Azure Key Vault - Retrieve Secrets

To use this template in Octopus Deploy, copy the JSON below and paste it into the Library → Step templates → Import dialog.

{
  "Id": "6f59f8aa-b2db-4f7a-b02d-a72c13d386f0",
  "Name": "Azure Key Vault - Retrieve Secrets",
  "Description": "This step retrieves one or more secrets from an Azure Key Vault and creates [sensitive output variables](https://octopus.com/docs/projects/variables/output-variables#sensitive-output-variables) for each value retrieved. These values can be used in other steps in your deployment or runbook process.\n\nYou can retrieve secrets with a specific version, and you can choose a custom output variable name for each secret.\n\n---\n\n**Required:** \n- An azure account with permissions to retrieve secrets from the Azure Key Vault.\n- The`Az.KeyVault` PowerShell module installed on the target or worker. If the module can't be found, the step will fail. *The `Az` module(s) can be installed from the [PowerShell gallery](https://www.powershellgallery.com/packages/Az)*\n\nNotes:\n\n- Tested on Octopus `2021.1`.\n- Tested with both Windows PowerShell and PowerShell Core on Linux.\n\n",
  "Version": 2,
  "ExportedAt": "2021-06-02T08:34:02.548Z",
  "ActionType": "Octopus.AzurePowerShell",
  "Author": "harrisonmeister",
  "Packages": [],
  "Parameters": [
    {
      "Id": "5b05337d-a62d-44f4-a702-95b45a400160",
      "Name": "Azure.KeyVault.RetrieveSecrets.Account",
      "Label": "Azure Account",
      "HelpText": "An Azure account with permissions to retrieve secrets from the Azure Key Vault.",
      "DefaultValue": "",
      "DisplaySettings": {
        "Octopus.ControlType": "AzureAccount"
      }
    },
    {
      "Id": "9b09b2b3-3c4d-4cbb-a065-8955f62448ad",
      "Name": "Azure.KeyVault.RetrieveSecrets.VaultName",
      "Label": "Vault Name",
      "HelpText": "The name of the Azure Key Vault to retrieve secrets from.",
      "DefaultValue": "",
      "DisplaySettings": {
        "Octopus.ControlType": "SingleLineText"
      }
    },
    {
      "Id": "43949afd-1049-41fc-bd01-e878476f5952",
      "Name": "Azure.KeyVault.RetrieveSecrets.VaultSecrets",
      "Label": "Vault Secrets to retrieve",
      "HelpText": "Specify the names of the Secrets to be returned from Azure Key Vault, in the format `SecretName SecretVersion | OutputVariableName` where:\n\n- `SecretName` is the name of the Secret to retrieve.\n- `SecretVersion` is the _optional_ version of the Secret to retrieve. *If this value isn't specified, the latest version will be retrieved*.\n- `OutputVariableName` is the _optional_ Octopus [output variable](https://octopus.com/docs/projects/variables/output-variables) name to store the secret's value in. *If this value isn't specified, an output name will be generated dynamically*.\n\n**Note:** Multiple fields can be retrieved by entering each one on a new line.",
