Azure / Azure/azure-powershell

[Feature]: Az.KeyVault.Extension should support purging soft-deleted secrets with Remove-Secret

Open
#19,733 2 comments 0 reactions 0 assignees View on GitHub
act-identity-squad customer-reported feature-request KeyVault Tracking
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description of the new feature

With the strongly encouraged and soon to be mandatory "soft-delete" feature in Azure KeyVault, the contract provided by the SecretManagement module interface effectively breaks when you remove an existing secret because it is not actually removed. Attempting to create a new secret with the same name fails and you are locked out from creating a new secret with that name until the retention period expires.

```
> Set-Secret -Vault az-posh -Name foo -Secret bar
> Remove-Secret -Vault az-posh -Name foo
> Set-Secret -Vault az-posh -Name foo -Secret qux
Set-Secret: Operation returned an invalid status code 'Conflict'
Code: Conflict
Message: Secret foo is currently in a deleted but recoverable state, and its name cannot be reused; in this state, the secret can only be recovered or purged.
```

There is currently no way to explicitly purge a secret using only the functions available from the SecretManagement module which is a problem for module authors who are trying to provide generic SecretManagement support in their code. They shouldn't need to rely on vault specific functionality to get basic Set/Remove secret support working.

### Proposed implementation details (optional)

When registering a vault with SecretManagement, a `VaultParameters` hashtable is used to provide extension specific parameters to the vault extension. Az.KeyVault.Extension currently allows for `AZKVaultName` and `SubscriptionId`. I propose adding a third optional parameter such as `PurgeOnRemove`.

`PurgeOnRemove` would be a boolean value. When set to `$true`, the `Remove-Secret` function would attempt to immediately purge a secret after deleting it from KeyVault.

This would of course require additional configuration in the KeyVault to allow purging from the requesting user. But that is something that can be documented and warned about. If the purge attempt fails, the delete would already have succeeded. So the user should be warned that the purge failed (and why if possible).

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.