
}


Write-Output "Remove Complete"

感谢所有回答的人。

azure-keyvaultkeypowershellpowershellscriptingsecretsmanager