用于删除 Key Vault 机密的 PowerShell 脚本出现 409 冲突错误

Question

我编写了一个 PowerShell 5.1 脚本，用于从启用了软删除的 Azure Key Vault 中删除机密。我了解到，要成功清除此类 Key Vault 中的秘密，您必须：

删除机密。
再次删除机密，这次指定 -InRemovedState 参数。

我的脚本是：

[CmdletBinding()]
Param(
    [Parameter(Mandatory = $True)]
    [string]$keyvaultName
)

#Remove assorted security items from Key Vault

# Shut up blather about deprecated features
 Set-Item -Path Env:\SuppressAzurePowerShellBreakingChangeWarnings -Value 'true'

Write-Output "Starting Removal"

### Remove Secrets
$secrets = Get-AzKeyVaultSecret -VaultName $keyvaultName

### Delete the secrets

foreach ($secret in $secrets) {
   Write-Output "Removing $($secret.Name)"
   Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Name -Force | Wait-Process

   if($?) {
      Write-Host "Removal of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Removal of $($secret.Name) $vaultName failed."
   }
}

### Go back around and purge the secrets

foreach ($secret in $secrets) {
   Write-Output "Purging $($secret.Name)"
   Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Name -InRemovedState -Force | Wait-Process

   if($?) {
      Write-Host "Purge of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Purge of $($secret.Name) $vaultName failed."
   }
}

Write-Output "Remove Complete"

但是，当脚本运行时，偶尔会出现“冲突”错误。出现的错误数量各不相同。我还莫名其妙地得到了一个证书，我怀疑这是由于我的 Key Vault 中的某种损坏造成的。这是输出，其中脚本 test-run.ps1 调用上面显示的我的清除脚本代码：

> .\test-run
Starting Removal
Removing QA-testing-certificate
Remove-AzKeyVaultSecret : Operation returned an invalid status code 'Forbidden'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:25
char:4
+    Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzKeyVaultSecret], KeyVaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.RemoveAzureKeyVaultSecret

Removal of QA-testing-certificate  failed.
Removing QA-testing-secret
Removal of QA-testing-secret succeeded.
Removing QA-testing-secrets2
Removal of QA-testing-secrets2 succeeded.
Removing QA-testing-secrets3
Removal of QA-testing-secrets3 succeeded.
Purging QA-testing-certificate
Remove-AzKeyVaultSecret : Operation returned an invalid status code 'Forbidden'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:39
char:4
+    Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzKeyVaultSecret], KeyVaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.RemoveAzureKeyVaultSecret

Purge of QA-testing-certificate  failed.
Purging QA-testing-secret
Remove-AzKeyVaultSecret : Operation returned an invalid status code 'Conflict'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:39
char:4
+    Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzKeyVaultSecret], KeyVaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.RemoveAzureKeyVaultSecret

Purge of QA-testing-secret  failed.
Purging QA-testing-secrets2
Remove-AzKeyVaultSecret : Operation returned an invalid status code 'Conflict'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:39
char:4
+    Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzKeyVaultSecret], KeyVaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.RemoveAzureKeyVaultSecret

Purge of QA-testing-secrets2  failed.
Purging QA-testing-secrets3
Purge of QA-testing-secrets3 succeeded.
Remove Complete

任何人都可以就发生的事情提供一些建议吗？我忽略了什么？

Answer 1

这就是您看到与某些证书发生冲突的原因。

在幕后，密钥保管库将证书的私钥存储为同名的隐藏秘密对象。

例如，如果我在我的密钥保管库中创建了一个名为“cert1”的证书，密钥保管库会创建一个名为“cert1”的隐藏机密。虽然这个隐藏的秘密在 Azure 门户中对您不可见，但当您使用 powershell / CLI 时它会显示出来。

您很可能是在尝试删除/清除仍然关联有证书的机密，从而导致冲突错误。

看起来您正在使用 for 循环遍历所有机密，这可能是造成这种情况的原因。

Answer 2

谢谢大家的帮助。事实证明，真正的问题是竞争条件。在使用 -InRemovedState 参数集发出相同的删除命令之前，您必须给 Azure 时间来实际完成删除。我添加了一个 Start-Sleep 命令，命令之间有 fifteen-second 延迟，这解决了问题。我的最终工作代码是：

[CmdletBinding()]
Param(

    [Parameter(Mandatory = $True)]
    [string]$keyvaultName,
)

#Remove assorted security items from Key Vault

# Shut up blather about deprecated features
 Set-Item -Path Env:\SuppressAzurePowerShellBreakingChangeWarnings -Value 'true'

Write-Output "Starting Removal"

### Remove Secrets
$secrets = Get-AzKeyVaultSecret -VaultName $keyvaultName

### Delete the secrets

foreach ($secret in $secrets) {
   Write-Output "Removing $($secret.Name)"
   Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Name -Force

   if($?) {
      Write-Host "Removal of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Removal of $($secret.Name) $vaultName failed."
   }
}

### Wait for changes to settle

Start-Sleep -s 15

### Go back around and purge the secrets

foreach ($secret in $secrets) {
   Write-Output "Purging $($secret.Name)"
   Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Name -InRemovedState -Force

   if($?) {
      Write-Host "Purge of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Purge of $($secret.Name) $vaultName failed."
   }
}


Write-Output "Remove Complete"

感谢所有回答的人。

用于删除 Key Vault 机密的 PowerShell 脚本出现 409 冲突错误

PowerShell script for removing Key Vault secrets getting 409 Conflict errors

powershell

scripting

key

azure-keyvault

secretsmanager