Error Get-AzureKeyVaultSecret : Unable to retrieve service key for ServicePrincipal account

4
votes

Using PowerShell, I can access my Azure KeyVault locally, provide the secret and return stored passwords. I can also do this from a VM I spin up. Additionally, I can access a single password from the KeyVault and use it to impersonate a user on a VSTS build agent, but I cannot access the remaining stored passwords. What gives?

Here's the message I receive:

[error]Get-AzureKeyVaultSecret : Unable to retrieve service key for ServicePrincipal account [hiddenaccountname]@[companyaccount].com. Please log in again to supply the credentials for this service principal. In PowerShell, execute Login-AzureRMAccount for Azure Resource Manager cmdlets or Add-AzureAccount for service management cmdlets.

...

  • CategoryInfo : CloseError: (:) [Get-AzureKeyVaultSecret], KeyNotFoundException
  • FullyQualifiedErrorId : Microsoft.Azure.Commands.KeyVault.GetAzureKeyVaultSecret

Here's what my code looks like at this section:

Login-AzureRmAccount -Credential $AzureCredential -ServicePrincipal -TenantId [abunchofnumbers]

$Password  = (Get-AzureKeyVaultSecret -VaultName "[nameOfVault]" -Name "[nameOfSecret]").SecretValueText

The login accepts the provided credentials and logs me in, but the Get-AzureKeyVaultSecret cmdlet fails, and only on VSTS during a build.

Any ideas, you strange and wonderful devs?

1
powershellazureazure-pipelinesazure-powershell
Do you add the service principal in key vault access policy? – Shui shengbao
Try to call Get-AzureKeyVaultSecret through Azure PowerShell task and check the result. This issue may benefit you: github.com/Azure/azure-powershell/issues/3389 – starian chen-MSFT
@ShengbaoShui, yes. Thanks for checking. And Get and List are checked. – DrewB

1 Answers

0
votes

[Resolved - Follow up] My process involved one Powershell script to impersonate a user by using Login-AzureRmAccount and Get-AzureKeyVaultSecret to get the password for a user, then a 2nd Powershell script to log back in to AzureRmAccount to get more passwords from the KeyVault. I swapped the order of these two scripts and problem went away.