      "DefaultValue": "",
      "DisplaySettings": {
        "Octopus.ControlType": "MultiLineText"
      }
    },
    {
      "Id": "46842344-405e-4633-a63f-115baaff7774",
      "Name": "Azure.KeyVault.RetrieveSecrets.PrintVariableNames",
      "Label": "Print output variable names",
      "HelpText": "Write out the Octopus [output variable](https://octopus.com/docs/projects/variables/output-variables) names to the task log. Default: `False`.",
      "DefaultValue": "False",
      "DisplaySettings": {
        "Octopus.ControlType": "Checkbox"
      }
    },
    {
      "Id": "0c20c004-c792-4acc-81c5-62ecceecf6ac",
      "Name": "Azure.KeyVault.RetrieveSecrets.AzModule.SpecificVersion",
      "Label": "Az PowerShell Module version (optional)",
      "HelpText": "If you wish to use a specific version of the `Az` PowerShell module (rather than the default), enter the version number here. e.g. `5.9.0`.\n\n**Note:** The version specified must exist on the machine.\n",
      "DefaultValue": "",
      "DisplaySettings": {
        "Octopus.ControlType": "SingleLineText"
      }
    },
    {
      "Id": "d4d93a9a-72e1-48be-9ed6-78986bbfaa06",
      "Name": "Azure.KeyVault.RetrieveSecrets.AzModule.CustomInstallLocation",
      "Label": "Az PowerShell Install Location (optional)",
      "HelpText": "If you wish to provide a custom path to the `Az` PowerShell module (rather than the default), enter the value here.\n\n**Note:** The Module must exist at the specified location on the machine. This step template will not download the Module.\n",
      "DefaultValue": "",
      "DisplaySettings": {
        "Octopus.ControlType": "SingleLineText"
      }
    }
  ],
  "Properties": {
    "Octopus.Action.Script.ScriptSource": "Inline",
    "Octopus.Action.Script.Syntax": "PowerShell",
    "OctopusUseBundledTooling": "False",
    "Octopus.Action.Script.ScriptBody": "[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12\n$ErrorActionPreference = 'Stop'\n\n# Variables\n$AzVaultModuleName = \"Az.KeyVault\"\n$AzureKeyVaultName = $OctopusParameters[\"Azure.KeyVault.RetrieveSecrets.VaultName\"]\n$VaultSecretNames = $OctopusParameters[\"Azure.KeyVault.RetrieveSecrets.VaultSecrets\"]\n$AzVaultModuleSpecificVersion = $OctopusParameters[\"Azure.KeyVault.RetrieveSecrets.AzModule.SpecificVersion\"]\n$AzVaultModuleCustomInstallLocation = $OctopusParameters[\"Azure.KeyVault.RetrieveSecrets.AzModule.CustomInstallLocation\"]\n$PrintVariableNames = $OctopusParameters[\"Azure.KeyVault.RetrieveSecrets.PrintVariableNames\"]\n\n# Validation\nif ([string]::IsNullOrWhiteSpace($AzureKeyVaultName)) {\n    throw \"Required parameter Azure.KeyVault.RetrieveSecrets.VaultName not specified\"\n}\nif ([string]::IsNullOrWhiteSpace($VaultSecretNames)) {\n    throw \"Required parameter Azure.KeyVault.RetrieveSecrets.VaultSecrets not specified\"\n}\n\nif ([string]::IsNullOrWhiteSpace($AzVaultModuleSpecificVersion) -eq $False) {\n    $requiredVersion = [Version]$AzVaultModuleSpecificVersion\n}\n\n# Cross-platform bits\n$WindowsPowerShell = $True\nif ($PSEdition -eq \"Core\") {\n    $WindowsPowerShell = $False\n}\n\n### Helper functions\nfunction Get-Module-CrossPlatform {\n    [CmdletBinding()]\n    Param(\n        [Parameter(Mandatory = $true, Position = 0)]\n        [string] $Name\n    )\n\n    $module = Get-Module -Name $Name -ListAvailable\n    if($WindowsPowerShell -eq $True -and $null -eq $module) {\n        $module = Get-InstalledModule -Name $Name\n    }\n\n    return $module\n}\n\n$PowerShellModuleName = $AzVaultModuleName\n\n# Check for Custom install location specified for AzVaultModule\nif ([string]::IsNullOrWhiteSpace($AzVaultModuleCustomInstallLocation) -eq $false) {\n    if ((Test-Path $AzVaultModuleCustomInstallLocation -IsValid) -eq $false) {\n        throw \"The path $AzVaultModuleCustomInstallLocation is not valid, please use a relative or absolute path.\"\n    }\n    \n    $AzVaultModulesFolder = [System.IO.Path]::GetFullPath($AzVaultModuleCustomInstallLocation)            \n    $LocalModules = (New-Item \"$AzVaultModulesFolder\" -ItemType Directory -Force).FullName\n    $env:PSModulePath = $LocalModules + [System.IO.Path]::PathSeparator + $env:PSModulePath\n\n    # Check to see if there\n    if ((Test-Path -Path \"$LocalModules/$AzVaultModuleName\") -eq $true)\n    {\n        # Use specific location\n        $PowerShellModuleName = \"$LocalModules/$PowerShellModuleName\"\n    }\n}\n\n# Import module\nif([string]::IsNullOrWhiteSpace($AzVaultModuleSpecificVersion)) {\n    Write-Host \"Importing module $PowerShellModuleName ...\"\n    Import-Module -Name $PowerShellModuleName\n}\nelse {\n    Write-Host \"Importing module $PowerShellModuleName ($AzVaultModuleSpecificVersion)...\"\n    Import-Module -Name $PowerShellModuleName -RequiredVersion $requiredVersion\n}\n\n# Check if Az.Vault Module is installed.\n$azVaultModule = Get-Module-CrossPlatform -Name $AzVaultModuleName\t\nif ($null -eq $azVaultModule) {\n    throw \"Cannot find the '$AzVaultModuleName' module on the machine. If you think it is installed, try restarting the Tentacle service for it to be detected.\"\t\n}\n\n$Secrets = @()\n$VariablesCreated = 0\n$StepName = $OctopusParameters[\"Octopus.Step.Name\"]\n\n# Extract secret names+versions \n@(($VaultSecretNames -Split \"`n\").Trim()) | ForEach-Object {\n    if (![string]::IsNullOrWhiteSpace($_)) {\n        Write-Verbose \"Working on: '$_'\"\n        $secretDefinition = ($_ -Split \"\\|\")\n        $secretName = $secretDefinition[0].Trim()\n        $secretNameAndVersion = ($secretName -Split \" \")\n        $secretVersion = $null\n        if($secretNameAndVersion.Count -gt 1) {\n        \t$secretName = $secretNameAndVersion[0].Trim()\n            $secretVersion = $secretNameAndVersion[1].Trim()\n        }\n        