This Runbook will Check if any of the Secrets, Keys and Certificates within Key Vault and Webhook within Runbook is nearing expiry or is expiring today
Param(
[string]$SubscriptionID='XXXX',
[int]$DaysNearExpiration=5000,
[string]$VaultName = 'XXX',
[string]$AutomationAccountResourceGroup = 'XXX'
)
write-verbose "Connecting to Azure"
$connectionName = "AzureRunAsConnection"
try
{
# Get the connection "AzureRunAsConnection "
$servicePrincipalConnection = Get-AutomationConnection -Name $connectionName
"Logging in to Azure..."
Add-AzureRmAccount `
-ServicePrincipal `
-TenantId $servicePrincipalConnection.TenantId `
-ApplicationId $servicePrincipalConnection.ApplicationId `
-CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint
}
catch {
if (!$servicePrincipalConnection)
{
$ErrorMessage = "Connection $connectionName not found."
throw $ErrorMessage
} else{
Write-Error -Message $_.Exception.Message
throw $_.Exception
}
}
Select-AzureRmSubscription -SubscriptionId $SubscriptionID
$ExpiredSecrets = @()
$NearExpirationSecrets = @()
$ExpiredSecretsToday = @()
#gather all key vaults from subscription
if ($VaultName) {
$KeyVaults = Get-AzureRmKeyVault -VaultName $VaultName
}
else {
$KeyVaults = Get-AzureRmKeyVault
}
#check date which will notify about expiration
$ExpirationDate = (Get-Date (Get-Date).AddDays($DaysNearExpiration) -Format yyyyMMdd)
$CurrentDate = (Get-Date -Format yyyyMMdd)
# iterate across all key vaults in subscription
foreach ($KeyVault in $KeyVaults) {
# gather all secrets in each key vault
$SecretsArray = Get-AzureKeyVaultSecret -VaultName $KeyVault.VaultName
foreach ($secret in $SecretsArray) {
# check if expiration date is set
if ($secret.Expires) {
$secretExpiration = Get-date $secret.Expires -Format yyyyMMdd
# check if expiration date set on secret is before notify expiration date
if ($ExpirationDate -gt $secretExpiration) {
# check if secret did not expire yet but will expire soon
if ($CurrentDate -lt $secretExpiration) {
$NearExpirationSecrets += New-Object PSObject -Property @{
Name = $secret.Name;
Category = 'SecretNearExpiration';
KeyVaultName = $KeyVault.VaultName;
ExpirationDate = $secret.Expires;
}
}
elseif ($CurrentDate -eq $secretExpiration)
{
$ExpiredSecretsToday += New-Object PSObject -Property @{
Name = $secret.Name;
Category = 'SecretExpiringToday';
KeyVaultName = $KeyVault.VaultName;
ExpirationDate = $secret.Expires;
}
}
# secret is already expired
else {
$ExpiredSecrets += New-Object PSObject -Property @{
Name = $secret.Name;
Category = 'SecretNearExpiration';
KeyVaultName = $KeyVault.VaultName;
ExpirationDate = $secret.Expires;
}
}
}
}
}
$certArray = Get-AzureKeyVaultCertificate $KeyVault.VaultName
foreach ($cert in $certArray) {
# check if expiration date is set
if ($cert.Expires) {
$certExpiration = Get-date $cert.Expires -Format yyyyMMdd
# check if expiration date set on secret is before notify expiration date
if ($ExpirationDate -gt $certExpiration) {
# check if secret did not expire yet but will expire soon
if ($CurrentDate -lt $certExpiration) {
$NearExpirationSecrets += New-Object PSObject -Property @{
Name = $cert.Name;
Category = 'CertNearExpiration';
ServiceName = $KeyVault.VaultName;
ExpirationDate = $cert.Expires;
}
}
elseif ($CurrentDate -eq $certExpiration)
{
$ExpiredSecretsToday += New-Object PSObject -Property @{
