Azure / Azure/azure-cli

az keyvault secret set exposes value

Open
#23,804 8 comments 4 reactions 1 assignee Claimed by @evelyn-ys View on GitHub
act-identity-squad Auto-Assign customer-reported feature-request KeyVault Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

It came to my attention (via a question I got from a colleague) that `az keyvault secret set` bluntly prints the secret value in **cleartext** to the output of the command (even if the secret was read from a file!).

I am aware this is a duplicate of #20858. The reason I am opening this issue anyway is that the suggestion there was to simply suppress the output of the command (via e.g. `--output none`) while the Key Vault API is being changed to no longer return the secret in its responses.

It is now more than half a year later, and the issue still occurs. Since printing a secret value in cleartext to stdout by default is a **big** violation of the Principle Of Least Astonishment, and it comes with a possibly significant security impact, I think it is warranted to introduce a workaround in Azure CLI so that it no longer prints the cleartext value of the secret.

Yes, changing the Key Vault API would also (and arguably better) solve this problem, but it is a design decision of Azure CLI to just dump the output of the response it gets to its API calls to stdout. Which means I think at least some of the responsibility is with Azure CLI to prevent this from happening.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.