Azure / Azure/azure-powershell
Secret unexpectedly deleted from keyvault
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
### Description
cross-reference of https://github.com/PowerShell/SecretManagement/issues/227
### Issue script & Debug output
```PowerShell
PS> Set-Secret -Name "SomeSecret" -SecureStringSecret $NewPasswordSecureString -Vault MyVault -Metadata @{Expiration = (Get-Date).AddMonth(1)}
^^ this doesnt set metadata but deletes the secret
Exception :
Type : System.Management.Automation.PSNotSupportedException
ErrorRecord :
Exception :
Type : System.Management.Automation.ParentContainsErrorRecordException
Message : Cannot add secret metadata '...' to vault '...: The vault does not support the
Set-SecretInfo function.
HResult : -2146233087
CategoryInfo : NotImplemented: (:) [], ParentContainsErrorRecordException
FullyQualifiedErrorId : NotSupported
Message : Cannot add secret metadata '...' to vault '...: The vault does not support the
Set-SecretInfo function.
HResult : -2146233067
TargetObject : Microsoft.PowerShell.SecretManagement.ExtensionVaultModule
CategoryInfo : NotImplemented: (Microsoft.PowerShel…xtensionVaultModule:ExtensionVaultModule) [Set-Secret],
PSNotSupportedException
FullyQualifiedErrorId : SetSecretMetadataCommandNotSupported,Microsoft.PowerShell.SecretManagement.SetSecretCommand
InvocationInfo :
MyCommand : Set-Secret
ScriptLineNumber : 1
OffsetInLine : 1
HistoryId : 48
Line : Set-Secret -Name "..." -SecureStringSecret $(New-Password -SecureString) -Vault
...-Metadata @{Expiration = (Get-Date).AddDays(100)} -Debug
PositionMessage : At line:1 char:1
+ Set-Secret -Name "..." -SecureStringSecret $(New-Password -Sec …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
InvocationName : Set-Secret
CommandOrigin : Internal
ScriptStackTrace : at , : line 1
PipelineIterationInfo :
```
### Environment data
```PowerShell
$PSVersionTable
Name Value
---- -----
PSVersion 7.4.4
PSEdition Core
GitCommitId 7.4.4
OS Microsoft Windows 10.0.20348
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```
### Module versions
```PowerShell
ModuleType Version PreRelease Name
---------- ------- ---------- ----
Script 3.0.3 Az.Accounts
Script 6.0.1 az.keyvault
```
### Error output
```PowerShell
Message : Cannot add secret metadata 'asdf' to vault 'asdf: The vault does not support the
Set-SecretInfo function.
StackTrace :
Exception : System.Management.Automation.PSNotSupportedException
InvocationInfo : {Set-Secret}
Line : Set-Secret -Name 'asdf' -Vault asdf-Secret (New-Password -SecureString) -Metadata
@{Expiration = (Get-Date).AddMonths(1)}
Position : At line:1 char:1
+ Set-Secret -Name 'asdf' -Vault asdf -Secret (New-Password -S …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
```
Contributor guide
Research direction
Start with the Set-Secret command shown in the issue and compare its metadata path with the reported Set-SecretInfo-not-supported error; review the cross-referenced SecretManagement issue for related context. Done means a metadata failure does not delete the existing secret, with the behavior covered by an appropriate regression test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, powershell
- Domain
- cloud, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100