95 lines
3.8 KiB
PowerShell
95 lines
3.8 KiB
PowerShell
$AzureKeyVaultProvider = @{
|
|
Name = "AzureKeyVault"
|
|
SupportedTypes = @(
|
|
"credential",
|
|
"securestring",
|
|
"string"
|
|
)
|
|
Resolver = {
|
|
Param(
|
|
[Parameter(Mandatory=$true)]
|
|
[System.Collections.IDictionary]
|
|
$Reference,
|
|
|
|
[Parameter(Mandatory=$true)]
|
|
[ValidateSet("credential", "securestring", "string")]
|
|
[string]
|
|
$ExpectedType,
|
|
|
|
[Parameter(Mandatory=$false)]
|
|
[hashtable]
|
|
$ProviderSettings = @{}
|
|
)
|
|
|
|
$GetSecretCommand = Get-Command -Name Get-AzKeyVaultSecret -ErrorAction SilentlyContinue
|
|
if($null -eq $GetSecretCommand){
|
|
throw "AzureKeyVault provider requires the module [Az.KeyVault] and command [Get-AzKeyVaultSecret]."
|
|
}
|
|
|
|
$Vault = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Vault" -DefaultValue "")
|
|
$Name = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "Name")
|
|
$UserName = [string](Get-ConfigurationDataMapValue -Map $Reference -Key "UserName" -DefaultValue "")
|
|
$Options = Get-ConfigurationDataMapValue -Map $Reference -Key "Options" -DefaultValue @{}
|
|
|
|
if([string]::IsNullOrWhiteSpace($Vault) -and $ProviderSettings.ContainsKey("DefaultVault")){
|
|
$Vault = [string]$ProviderSettings.DefaultVault
|
|
}
|
|
|
|
if([string]::IsNullOrWhiteSpace($Vault)){
|
|
throw "AzureKeyVault secret [$Name] requires [Vault] or provider setting [DefaultVault]."
|
|
}
|
|
|
|
if($ProviderSettings.ContainsKey("SubscriptionId") -or $ProviderSettings.ContainsKey("TenantId")){
|
|
$SetContextCommand = Get-Command -Name Set-AzContext -ErrorAction SilentlyContinue
|
|
if($null -eq $SetContextCommand){
|
|
throw "AzureKeyVault provider settings define Azure context values, but command [Set-AzContext] was not found. Install [Az.Accounts] or remove SubscriptionId/TenantId from provider settings."
|
|
}
|
|
|
|
$ContextParameters = @{}
|
|
if($ProviderSettings.ContainsKey("SubscriptionId") -and -not [string]::IsNullOrWhiteSpace([string]$ProviderSettings.SubscriptionId)){
|
|
$ContextParameters["SubscriptionId"] = [string]$ProviderSettings.SubscriptionId
|
|
}
|
|
|
|
if($ProviderSettings.ContainsKey("TenantId") -and -not [string]::IsNullOrWhiteSpace([string]$ProviderSettings.TenantId)){
|
|
$ContextParameters["Tenant"] = [string]$ProviderSettings.TenantId
|
|
}
|
|
|
|
if($ContextParameters.Count -gt 0){
|
|
& $SetContextCommand @ContextParameters | Out-Null
|
|
}
|
|
}
|
|
|
|
$CommandParameters = @{
|
|
VaultName = $Vault
|
|
Name = $Name
|
|
}
|
|
|
|
if($Options -is [System.Collections.IDictionary]){
|
|
foreach($Key in $Options.Keys){
|
|
$CommandParameters[$Key] = $Options[$Key]
|
|
}
|
|
}
|
|
|
|
if($ExpectedType -eq "string" -and $GetSecretCommand.Parameters.ContainsKey("AsPlainText") -and -not $CommandParameters.ContainsKey("AsPlainText")){
|
|
$CommandParameters["AsPlainText"] = $true
|
|
}
|
|
|
|
$Secret = & $GetSecretCommand @CommandParameters
|
|
if($null -eq $Secret){
|
|
throw "Azure Key Vault secret [$Name] was not found in vault [$Vault]."
|
|
}
|
|
|
|
if($ExpectedType -eq "string" -and $Secret -is [string]){
|
|
return $Secret
|
|
}
|
|
|
|
if($Secret.PSObject.Properties["SecretValue"]){
|
|
return ConvertFrom-ConfigurationDataSecretValue -Secret $Secret.SecretValue -ExpectedType $ExpectedType -Name $Name -UserName $UserName
|
|
}
|
|
|
|
return ConvertFrom-ConfigurationDataSecretValue -Secret $Secret -ExpectedType $ExpectedType -Name $Name -UserName $UserName
|
|
}
|
|
}
|
|
|
|
Register-ConfigurationDataSecretProvider @AzureKeyVaultProvider
|