用于删除Key Vault机密并获得409个冲突错误的PowerShell脚本

分类：编程问答

如何解决用于删除Key Vault机密并获得409个冲突错误的PowerShell脚本

我编写了PowerShell 5.1脚本，该脚本从启用了软删除的Azure密钥保管库中删除机密。我了解到，要成功清除此类Vault中的秘密，您必须：

  1. 删除秘密。
  2. 再次删除机密，这次指定-InRemovedState参数。

我的脚本是：

[CmdletBinding()]
Param(
    [Parameter(Mandatory = $True)]
    [string]$keyvaultName
)

#Remove assorted security items from Key Vault

# Shut up blather about deprecated features
 Set-Item -Path Env:\SuppressAzurePowerShellBreakingChangeWarnings -Value 'true'

Write-Output "Starting Removal"

### Remove Secrets
$secrets = Get-AzKeyVaultSecret -VaultName $keyvaultName

### Delete the secrets

foreach ($secret in $secrets) {
   Write-Output "Removing $($secret.Name)"
   Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Name -Force | Wait-Process

   if($?) {
      Write-Host "Removal of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Removal of $($secret.Name) $vaultName failed."
   }
}

### Go back around and purge the secrets

foreach ($secret in $secrets) {
   Write-Output "Purging $($secret.Name)"
   Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Name -InRemovedState -Force | Wait-Process

   if($?) {
      Write-Host "Purge of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Purge of $($secret.Name) $vaultName failed."
   }
}

Write-Output "Remove Complete"

但是，脚本运行时，偶尔会出现“冲突”错误。出现的错误数量各不相同。我还从头到尾显示了证书，我怀疑这是由于我的Key Vault中的某种损坏造成的。这是输出，脚本test-run.ps1调用上面显示的我的清除脚本代码：

> .\test-run
Starting Removal
Removing QA-testing-certificate
Remove-AzKeyVaultSecret : Operation returned an invalid status code 'Forbidden'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:25
char:4
+    Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzKeyVaultSecret],KeyVaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.RemoveAzureKeyVaultSecret

Removal of QA-testing-certificate  failed.
Removing QA-testing-secret
Removal of QA-testing-secret succeeded.
Removing QA-testing-secrets2
Removal of QA-testing-secrets2 succeeded.
Removing QA-testing-secrets3
Removal of QA-testing-secrets3 succeeded.
Purging QA-testing-certificate
Remove-AzKeyVaultSecret : Operation returned an invalid status code 'Forbidden'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:39
char:4
+    Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzKeyVaultSecret],KeyVaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.RemoveAzureKeyVaultSecret

Purge of QA-testing-certificate  failed.
Purging QA-testing-secret
Remove-AzKeyVaultSecret : Operation returned an invalid status code 'Conflict'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:39
char:4
+    Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzKeyVaultSecret],KeyVaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.RemoveAzureKeyVaultSecret

Purge of QA-testing-secret  failed.
Purging QA-testing-secrets2
Remove-AzKeyVaultSecret : Operation returned an invalid status code 'Conflict'
At C:\Users\SESA280186\Desktop\OData\DevOps\Security\Key-Vault-material\keyvault-prototyping\remove-items2.ps1:39
char:4
+    Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Nam ...
+    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Remove-AzKeyVaultSecret],KeyVaultErrorException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.RemoveAzureKeyVaultSecret

Purge of QA-testing-secrets2  failed.
Purging QA-testing-secrets3
Purge of QA-testing-secrets3 succeeded.
Remove Complete

任何人都可以对正在发生的事情提供一些建议吗？我忽略了什么？

解决方法

这是您看到与某些证书冲突的原因。

在后台，密钥库将证书的私钥存储为具有相同名称的隐藏秘密对象。

例如，如果我在密钥库中创建了一个名为“ cert1”的证书，则密钥库将创建一个名为“ cert1”的隐藏机密。尽管您无法在Azure门户中看到此隐藏的机密，但是当您使用Powershell / CLI时，它确实会显示出来。

您最有可能试图删除/清除仍与之关联的证书的机密，从而导致冲突错误。

看起来您正在使用for循环遍历所有机密，这很可能是造成这种情况的原因。

,

谢谢大家的帮助。事实证明，真正的问题是比赛条件。在发出带有-InRemovedState参数集的相同删除命令之前，您必须给Azure时间实际完成删除操作的时间。我添加了一个Start-Sleep命令，命令之间的延迟为15秒，这解决了该问题。我最后的工作代码是：

[CmdletBinding()]
Param(

    [Parameter(Mandatory = $True)]
    [string]$keyvaultName,)

#Remove assorted security items from Key Vault

# Shut up blather about deprecated features
 Set-Item -Path Env:\SuppressAzurePowerShellBreakingChangeWarnings -Value 'true'

Write-Output "Starting Removal"

### Remove Secrets
$secrets = Get-AzKeyVaultSecret -VaultName $keyvaultName

### Delete the secrets

foreach ($secret in $secrets) {
   Write-Output "Removing $($secret.Name)"
   Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Name -Force

   if($?) {
      Write-Host "Removal of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Removal of $($secret.Name) $vaultName failed."
   }
}

### Wait for changes to settle

Start-Sleep -s 15

### Go back around and purge the secrets

foreach ($secret in $secrets) {
   Write-Output "Purging $($secret.Name)"
   Remove-AzKeyVaultSecret -VaultName $keyvaultName -Name $secret.Name -InRemovedState -Force

   if($?) {
      Write-Host "Purge of $($secret.Name) succeeded."
   }
   else {
      Write-Host "Purge of $($secret.Name) $vaultName failed."
   }
}


