Get-AzKeyVaultSecret: Operation get is not allowed on a disabled secret

[ktdixit]

Get-AzKeyVaultSecret -VaultName $keyVaultName

Error:
2021-06-30T12:20:46.1348367Z ##[error]Operation returned an invalid status code 'Forbidden'
Code: Forbidden
Message: Operation get is not allowed on a disabled secret.
2021-06-30T12:20:46.3023398Z ##[error]PowerShell exited with code '1'.

Note: I am running this command in AzureDevOps (Azure Powershell) which has Get, List, Set permission in Keyvault access policies (PermissionsToKeys and PermissionsToSecrets)

[dingmeng-xue]

Thanks for reporting. We will look into it.

[BethanyZhou]

Hi @ktdixit , what's the version of Az.KeyVault you are using? I remembered we have fixed this issue in #14740, please try Az.KeyVault>=3.4.3.

[ktdixit]

I am using AzurePowershell Task 5.x in Azure Pipelines. I want to get only enabled secrets and name of the disabled secrets (so that we will know what are disabled)

[BethanyZhou]

Thanks for your quick response.

I recommend to use our latest Azure PowerShell version as following:

Latest Az PowerShell supports what you want to do:

[ktdixit]

@BethanyZhou thanks for your response. I can get the secret names status (true or false) using Get-AzKeyVaultSecret -VaultName $(keyVaultName) with azure powershell version 6.1.0 (specific version), but it doesn't skip disabled secrets. Entire pipeline fails.
Scenario: I have 50+ secrets in a keyvault and 15th secret is disabled, it doesnt move to the next secret for printing.

Here is my code: Am I missing any parameter?

Get-AzKeyVaultSecret -VaultName $(keyVaultName) -AsPlainText | Foreach-Object {
$secret = Get-AzKeyVaultSecret -VaultName $(keyVaultName) -Name $.Name -AsPlainText
@{
"Value" = $secret; "Name" = $.Name
}
}
Error:
##[error]Operation returned an invalid status code 'Forbidden'
Code: Forbidden
Message: Operation get is not allowed on a disabled secret.
2021-07-01T17:18:35.7987139Z ##[error]PowerShell exited with code '1'.
2021-07-01T17:18:36.6177123Z ##[section]Finishing: AzureDevOps Account - Get Keyvault Secret

[BethanyZhou]

Hi @ktdixit ,

Thanks for sharing further information.

I believe the error is from $secret = Get-AzKeyVaultSecret -VaultName $(keyVaultName) -Name $.Name -AsPlainText. We are not allowed to perform Get operation on a disabled secret.

As you said you only want to get the name of disable secrets, I suggest following code:

Get-AzKeyVaultSecret -VaultName $(keyVaultName) | Foreach-Object {
  if($_.Enabled){
    $secret = Get-AzKeyVaultSecret -VaultName $(keyVaultName) -Name $_.Name -AsPlainText
    @{"Value" = $secret; "Name" = $_.Name}
  }else{
    @{"Value" = "None"; "Name" = $_.Name}
  }
}

[ktdixit]

@BethanyZhou works perfectly fine. Thank you so much for your help. Much appreciated