Name = $cert.Name;
Category = 'CertExpiringToday';
ServiceName = $KeyVault.VaultName;
ExpirationDate = $cert.Expires;
}
}
# secret is already expired
else {
$ExpiredSecrets += New-Object PSObject -Property @{
Name = $cert.Name;
Category = 'CertNearExpiration';
ServiceName = $KeyVault.VaultName;
ExpirationDate = $cert.Expires;
}
}
}
}
}
$keysArray = Get-AzureKeyVaultKey $KeyVault.VaultName
foreach ($key in $keysArray) {
# check if expiration date is set
if ($key.Expires) {
$keyExpiration = Get-date $key.Expires -Format yyyyMMdd
# check if expiration date set on secret is before notify expiration date
if ($ExpirationDate -gt $keyExpiration) {
# check if secret did not expire yet but will expire soon
if ($CurrentDate -lt $keyExpiration) {
$NearExpirationSecrets += New-Object PSObject -Property @{
Name = $key.Name;
Category = 'KeyNearExpiration';
ServiceName = $KeyVault.VaultName;
ExpirationDate = $key.Expires;
}
}
elseif ($CurrentDate -eq $keyExpiration)
{
$ExpiredSecretsToday += New-Object PSObject -Property @{
Name = $key.Name;
Category = 'KeyExpiringToday';
ServiceName = $KeyVault.VaultName;
ExpirationDate = $key.Expires;
}
}
# secret is already expired
else {
$ExpiredSecrets += New-Object PSObject -Property @{
Name = $key.Name;
Category = 'KeyNearExpiration';
ServiceName = $KeyVault.VaultName;
ExpirationDate = $key.Expires;
}
}
}
}
}
}
Get-AzureRmResourceGroup -Name $AutomationAccountResourceGroup | `
Get-AzureRmAutomationAccount | `
Get-AzureRmAutomationWebhook | `
ForEach($_ )`
{
if ($_.ExpiryTime) {
$cstzone = [System.TimeZoneInfo]::FindSystemTimeZoneById("Central Standard Time")
$csttime = [System.TimeZoneInfo]::ConvertTimeFromUtc($_.ExpiryTime.UtcDateTime, $cstzone)
$webhkExpiration = Get-date $csttime -Format yyyyMMdd
# check if expiration date set on secret is before notify expiration date
if ($ExpirationDate -gt $webhkExpiration) {
# check if secret did not expire yet but will expire soon
if ($CurrentDate -lt $webhkExpiration) {
$NearExpirationSecrets += New-Object PSObject -Property @{
Name = $_.Name;
Category = 'WebHookNearExpiration';
ServiceName = ($_.AutomationAccountName)+"\"+($_.RunbookName);
ExpirationDate = $_.ExpiryTime;
}
}
elseif ($CurrentDate -eq $webhkExpiration)
{
$ExpiredSecretsToday += New-Object PSObject -Property @{
Name = $_.Name;
Category = 'WebHookExpiringToday';
ServiceName = ($_.AutomationAccountName)+"\"+($_.RunbookName);
ExpirationDate = $_.ExpiryTime;
}
}
# secret is already expired
else {
$ExpiredSecrets += New-Object PSObject -Property @{
Name = $_.Name;
Category = 'WebHookNearExpiration';
ServiceName = ($_.AutomationAccountName)+"\"+($_.RunbookName);
ExpirationDate = $_.ExpiryTime;
}
}
}
}
}
if ($ExpiredSecretsToday.Count -gt 0 -or $NearExpirationSecrets.Count -gt 0)
{
$data=($ExpiredSecretsToday)
$message_array01="SecretExpiringToday:" + "[TotalCount: $($ExpiredSecretsToday.Count)]"
foreach ($dt in $data)
{
$message_array01 += "[Name:"+$dt.Name+" ExpDate:"+$dt.ExpirationDate+"]"
}
$data=($NearExpirationSecrets)
$message_array02="SecretNearExpiration:"+ "[Total Count: $($ExpiredSecretsToday.Count)]"
foreach ($dt in $data)
{
$message_array02 += "[Name:"+$dt.Name+" ExpDate:"+$dt.ExpirationDate+"]"
}
Write-Output $message_array01 + "`r`n" + $message_array02
throw $message_array01 + "`r`n" + $message_array02
}
