Azure / Azure/azure-powershell

Secret unexpectedly deleted from keyvault

Open
#25,975 1 comment 0 reactions 0 assignees View on GitHub
bug customer-reported needs-triage
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

cross-reference of https://github.com/PowerShell/SecretManagement/issues/227

### Issue script & Debug output

```PowerShell
PS> Set-Secret -Name "SomeSecret" -SecureStringSecret $NewPasswordSecureString -Vault MyVault -Metadata @{Expiration = (Get-Date).AddMonth(1)}

^^ this doesnt set metadata but deletes the secret

Exception :
Type : System.Management.Automation.PSNotSupportedException
ErrorRecord :
Exception :
Type : System.Management.Automation.ParentContainsErrorRecordException
Message : Cannot add secret metadata '...' to vault '...: The vault does not support the
Set-SecretInfo function.
HResult : -2146233087
CategoryInfo : NotImplemented: (:) [], ParentContainsErrorRecordException
FullyQualifiedErrorId : NotSupported
Message : Cannot add secret metadata '...' to vault '...: The vault does not support the
Set-SecretInfo function.
HResult : -2146233067
TargetObject : Microsoft.PowerShell.SecretManagement.ExtensionVaultModule
CategoryInfo : NotImplemented: (Microsoft.PowerShel…xtensionVaultModule:ExtensionVaultModule) [Set-Secret],
PSNotSupportedException
FullyQualifiedErrorId : SetSecretMetadataCommandNotSupported,Microsoft.PowerShell.SecretManagement.SetSecretCommand
InvocationInfo :
MyCommand : Set-Secret
ScriptLineNumber : 1
OffsetInLine : 1
HistoryId : 48
Line : Set-Secret -Name "..." -SecureStringSecret $(New-Password -SecureString) -Vault
...-Metadata @{Expiration = (Get-Date).AddDays(100)} -Debug
PositionMessage : At line:1 char:1
+ Set-Secret -Name "..." -SecureStringSecret $(New-Password -Sec …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
InvocationName : Set-Secret
CommandOrigin : Internal
ScriptStackTrace : at , : line 1
PipelineIterationInfo :
```

### Environment data

```PowerShell
$PSVersionTable

Name Value
---- -----
PSVersion 7.4.4
PSEdition Core
GitCommitId 7.4.4
OS Microsoft Windows 10.0.20348
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
ModuleType Version PreRelease Name
---------- ------- ---------- ----
Script 3.0.3 Az.Accounts
Script 6.0.1 az.keyvault
```

### Error output

```PowerShell
Message : Cannot add secret metadata 'asdf' to vault 'asdf: The vault does not support the
Set-SecretInfo function.
StackTrace :
Exception : System.Management.Automation.PSNotSupportedException
InvocationInfo : {Set-Secret}
Line : Set-Secret -Name 'asdf' -Vault asdf-Secret (New-Password -SecureString) -Metadata
@{Expiration = (Get-Date).AddMonths(1)}
Position : At line:1 char:1
+ Set-Secret -Name 'asdf' -Vault asdf -Secret (New-Password -S …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```

Contributor guide

Open the contributing guide

Research direction

Start with the Set-Secret command shown in the issue and compare its metadata path with the reported Set-SecretInfo-not-supported error; review the cross-referenced SecretManagement issue for related context. Done means a metadata failure does not delete the existing secret, with the behavior covered by an appropriate regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.