如何使用Powershell在

如何解决如何使用Powershell在

我正在Powershell中编写一个小程序，该程序连接到Office 365以下载审核日志，进行一些更改，然后将CSV导出到Azure Data Lake Storage帐户。为了按计划运行此过程，我创建了一个Azure Function应用（计时器模板）来运行该程序。为避免使用硬编码的凭据，我创建了一个Azure密钥保管库来存储凭据机密。我在Azure Function中创建了一个托管身份，使用凭据在Azure Key Vault中创建了机密，然后在URL的“配置”下的Azure Function中创建了三个应用程序设置，并指向URL，以指向存储在Azure Key Vault中的机密。

这三个应用程序设置分别称为“ SecretUsername”，“ SecretPassword”（指向Office 365）和“ SecretSAS”（用于将CSV存储在ADLS中）。

如何在Powershell脚本中引用这些变量？我在代码中尝试了其他变体，但似乎没有一个起作用。例子：

$ uSecret = $ SecretUsername
$ uSecret = $ ENV：SecretUsername
$ uSecret = ENV：SecretUsername

$ uSecret =（Get-ChildItem ENV：SecretUsername）.SecretValueText

 # Input bindings are passed in via param block.
 param($Timer)

 # Get the current universal time in the default string format.
 $currentUTCtime = (Get-Date).ToUniversalTime()

 # The 'IsPastDue' property is 'true' when the current function invocation is later than scheduled.
 if ($Timer.IsPastDue) {
     Write-Host "PowerShell timer is running late!"
 }

 # Write an information log with the current time.
 Write-Host "PowerShell timer trigger function ran! TIME: $currentUTCtime"

 Set-ExecutionPolicy AllSigned 
 Set-Item ENV:\SuppressAzurePowerShellBreakingChangeWarnings "true"

 $uSecret = (Get-ChildItem ENV:SecretUsername).SecretValueText 
 $pSecret = (Get-ChildItem ENV:SecretPassword).SecretValueText 
 $sasSecret = (Get-ChildItem ENV:SecretSAS).SecretValueText 
 $securePassword = ConvertTo-SecureString -String $pSecret -AsPlainText -Force
 $UserCredential = New-Object -TypeName "System.Management.Automation.PSCredential" -ArgumentList $uSecret,$securePassword

 $session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri https://outlook.office365.com/powershell-liveid/ -Credential $UserCredential -Authentication Basic -AllowRedirection
 Import-PSSession $session

 $startDate=(get-date).AddDays(-10)
 $endDate=(get-date)
 $scriptStart=(get-date)

 $sessionName = (get-date -Format 'u')+'pbiauditlog'

 $aggregateResults = @()
 $i = 0 # Loop counter
 Do { 
     $currentResults = Search-UnifiedAuditLog -StartDate $startDate -EndDate $enddate -SessionId $sessionName -SessionCommand ReturnLargeSet -ResultSize 1000 -RecordType PowerBIAudit
     if ($currentResults.Count -gt 0) {
         Write-Host ("Finished {3} search #{1},{2} records: {0} min" -f [math]::Round((New-TimeSpan -Start $scriptStart).TotalMinutes,4),$i,$currentResults.Count,$user.UserPrincipalName )
         # Accumulate the data.
         $aggregateResults += $currentResults
         # No need to do another query if the # records returned <1000 - should save around 5-10 seconds per user.
         if ($currentResults.Count -lt 1000) {
             $currentResults = @()
         } else {
             $i++
         }
     }
 } Until ($currentResults.Count -eq 0) # End of Session Search Loop.

 $data=@()

