Azure KeyVault設置策略和自動化添加secrets鍵值對

一. 關於Azure Key Vault

Azure 密鑰保管庫可幫助保護雲應用程序和服務使用的加密密鑰和機密。 藉助 Key Vault，可以使用密鑰來加密密鑰和機密（例如身份驗證密鑰、存儲賬戶密鑰、數據加密密鑰、.PFX 文件和密碼）。密鑰保管庫簡化了密鑰管理過程，可以讓你控制用於訪問和加密數據的密鑰。 開發人員能夠在幾分鐘內建立用於開發和測試的密鑰，並沒有縫地將其遷移到生產密鑰。 安全管理員能夠根據須要授予（和吊銷）密鑰權限。

二.  以下自動化腳本實現的功能

1. 向已經有的key vault中添加secrets鍵值對
2. 設置key vault的policy

---

# set Azure Enviroment into China Mooncake.
$EnvironmentName ="AzureChinaCloud"
# Give your subcriptionID here.
$SubscriptionId="*********"
# your keyvault name
$keyvaultName="yourkeyvaultname"
# set secret type (option)
$ContentType="config"
 
##login
Login-AzureRmAccount -EnvironmentName 'AzureChinaCloud'
Set-AzureRmContext -SubscriptionId $SubscriptionId
 
## set keyvault policy
Set-AzureRmKeyVaultAccessPolicy -VaultName $keyvaultName -EnabledForDeployment -EnabledForTemplateDeployment -EnabledForDiskEncryption
## initial keyvault secrets pairs
$keyvaultSecrets =@{key1 = 'value1';key2 = 'value2'}
<#
foreach($key in $keyvaultSecrets.keys)
{
Remove-AzureKeyVaultSecret -VaultName $keyvaultName -Name $key -Force -Confirm:$False
Write-Output "remvoe $key successfully"
}
#>
#>
## add secrets
foreach($key in $keyvaultSecrets.keys)
{
$Secret = ConvertTo-SecureString -String $keyvaultSecrets[$key] -AsPlainText -Force
Set-AzureKeyVaultSecret -VaultName $keyvaultName -Name $key -SecretValue $Secret -ContentType $ContentType
}
 
## list secrets
foreach($key in $keyvaultSecrets.keys)
{
(get-azurekeyvaultsecret -VaultName $keyvaultName -name $key).SecretValueText
}

line 11-12須要注意你使用的azure的環境，此處以azure china爲例

---

keyvualt的策略設置能夠參考此處

• EnabledForDeployment ：Enables the Microsoft.Compute resource provider to retrieve secrets from this key vault when this key vault is referenced in resource creation, for example when creating a virtual machine
• EnabledForDiskEncryption：Enables the Azure disk encryption service to get secrets and unwrap keys from this key vault.
• EnabledForTemplateDeployment：Enables Azure Resource Manager to get secrets from this key vault when this key vault is referenced in a template deployment.