Unable to access Azure Key vault secret in a powershell script running on Azure Devops

2
votes

I have a powershell script that attempts to retrieve a secret stored in Azure key vault using this command.

$password = (Get-AzureKeyVaultSecret -vaultName $vaultName -name $secretName).SecretValueText

It is working perfectly fine when I execute my powershell script locally. But, when I try to do the same on Azure Devops, it fails giving below error.

[error]Operation returned an invalid status code 'Forbidden'

I feel it isn't an access policy issue, as I am able to successfully perform read/write on my vault using powershell script running locally.

1
azurepowershellazure-devopsazure-resource-managerazure-keyvault
Is your keyvault restricted to certain IP address ranges? – Daniel Mann
@DanielMann I have allowed access from all networks. – Shiv Rajawat

1 Answers

4
votes

I'm quite sure it is a access policy issue.

Go to your DevOps Project Settings - Pipelines - Service Connections and click on "Update Service Connection" (Use the full version of the dialog). There you can find the Subscription Id and Service Principal ID.

You then have to give explicit permissions to this SPN:

Login-AzureRmAccount -subscription <YourSubscriptionID>
$spn= Get-AzureRmADServicePrincipal -spn <YourSPN>
Set-AzureRmKeyVaultAccessPolicy -VaultName <YourVaultName> -ObjectId $spn.Id -PermissionsToSecrets get,list;