 foreach ($auditlogitem in $aggregateResults) {
     $datum = New-Object -TypeName PSObject  
     $d = ConvertFrom-json $auditlogitem.AuditData
     $datum | Add-Member -MemberType NoteProperty -Name Id -Value $d.Id
     $datum | Add-Member -MemberType NoteProperty -Name CreationTDateTime -Value $d.CreationDate
     $datum | Add-Member -MemberType NoteProperty -Name CreationTime -Value $d.CreationTime
     $datum | Add-Member -MemberType NoteProperty -Name RecordType -Value $d.RecordType
     $datum | Add-Member -MemberType NoteProperty -Name Operation -Value $d.Operation
     $datum | Add-Member -MemberType NoteProperty -Name OrganizationId -Value $d.OrganizationId
     $datum | Add-Member -MemberType NoteProperty -Name UserType -Value $d.UserType
     $datum | Add-Member -MemberType NoteProperty -Name UserKey -Value $d.UserKey
     $datum | Add-Member -MemberType NoteProperty -Name Workload -Value $d.Workload        
     $datum | Add-Member -MemberType NoteProperty -Name UserId -Value $d.UserId
     $datum | Add-Member -MemberType NoteProperty -Name ClientIPAddress -Value $d.ClientIPAddress
     $datum | Add-Member -MemberType NoteProperty -Name UserAgent -Value $d.UserAgent
     $datum | Add-Member -MemberType NoteProperty -Name Activity -Value $d.Activity
     $datum | Add-Member -MemberType NoteProperty -Name ItemName -Value $d.ItemName
     $datum | Add-Member -MemberType NoteProperty -Name WorkSpaceName -Value $d.WorkSpaceName
     $datum | Add-Member -MemberType NoteProperty -Name DashboardName -Value $d.DashboardName
     $datum | Add-Member -MemberType NoteProperty -Name DatasetName -Value $d.DatasetName
     $datum | Add-Member -MemberType NoteProperty -Name ReportName -Value $d.ReportName
     $datum | Add-Member -MemberType NoteProperty -Name WorkspaceId -Value $d.WorkspaceId
     $datum | Add-Member -MemberType NoteProperty -Name ObjectId -Value $d.ObjectId
     $datum | Add-Member -MemberType NoteProperty -Name DashboardId -Value $d.DashboardId
     $datum | Add-Member -MemberType NoteProperty -Name DatasetId -Value $d.DatasetId
     $datum | Add-Member -MemberType NoteProperty -Name ReportId -Value $d.ReportId
     $datum | Add-Member -MemberType NoteProperty -Name OrgAppPermission -Value $d.OrgAppPermission

     # Option to include the below JSON column however for large amounts of data it may be difficult for PBI to parse
     $datum | Add-Member -MemberType NoteProperty -Name Datasets -Value (ConvertTo-Json $d.Datasets)

     # Below is a simple PowerShell statement to grab one of the entries and place in the DatasetName if any exist
     foreach ($dataset in $d.datasets) {
         $datum.DatasetName = $dataset.DatasetName
         $datum.DatasetId = $dataset.DatasetId
     }
     $data+=$datum
 }

 $dateTimestring = $startDate.ToString("yyyyMMdd") + "_" + (Get-Date -Format "yyyyMMdd") + "_" + (Get-Date -Format "HHmm")
 $fileName = ($dateTimestring + ".csv")
 Write-Host ("Writing to file {0}" -f $fileName) 
 $filePath = "$Env:temp/" + $fileName
 $data | Export-csv -Path $filePath

 Connect-AzAccount -Credential $UserCredential
 Get-AzVM -ResourceGroupName "Audit" -status
 $Context = New-AzStorageContext -StorageAccountName "auditingstorage" -StorageAccountKey $sasSecret
 Set-AzStorageBlobContent -Force -Context $Context -Container "auditlogs" -File $filePath -Blob $filename 

 Remove-PSSession -Id $Session.Id

如何引用Azure Function中的应用程序设置，以便可以在程序中使用存储的机密？

请协助！非常感谢！

解决方法

要访问或不通过密钥库访问应用程序设置，必须通过$env:APPSETTING_YourSettingName

对其进行检索。

因此，对于您的密钥库引用的机密，您可以通过以下变量进行访问。

$env:APPSETTING_SecretUserName
$env:APPSETTING_SecretPassword
$env:APPSETTING_SecretSAS

如果需要，您需要列出它们的列表。

Get-ChildItem env:APPSETTING_*

注意，返回的值将是纯文本未加密的字符串。因此，在您的代码中，这是

 $uSecret = (Get-ChildItem ENV:SecretUsername).SecretValueText

成为：

 $uSecret = $env:APPSETTING_SecretUserName

附加说明

由于评论中已指出，因此我将提及它。我完全不主张在应用程序设置中使用明文秘密。

应用程序设置应为任何敏感数据的密钥库参考。我只是简单地说，可以在运行时通过$env:APPSETTING_YourSettingName变量以明文形式检索它。

示例： AppSetting名称：MySecretUser AppSetting值：@ Microsoft.KeyVault（SecretUri = https：//myvault.vault.azure.net/secrets/mysecret/ec96f02080254f109c51a1f14cdb1931）实际秘密值（在密钥库中）：I_AM_Secret

在运行时，获取值$env:APPSETTING_MySecretUser将返回值为 I_AM_Secret

的字符串对象。

如何使用Powershell在

如何解决如何使用Powershell在

解决方法

相关推荐