Write-Output "Remove Complete"

感谢所有回答的人。

版权声明：本文内容由互联网用户自发贡献，该文观点与技术仅代表作者本人。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如发现本站有涉嫌侵权/违法违规的内容， 请发送邮件至 dio@foxmail.com 举报，一经查实，本站将立刻删除。

相关推荐

导入项目后报错问题
依赖报错 idea导入项目后依赖报错，解决方案：https://blog.csdn.net/weixin_42420249/article/details/81191861 依赖版本报错：更换其他版本 无法下载依赖可参考：https://blog.csdn.net/weixin_42628809/a
idea不能识别yaml文件
使用mybatis plus常见错误
错误1：代码生成器依赖和mybatis依赖冲突 启动项目时报错如下 2021-12-03 13:33:33.927 ERROR 7228 [ main] o.s.b.d.LoggingFailureAnalysisReporter : *************************** APPL
gradle常见问题与错误
错误1：gradle项目控制台输出为乱码 # 解决方案：https://blog.csdn.net/weixin_43501566/article/details/112482302 # 在gradle-wrapper.properties 添加以下内容 org.gradle.jvmargs=-Df
Mybatis Plus传入参数0不起作用
错误还原：在查询的过程中，传入的workType为0时，该条件不起作用 <select id="xxx"> SELECT di.id, di.name, di.work_type, di.updated... <where> <if test=&qu
linux中make编译源码包失败
报错如下，gcc版本太低 ^ server.c:5346:31: 错误：‘struct redisServer’没有名为‘server_cpulist’的成员 redisSetCpuAffinity(server.server_cpulist); ^ server.c: 在函数‘hasActiveC
微服务启动错误：Command line is too long. Shorten command line for
解决方案1 1、改项目中.idea/workspace.xml配置文件，增加dynamic.classpath参数 2、搜索PropertiesComponent，添加如下 <property name="dynamic.classpath" value="tru
vue常见错误
删除根组件app.vue中的默认代码后报错：Module Error (from ./node_modules/eslint-loader/index.js): 解决方案：关闭ESlint代码检测，在项目根目录创建vue.config.js，在文件中添加 module.exports = { lin
spark常见错误
查看spark默认的python版本 [root@master day27]# pyspark /home/software/spark-2.3.4-bin-hadoop2.7/conf/spark-env.sh: line 2: /usr/local/hadoop/bin/hadoop: No s
matplotlib报错：AttributeError: module 'backend_interagg' has no attribute 'FigureCanvas'. Did you mean: 'FigureCanvasAgg'?
使用本地python环境可以成功执行 import pandas as pd import matplotlib.pyplot as plt # 设置字体 plt.rcParams['font.sans-serif'] = ['SimHei'] # 能正确显示负号 p
gitlab登录失败，报错：This challenge page was accidentally cached by an intermediary and is no longer available.
设置时间 控制面板
后端开发常见错误
错误1：Request method ‘DELETE‘ not supported 错误还原：controller层有一个接口，访问该接口时报错：Request method ‘DELETE‘ not supported 错误原因：没有接收到前端传入的参数，修改为如下 参考 错误2：cannot r
docker常见错误
错误1：启动docker镜像时报错：Error response from daemon: driver failed programming external connectivity on endpoint quirky_allen 解决方法：重启docker -> systemctl r
idea常见错误
错误1：private field ‘xxx‘ is never assigned 按Altʾnter快捷键，选择第2项 参考：https://blog.csdn.net/shi_hong_fei_hei/article/details/88814070 错误2：启动时报错，不能找到主启动类 #
pip安装依赖失败
报错如下，通过源不能下载，最后警告pip需升级版本 Requirement already satisfied: pip in c:\users\ychen\appdata\local\programs\python\python310\lib\site-packages (22.0.4) Coll
maven常见错误
错误1：maven打包报错 错误还原：使用maven打包项目时报错如下 [ERROR] Failed to execute goal org.apache.maven.plugins:maven-resources-plugin:3.2.0:resources (default-resources)
cloud项目中常见错误
错误1：服务调用时报错 服务消费者模块assess通过openFeign调用服务提供者模块hires 如下为服务提供者模块hires的控制层接口 @RestController @RequestMapping("/hires") public class FeignControl
springboot常见错误
错误1：运行项目后报如下错误 解决方案 报错2：Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:3.8.1:compile (default-compile) on project sb 解决方案：在pom.
springmvc拦截器中使用redisTemplate报空指针异常
参考 错误原因 过滤器或拦截器在生效时，redisTemplate还没有注入 解决方案：在注入容器时就生效 @Component //项目运行时就注入Spring容器 public class RedisBean { @Resource private RedisTemplate<String
vite报错：npm ERR! command C:WINDOWSsystem32cmd.exe /d /s /c C:UsersychenAppDataLocalTempnpx-dde1c848.cmd
使用vite构建项目报错 C:\Users\ychen\work>npm init @vitejs/app @vitejs/create-app is deprecated, use npm init vite instead C:\Users\ychen\AppData\Local\npm-
pythonJavaScriptjavaHTMLPHPreactjsC#AndroidCSSNode.jssqlrpython-3.xMysqLjQueryc++pandasFlutterangularIOSdjangolinuxswifttypescript路由器JSON路由器设置无线路由器h3c华三华三路由器设置华三路由器电脑软件教程arraysdocker软件图文教程Cvue.jslaravelspring-boot