if([string]::IsNullOrWhiteSpace($secretName)) {\n            throw \"Unable to establish secret name from: '$($_)'\"\n        }\n        $secret = [PsCustomObject]@{\n            Name         = $secretName\n            SecretVersion= $secretVersion\n            VariableName = if (![string]::IsNullOrWhiteSpace($secretDefinition[1])) { $secretDefinition[1].Trim() } else { \"\" }\n        }\n        $Secrets += $secret\n    }\n}\n\nWrite-Verbose \"Vault Name: $AzureKeyVaultName\"\nWrite-Verbose \"Print variables: $PrintVariableNames\"\nWrite-Verbose \"Secrets to retrieve: $($Secrets.Count)\"\nWrite-Verbose \"Az Version specified: $AzVaultModuleSpecificVersion\"\nWrite-Verbose \"Az Custom Install Dir: $AzVaultModuleCustomInstallLocation\"\n\n# Retrieve Secrets\nforeach($secret in $secrets) {\n    $name = $secret.Name\n    $secretVersion = $secret.SecretVersion\n    $variableName = $secret.VariableName\n    if ([string]::IsNullOrWhiteSpace($variableName)) {\n        $variableName = \"$($AzureKeyVaultName.Trim()).$($name.Trim())\"\n    }\n    \n    if ([string]::IsNullOrWhiteSpace($secretVersion)) {\n    \t$azSecretValue = Get-AzKeyVaultSecret -VaultName $AzureKeyVaultName -Name $name -AsPlainText    \n    }\n    else {\n    \t$azSecretValue = Get-AzKeyVaultSecret -VaultName $AzureKeyVaultName -Name $name -Version $secretVersion -AsPlainText\n    }\n    \n    Set-OctopusVariable -Name $variableName -Value $azSecretValue -Sensitive\n\n    if($PrintVariableNames -eq $True) {\n        Write-Host \"Created output variable: ##{Octopus.Action[$StepName].Output.$variableName}\"\n    }\n    $VariablesCreated += 1\n}\n\nWrite-Host \"Created $variablesCreated output variables\"",
    "Octopus.Action.Azure.AccountId": "#{Azure.KeyVault.RetrieveSecrets.Account}"
  },
  "Category": "Azure Key Vault",
  "HistoryUrl": "https://github.com/OctopusDeploy/Library/commits/master/step-templates//opt/buildagent/work/75443764cd38076d/step-templates/azure-keyvault-retrieve-secrets.json",
  "Website": "/step-templates/6f59f8aa-b2db-4f7a-b02d-a72c13d386f0",
  "Logo": "iVBORw0KGgoAAAANSUhEUgAAADUAAAA2CAIAAADoEEaJAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAKTklEQVRoge2Ze3BU1R3Hv+ece/eVZLOLeQHmwUOUIDpaKxSQgh1xHAUlMJ0+pjr1MaMzOFpASOv0P8eqPHRG1PpogUrbP1qDilZ8gUBsobXGlppSMQgJkGQ3ye5mk9zde+85v/6xz2x2k1V8/eFvds7cvff3+93P/s7vnPM7ZxkR4Wss/KsGmEC+4Ts30c7Rvq3bCMfk/o4hBpwMWwRM8zsU0dUzSn0ucdlk9zn6Z59tfOxuj7zYPvjOKaMzYoMzziAYm+PsAdjReDURFBEU1XnF0mmeG2d7VzaWfxl84Zjc2hp8+EjINMmpCQ9jTsEFcNeUlnur95QIG4RhqT3WvfypQJOtyCJEpbQUOTVsmO9fu6jS5xJfFN+jrcH7D/QZNisXvERwnTOdM5+D/+7Sx2bTEQAgAAxEILTzebccvTdsKktRXJEhVcSWbh3brqu+9fJJnzNfW7ex/PedZ6LS69DKOHdqvLZUrFkwaclMT8WZ+9F9AIyBCIxBUQqRoWZxX90D+zuMJ/8a6opaMUVDtorY8pIKfceqqUWm5sR8Le3hm3f32BJ+XXML1uDVH7m+6opaFwAcb0bgYFKv6iqc9z0A6HsbPYdAgCLUfBezHwLwXld8w6u9nYP2sFRhSwqhXv5h7dXTS8+Vb2trcN2bwTJN+Bya38GfXjV5Xq2LMQBAx0YEDoGl4KY/nDE7vgG9rVAEYqhejIseAkCEI52xu3b39MXsqK0iprX12uqfLawYn2+8+W9za3Ddm0GfQ5vk0GaV64fuqp9fl4I70Yz+Q9AYBKAxVK0cZVnTBA4IBg4EDuJYMwDGML/edeDOuov8Tp8ufE597euBra3Bz8jX0h6+782gX9d8urj+gpK9d9R6XSnlT5rRfzD5+kQ7VjSAAwLZiAC8Lv7a7effMKvUp4lJTn3dG4F9J4Y+NV9bt3Hz7p4yXfPq4sdzvdtWVmuCJZ+dbMbAoRQcwAEODLSMsh9oAWfQsnQCB9KImmCP31T1/YvLyjRe5tBX/LGrrdsoxJc//87f/L/ACNU49Vnl+mt31OppuFPN6D+U/FEcoFTLAP9C+JsAYGA3+loBQAEKkAQCJKCAqmQuArAkXfNMZ0fEClryQr/415qZxfL98q2eB1pDNU7dp4n37qkvcaRifGoj+lvBAZb1AcBS9EQAgyIQkp80ospCnJ1EDI3IhU92hiy7J24/t7z6tm/lmRdz+zcck5sOh7y6cAv27OqaDFzgtxm4RJ9m5x8HGEGwZJu8k6XJAAEwQu9BdG1PuPR7xDOrakqEKNfE3XsDYUNOzLelNRiXKOO8wasvbHBlHnQ/n/VKBs7AEhejITgDo9RTZFqB1FPgk51prwsaXA1erVTjhk1b3s0zlnP5HjkSKhfCJfijK6pYuuOMD0Fm7iuHJHpMdGd9ekz0mui10GsiYCFgIWgiYI6y4oCMwzidfD1jW1ZUuzjzaWLT4dBYvlH1VUt7xDSpwsXnVDkvneLK1WVZMWBA0ELYHusxKZR1UekAZ1AEDiiAMdiDacVLpzgvqXb97awRjsuW9nBTo68g34vtg05N6JzdceXocsg9J/XrWWZYzBjzA3L4JIFYavxSFiKhrDFb99Zvl7ftiemcvdQeHY/vwCnDzZnO2cIGT+77Kq7FwOtACg7AWRPd5gSIAHSGWR4wBlDStuEHOYrfqXdrnJUI/s7JkZxHGb62bqMzYtW4nT4n93vGzNvV92LkA1iBzB0HQ+lExRwBGsuahgilk1F/T47WeSXCLZiTsc6o3dZtZJc2Gb6QIcG5AK6/KF9ZIbyYtgOdP4XZm7xToaNCnwBOAoqgUlEvmYzZ2/Pqrry47Dfvh8FYaPQsk4nT/hNDnIFzVukpEBXhRd12OKvGY8rhy7721GD2dmjevLrVJRoDOGP7OqL5+RggGOPA5ecXTnzhRe2OT4GYFk81LiwIB+CSKU7BGGPg6Ukth+9k2ALAGHM7WK51DmJdcYiJlZMAVw0u2AFREA6AR+cM0Bj7JGTl5wMgwEA0Ll3CqAjE9F7EVYOZ28eHA8A5AVBEfveo7MrwNfh0CwRgxCxix5RA5AXGR7I4IHAHZkwMB8AwE+nKfK5RIct8UUREUISjPfGJ+RKI9dvyIKYrF+7A9G3FwAF4/4xBBEkqJzYZvqtnlCmlJChvHZFfHHMw6cZRd1QaTsf0bXDNKdJTxJCSSBGWjt40Zfj8bgGCrajlaHSMeWHJqfMS10RQn8YH0e4PhywAqnD+XTbZXesVFqE/pkIjRbtPrK3DEh2x5GqrCBKwTXy0BnJwYg9A2KCISZZU9V4tZ188KhmXNniGpbSI3h2zDo7HpwCTYFNW/AAFWCaOrynGx7snR0ylDEWLG3I37aP4bmwsiyuKK/XMkXDRfAwSGSyZVdArQsWKiR0Q/fpw2FIUk/KmxtzBNIqvqdGnazAktQfN/xQ5ilVq+wNkQBOItbejYvWEDv7dHT/WZw5LpeusacwxV26d0jzfH7FlTKnmV4PFHh0lsBJjItHLMhXOiYSI1u8JxqSKSLVxnn+sQi7f2kWVTg1DtjrWb75/pogQKgZJyQ61Ey2S7cfPofeF8a3/0RXviJhRpZyC1l1VOTGfzyUeWFIRseWwLW//c89wfKKBnAZK9HISjpJdfPblcUyH4+rWP501JA2a9oNLKvIeDeY5P1i/qHJuhR62VV/MXr3rrC3H7adktqVyTibgGGyCZyrmPl7Izla0etfZiEX9lj230rF2UZ7g5ecDsHPVVM5V1Fb/7YuveyUwXiISS0aLAJmY/1J3LlhfqKAiorUvBY71xSOWrQnsXDW1kPv8fJdNdj/fNCVi2hFbvnxs6O4Xe61CUUwELzHz2en4ATbQvhlWnvnZkrRmd++ej4bCtoxactfKmnHOKgueXzU1lm9ZVhmO24O2euWj4WXPns6/LhODnVXHZw+R0Gl88Isc9dCIvObpzr8cH45YMmzam5ZV5mzYiuUDsHZR5ZZllQNxa8CSH4fjC57ofPv4cG6BoVJLLWOpzEMyihKoXpqt+PbHwwue6OwYtPstO2Tam66pXF8g7dJSzPlu5CctZyVxn+Clmphaqj1yQ9W8utQeYOQ03lqdPH9Gdgtcfh/qVgEgwt+7YhteDXRFLUNSv2VrArtW1owfuWL5ALR1G7e8cOZon1WuiVKNuzifWqrddqVv6Ux3rU9H5wv456akKqWm5Ss2qLqVZyL2Ox3Gc0fCZ4bsmFRRpQYtObdC3/k5no+nZXNr8P4DfaYFny5cnLk41xjTOVsyzXOda+/ykafAkOjrPZ4795rX7TsxIgmmUpaiYakiUjkFPbikotBUcq58AMIxuaU1+PDhkGVD56xEcCdjGmcC7EfeN37l3wng5wO3/CG6TBJZgKlUTFJMSl1nG+f7132h/89kS0t7+KX26P6TI11RCYBzzhjmOgJE1G7VSFKKAKXqvfriBvdNjd6xC/8Xy5eWtm4jZMh9HVHOWGKH2uDTCVg6vdTv/ur+H/zS5Ov+/+83fOcm/wdmDxf7M5IELQAAAABJRU5ErkJggg==",
  "$Meta": {
    "Type": "ActionTemplate"
  }
}

History