Fetch secrets with no access to key vault using Devops pipelines
Tags: azure, devops, powershell, iac
Published: 2022-04-14 21:16:00

Greetings my fellow Technology Advocates and Specialists.

| **USECASE INTRODUCTION:-** | 
| --------- |
Azure Key Vault is Protected by "**Access Policies**" and "**Firewall and Virtual Networks**". An Azure Cloud Engineer **Cannot Fetch Secrets** because of one of the condition or both (Depending upon the Scenerio).

| __PROBLEM STATEMENTS:-__ |
| --------- |

1. User Account of Cloud Engineer is not part of Key Vault Access Policy. Hence Secrets cannot be viewed from Azure Portal.
2. Key Vault is Protected by Organization's Public NAT IPs. Secrets cannot be viewed from Azure Portal unless Cloud Engineer is working from inside Organization Network.
3. Key Vault is Protected by Azure Virtual Network. Secrets cannot be viewed from Azure Portal unless inside Azure Virtual Network.   

| **QUESTION TIME:-** |
| --------- |
How will the Cloud Engineer Fetch Secrets ?


| __LIVE RECORDED SESSION:-__ |
| --------- |
| __LIVE DEMO__ was Recorded as part of my Presentation in __WELSH AZURE GROUP__ Forum/Platform |
| Duration of My Demo = __32 Mins 38 Secs__ |
| Start and End Time = __00:39:22 to 01:12:00__ |

{% youtube um_6WtIBSA8 %}


| __REQUIREMENTS:-__ |
| --------- |

1. Azure Key Vault
2. Three Sample Secrets in Azure Key Vault 
3. Azure Resource Manager Service Connection 
4. Azure DevOps Pipeline (YAML)

| **NOTE:-** |
| --------- |

The Service Principal (which is required to Create Service Connection) should at minimum have **GET** and **LIST** Access Policy Permissions in Azure Key Vault.

| __BELOW DISPLAYS THE SAMPLE SECRETS IN KEY VAULT:-__ |
| --------- |
| ![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7uifu9nh2pcpgoevd5us.png) |

| __WHAT DOES THE PIPELINE DO:-__ |
| --------- |

| # | PIPELINE TASKS | 
| --------- | --------- |
| 1. | AZURE KEY VAULT TASKS |
| 2. | FETCH ALL SECRETS AND STORE IT IN A TEXT FILE | 
| 3. | COPY THE SECRETS TEXT FILE TO ARTIFACTS STAGING DIRECTORY |
| 4. | PUBLISH THE ARTIFACTS |


| __CODE REPOSITORY:-__ |
| --------- |
| {% github arindam0310018/14-Apr-2022-DevOps__Fetch-Secrets-With-No-Access-To-KeyVault %} |

| __Below follows the contents of the YAML File (Azure DevOps):-__ |
| --------- |
```
trigger:
  none

######################
#DECLARE VARIABLES:-
######################
variables:
  ServiceConnection: amcloud-cicd-service-connection
  KVName: ampockv
  Artifact: AM
  
#########################
# Declare Build Agents:-
#########################
pool:
  vmImage: windows-latest

###################
# Declare Stages:-
###################
stages:

- stage: USECASE_DISPLAY_ALL_SECRETS_AND_VALUES
  jobs:
  - job: DISPLAY_SECRETS_AND_VALUES
    displayName: DISPLAY SECRETS AND VALUES
    steps:

########################################################################
# Azure Key Vault Task.
# Display the name of Key Vault.
# Display the No. of Secrets found in Key Vault.
# Display the No. of enabled and unexpired Secrets found in Key Vault.
# Downloads values of Each Secret in Key Vault.
########################################################################

    - task: AzureKeyVault@2
      displayName: AZ KEYVAULT TASK
      inputs:
        azureSubscription: '$(ServiceConnection)'
        KeyVaultName: '$(KVName)'
        SecretsFilter: '*'
        RunAsPreJob: false

#######################################################
# Integers can be compared with these operators:
#   -eq # Equal
#   -ne # Not equal
#   -lt # Less than
#   -le # Less than or equal
#   -gt # Greater than
#   -ge # Greater than or equal
#######################################################

###############################################################
# Copy the Secrets text file to Artifacts Staging Directory:-
###############################################################

    - task: AzureCLI@2
      displayName: FETCH ALL SECRETS
      inputs:
        azureSubscription: '$(ServiceConnection)'
        scriptType: ps
        scriptLocation: inlineScript
        inlineScript: |
          az --version
          az account show
          $count = az keyvault secret list --vault-name $(KVName) --query "[] | length(@)"
          For ($i=0; $i -lt $count; $i++) {
          $secretname = az keyvault secret list --vault-name $(KVName) --query [$i].name -o tsv
          $secretvalue = az keyvault secret show --vault-name $(KVName) --name $secretname --query value -o tsv
          echo ($secretname + ':' + $secretvalue) >> Secrets.txt
          }
###############################################################
# Copy the Secrets text file to Artifacts Staging Directory:-
###############################################################

    - task: CopyFiles@2
      displayName: COPY TO ARTIFACTS STAGING DIRECTORY
      inputs:
        Contents: Secrets.txt
        targetFolder: '$(Build.ArtifactStagingDirectory)'

###########################
# Publish the Artifacts:-
###########################

    - task: PublishBuildArtifacts@1
      displayName: PUBLISH ARTIFACTS
      inputs:
        PathtoPublish: '$(Build.ArtifactStagingDirectory)'
        ArtifactName: '$(Artifact)'
        publishLocation: 'Container'
```

| __Values of the VARIABLES incase if you wish to change:-__ |
| --------- |
```
######################
#DECLARE VARIABLES:-
######################
variables:
  ServiceConnection: amcloud-cicd-service-connection
  KVName: ampockv
  Artifact: AM
```
| __Change the Agent Pool from MICROSOFT HOSTED BUILD AGENT to SELF HOSTED BUILD AGENT otherwise, below error is encountered:-__ |
| --------- |

| ![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jnakxms8lvplnx62cd8w.png) |
| --------- |

| __PIPELINE RESULTS:-__ |
| --------- |
| ![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/f6iveb8cjkossb2v0k01.png) |

| __SECRETS TEXT FILE PUBLISHED IN ARTIFACTS:-__ |
| --------- |

| ![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dxlisxuuu7njgll5do5d.png) |
| --------- |

| ![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fl5ta6r7a3tz3tl1d9l6.png) |
| --------- | 

| __DOWNLOAD AND VIEW THE SECRETS TEXT FILE:-__ |
| --------- |

| ![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1sdp8blrg03lq8ylisv3.png) |
| --------- |
| The Output Format in Secrets Text file is [**NAME OF THE SECRET**]:[**VALUE OF THE SECRET**] |