Public/OSDCloud/CloudSecret.ps1
|
function Invoke-CloudSecret { <# .SYNOPSIS Invoke a secret retrieved from Azure Key Vault. .DESCRIPTION Loads the named secret with Get-CloudSecret and either invokes it directly, writes it to a temporary file, or runs it elevated depending on the selected invoke mode. .PARAMETER VaultName Name of the Key Vault that contains the secret. .PARAMETER Name Name of the secret to read. .PARAMETER Invoke Choose how to run the secret content: Command, File, or FileRunas. .EXAMPLE Invoke-CloudSecret -VaultName contoso -Name Script Invokes the retrieved secret in the current session. .EXAMPLE Invoke-CloudSecret -VaultName contoso -Name Script -Invoke FileRunas Writes the secret to a temporary file and runs it elevated. .NOTES Author: David Segura - Recast Software 2026-07-10 - Updated help to repo standard .LINK https://github.com/OSDeploy/OSD/tree/master/docs #> [CmdletBinding()] param ( [Parameter(Mandatory, Position = 0)] [ValidateNotNull()] [System.String] # Specifies the name of the key vault to which the secret belongs. This cmdlet constructs the fully qualified domain name (FQDN) of a key vault based on the name that this parameter specifies and your current environment. $VaultName, [Parameter(Mandatory, Position = 1)] [ValidateNotNull()] [System.String] # Specifies the name of the secret to get the content to use as a PSCloudScript $Name, [ValidateSet('Command','File','FileRunas')] [System.String] $Invoke = 'Command' ) #================================================= # Get-CloudSecret #================================================= [System.String]$GetCloudSecret = Get-CloudSecret -VaultName $VaultName -Name $Name #================================================= # Invoke #================================================= if ($GetCloudSecret) { if ($Invoke -eq 'Command') { Invoke-Expression -Command $GetCloudSecret } if ($Invoke -eq 'File') { $GetCloudSecret | Out-File -FilePath "$env:TEMP\CloudSecret.ps1" & "$env:TEMP\CloudSecret.ps1" Remove-Item -Path "$env:TEMP\CloudSecret.ps1" -Force -ErrorAction Ignore | Out-Null } if ($Invoke -eq 'FileRunas') { $GetCloudSecret | Out-File -FilePath "$env:TEMP\CloudSecret.ps1" Start-Process powershell.exe -Verb Runas "& $env:TEMP\CloudSecret.ps1" -Wait Remove-Item -Path "$env:TEMP\CloudSecret.ps1" -Force -ErrorAction Ignore | Out-Null } } } function Set-CloudSecret { <# .SYNOPSIS Convert content to an Azure Key Vault secret. .DESCRIPTION Reads content from a URL, the clipboard, a file, or a raw string and stores it in Azure Key Vault as a secret. .PARAMETER VaultName Name of the Key Vault that receives the secret. .PARAMETER Name Name of the secret to set. .PARAMETER Uri URI content to set as the Azure Key Vault secret. .PARAMETER Clipboard Clipboard text to set as the Azure Key Vault secret. .PARAMETER File File content to set as the Azure Key Vault secret. .PARAMETER String String content to set as the Azure Key Vault secret. .EXAMPLE Set-CloudSecret -VaultName contoso -Name Script -File .\script.ps1 Uploads file contents to Key Vault. .EXAMPLE Set-CloudSecret -VaultName contoso -Name Script -Clipboard Stores clipboard contents in Key Vault. .NOTES Author: David Segura - Recast Software 2026-07-10 - Updated help to repo standard .LINK https://github.com/OSDeploy/OSD/tree/master/docs #> [CmdletBinding(DefaultParameterSetName='FromUriContent')] param ( [Parameter(Mandatory, Position = 0)] [Alias('Vault')] [System.String] # Specifies the name of the key vault to which the secret belongs. This cmdlet constructs the fully qualified domain name (FQDN) of a key vault based on the name that this parameter specifies and your current environment. $VaultName, [Parameter(Mandatory, Position = 1)] [Alias('Secret','SecretName')] # Specifies the name of the secret to set [System.String] $Name, [Parameter(ParameterSetName='FromUriContent', Mandatory)] [System.Uri] # Uri content to set as the Azure Key Vault secret $Uri, [Parameter(ParameterSetName='FromClipboard', Mandatory)] [System.Management.Automation.SwitchParameter] # Clipboard raw text to set as the Azure Key Vault secret $Clipboard, [Parameter(ParameterSetName='FromFile', Mandatory)] [System.IO.FileInfo] # File content to set as the Azure Key Vault secret $File, [Parameter(ParameterSetName='FromString', Mandatory)] [System.String] # String to set as the Azure Key Vault secret $String ) $RawString = $null #================================================= # Import Az Modules #================================================= $Module = Import-Module Az.Accounts -PassThru -ErrorAction Ignore if (-not $Module) { Install-Module Az.Accounts -Force } $Module = Import-Module Az.KeyVault -PassThru -ErrorAction Ignore if (-not $Module) { Install-Module Az.KeyVault -Force } if (!(Get-AzContext -ErrorAction Ignore)) { Connect-AzAccount -DeviceCode } if (Get-AzContext -ErrorAction Ignore) { #================================================= # FromUriContent #================================================= if ($PSCmdlet.ParameterSetName -eq 'FromUriContent') { $GithubRawUrl = (Get-GithubRawUrl -Uri $Uri) foreach ($Item in $GithubRawUrl) { try { $WebRequest = Invoke-WebRequest "$Item" -UseBasicParsing -Method Head -MaximumRedirection 0 -ErrorAction SilentlyContinue if ($WebRequest.StatusCode -eq 200) { if ($RawString) {[System.String]$RawString += "`n"} [System.String]$RawString += Invoke-RestMethod -Uri $Item } } catch { Write-Warning $_ } } } #================================================= # FromClipboard #================================================= if ($PSCmdlet.ParameterSetName -eq 'FromClipboard') { if (Get-Clipboard -ErrorAction Ignore) { try { $RawString = Get-Clipboard -Format Text -Raw } catch { Write-Warning $_ } } } #================================================= # FromFile #================================================= if ($PSCmdlet.ParameterSetName -eq 'FromFile') { if (Test-Path $File) { try { $RawString = Get-Content $File -Raw } catch { Write-Warning $_ } } } #================================================= # FromString #================================================= if ($PSCmdlet.ParameterSetName -eq 'FromString') { if ($String) { $RawString = $String } } #================================================= # Set-AzKeyVaultSecret #================================================= if ($RawString) { try { $SecretValue = ConvertTo-SecureString -String $RawString -AsPlainText -Force Set-AzKeyVaultSecret -VaultName $VaultName -Name $Name -SecretValue $SecretValue -ContentType 'text/plain' } catch { Write-Warning $_ } } } } |