{"id":6512,"date":"2022-07-14T14:14:29","date_gmt":"2022-07-14T13:14:29","guid":{"rendered":"https:\/\/rakhesh.com\/?p=6512"},"modified":"2022-07-14T14:22:23","modified_gmt":"2022-07-14T13:22:23","slug":"getting-a-list-of-key-vaults-and-access-policies","status":"publish","type":"post","link":"https:\/\/rakhesh.com\/azure\/getting-a-list-of-key-vaults-and-access-policies\/","title":{"rendered":"Getting a list of Key Vaults and Access Policies"},"content":{"rendered":"

I am doing a bit of cleaning up at work, merging some of my Automation Accounts, moving stuff around, renaming some Key Vaults (why is naming something so hard<\/a>!!?<\/em>) and wanted to get a list of all my Key Vaults and their Access Policies.<\/p>\n

I had been maintaining a list in SharePoint Online manually, but I don’t trust myself. :) Wanted to generate something to get the current state. I came up with the following PowerShell script:<\/p>\n

$vaults = @{}\r\n$appIds = @{}\r\n\r\n# List all the Key Vault and process them\r\nGet-AzKeyVault | ForEach-Object{ \r\n    $vaultName = $_.VaultName\r\n    Write-Host \"Processing $vaultName\"\r\n\r\n    # To get the Access Policies we need to get the Key Vault directly\r\n    $accessPolicies = (Get-AzKeyVault -VaultName $_.VaultName -ErrorVariable warning).AccessPolicies\r\n\r\n    # To my vaults hash table add the Vault name as a key\r\n    $vaults.$vaultName = @{}\r\n\r\n    # Process each Access Policy\r\n    foreach ($accessPolicy in $accessPolicies) {\r\n        # Strip out the app Id\/ username from the Access Policy so it's just the name\r\n        $displayName = $accessPolicy.DisplayName -replace '\\s\\([^\\s]+\\)$',''\r\n\r\n        # Make a new temporary hash with the permissions. I am only interested in these three but there are a few more.\r\n        $tempHash = [ordered]@{\r\n            \"PermissionsToCertificates\" = \"\"\r\n            \"PermissionsToKeys\" = \"\"\r\n            \"PermissionsToSecrets\" = \"\"\r\n        }\r\n\r\n        # Get the values, combine them into a single string for each permission type. Assign these to the hash table above.\r\n        $tempHash.PermissionsToCertificates = $accessPolicy.PermissionsToCertificates -join \",\"\r\n        $tempHash.PermissionsToKeys = $accessPolicy.PermissionsToKeys -join \",\"\r\n        $tempHash.PermissionsToSecrets = $accessPolicy.PermissionsToSecrets -join \",\"\r\n\r\n        # To the vaults hash table above, where I created a key with the vault name, I now create a new hash table with the key as the display name of the app\/ user.\r\n        # And I assign the temporary hash table as a value of that. \r\n        # Thus $vaults.'vaultname1'.'appId' gives me the permissions. Neat huh! :)\r\n        $vaults.$vaultName[$displayName] = $tempHash\r\n\r\n        # Do the same for the hash tables of app Ids. I call this app Ids but they also include users. I am mainly interested in app Ids hence the name.\r\n        # If the appIds hash table already contains a key with the display name of the app, I create a value in that similar to what I did above.\r\n        # But if it does not contain a key, then I create that key and set its value as a hash table. Then I do the same as above.\r\n        if ($appIds.ContainsKey($displayName)) { \r\n            $appIds.$displayName[$vaultName] = $tempHash\r\n        } else {\r\n            $appIds.$displayName = @{}\r\n            $appIds.$displayName[$vaultName] = $tempHash\r\n        }   \r\n    }\r\n}<\/pre>\n
Maybe it helps someone…<\/p>\n","protected":false},"excerpt":{"rendered":"
I am doing a bit of cleaning up at work, merging some of my Automation Accounts, moving stuff around, renaming some Key Vaults (why is naming something so hard!!?) and wanted to get a list of all my Key Vaults and their Access Policies. I had been maintaining a list in SharePoint Online manually, but … Continue reading Getting a list of Key Vaults and Access Policies<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false}}},"categories":[887],"tags":[988,227],"jetpack_publicize_connections":[],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/6512"}],"collection":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/comments?post=6512"}],"version-history":[{"count":0,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/posts\/6512\/revisions"}],"wp:attachment":[{"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/media?parent=6512"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/categories?post=6512"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rakhesh.com\/wp-json\/wp\/v2\/tags?post=6512"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}