PowerShell Secret Management
Tags: powershell, azure, secret
Published: 2022-11-17 16:17:54

---
title: PowerShell Secret Management
published: true
description: How to manage secrets by powershell
tags: powershell,azure,secret
cover_image:  https://dev-to-uploads.s3.amazonaws.com/uploads/articles/48t48d22934g2l3ecg62.jpg
# Use a ratio of 100:42 for best results.
# published_at: 2022-11-16 22:00 +0000
---

A secret management is the best way for securely storing and accessing secrets which are anything that you want to tightly control access to, such as API keys, passwords, certificates, or cryptographic keys.

All major cloud providers have a secret management service, for instance [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault/) and [AWS Secrets Manager](https://aws.amazon.com/secrets-manager/). Usually the common way for managing these services is by web portal or CLI.

Another way to manage secrets is by using **[PowerShell SecretManagement Module](https://github.com/powershell/SecretManagement)**. Next the description of the module grabbed directly from the github repository:

> *"PowerShell SecretManagement module provides a convenient way for an user to store and retrieve secrets. The secrets are stored in SecretManagement extension vaults. An extension vault is a PowerShell module that has been registered to SecretManagement. An extension vault can store secrets locally or remotely. Extension vaults are registered to the current logged in user context, and will be available only to that user (unless also registered to other users)."*

Now, I'm going to describe how to manage secrets stored on [Azure Key Vault](https://azure.microsoft.com/en-us/products/key-vault/). 

Step 1, install the required modules:
```powershell
# install secretmanagement module
PS > Install-Module -Name Microsoft.PowerShell.SecretManagement

# install extension vault provider for Azure KeyVault
PS > Install-Module -Name Az.KeyVault

# tip to find the extension vault providers available
PS > Find-Module -tag "SecretManagement"
```
Step 2, register the extension vault to the current user:
```powershell
PS > $subId = "<<keyvault-subscriptionid>>"
PS > $vaultName = "<<keyvault-name>>"
PS > Register-SecretVault -Name myAzKV -ModuleName Az.KeyVault -VaultParameters @{AZKVaultName=$vaultName;SubscriptionId=$subId}

# tip to show the list of extension vault registered (can have more)
PS > Get-SecretVault

Name   ModuleName  IsDefaultVault
----   ----------  --------------
myAzKV Az.KeyVault True
```
Step 3, show the secrets currently stored on registered extension vault:
```powershell
# get list of secrets
PS > Get-SecretInfo

Name    Type     VaultName
----    ----     ---------
key1    Unknown  myAzKV
key2    Unknown  myAzKV
```
Step 4, store a new secret
```powershell
PS > Set-Secret key3 -Vault myAzKV
cmdlet Set-Secret at command pipeline position 1
Supply values for the following parameters:
SecureStringSecret: ***********

# tip add metadata to secret
PS > Set-SecretInfo key3 -Metadata @{"purpose"="demo"}
```
Step 5, retrieve the contents of a secret
```powershell
# get secret contents
PS > Get-Secret key3 -AsPlainText -vault myAzKV
Hello World
```
___
Thanks for reading!