Does azure key vault support regular text files?

user_9373781 0
Viewed 2735

I have a text file which I use in a pipeline, this particular file contains secrets that the pipeline uses to authenticate against some service. The file looks like this.

app1|resource1|secret1
app2|resource2|secret2

This file is used to map the secret to each app. I've been told I can use azure key vault to store this info but I'm only seeing options for ssh keys, certificates and key value pair strings.

Any suggestions would be nice to hear. I should also note currently I'm using azure "Secure Files" to store this file, however it's not very intuitive because every time the file needs to be updated, you have to delete the current one, upload a new one then edit the pipeline to add it again.

Plus I need a central place where I can store this file so as to have anyone on my team edit it, and not just me.

azureportal azure-keyvault azure-devops azure
3 Answers

So I resolved the issue by taking the contents of the file and base64 encoding it, like this

base64 -w0 mapping_file.txt

The '-w0' puts everything on one line, then store the output as the value for the azure key vault secret:

mapping-file: encoded_value

In my script I simple decode the value and use the contents as is. My team members can now go to azure key vault, get the value, decode it, edit and encode it.

user_93737810

Yes, Azure supports plain text files. In the documentation, they call it multi-line secret instead of a regular text file.

I had a similar issue, I had to create a secret that contains a *.json file, which contains the private key among many other parameters.

I solved the issue by using the following commands in a terminal.

#Create the secret
az keyvault secret set --name SECRET_NAME --vault-name KEYVAULT_NAME --file FILE_NAME_WITH_ABSOLUT_PATH

#Download the secret
az keyvault secret download --name SECRET_NAME --vault-name KEYVAULT_NAME --file FILE_NAME_WITH_ABSOLUT_PATH

If you need to use the file inside a pipeline, you can solve the issue in two steps (tasks):

  1. Read the secret from the KeyVault (same as if it would be a normal password). This will store the contents of the file inside a pipeline variable.
  2. Create a task that stores the contents of the pipeline variable inside a file. This task can be for example a bash.

You can follow the example below:

parameters:
  - name: azureSubscription
    type: string
    default: 'my-subscription'

...

variables:
  - name: secretFileName
    value: /home/vsts/.config/appName/my-secret-file-name.json

...
# Your pipeline ...
...

 - task: AzureKeyVault@1
   displayName: "Reads the secret from Azure KeyVault"
   inputs:
     azureSubscription: ${{ parameters.azureSubscription }}
     KeyVaultName: "my-keyvault"
     SecretsFilter: 'my-secret'
     RunAsPreJob: false

 - task: Bash@3
   displayName: "Create the file that contains the secret"
   inputs:
     targetType: 'inline'
     script: |
       echo "Create the directory... "
       DIR="$(dirname "${$FILE_NAME}")"
       mkdir -p $DIR
       cd $DIR
       pwd
       echo "Create the file for Private Key..."
       FILE="$(basename "${$FILE_NAME}")"
       echo $MY_SECRET > $FILE
       ls -la
   env:
     MY_SECRET: $(my-secret)
     FILE_NAME: $(secretFileName)
user_18661090

You can try to use RegEx Match & Replace task to replace the secret in the text file. This task replaces file content with a regular expression match.

enter image description here

The required configuration options are:

  • Path to File : Select the file to run the Regular Expression search.
  • Regular Expression to use : Enter the regular expression without the modifiers. (Eg. (?:\d*.)?\d+) Learn more about Regular Expressions from Microsoft RegEx Quick Reference and test your Regular Expressions online using RegExr
  • Replacement value : Enter the value to replace with the regex match.
user_115081920
Related