KQL 查询列出 keyvault 中已过期或将在 7 天后过期的机密和密钥

Question

请提供 KQL 查询，列出 keyvault 中即将在 7 或 10 天内过期的所有机密和密钥以及已过期的机密和密钥。

尝试过下面的 KQL 查询，它可以工作，但由于它使用“SecretNearExpiry”事件会在到期前 30 天记录，并且我无法灵活地在到期前 5 天或 7 天记录机密或密钥

let lastIndexof = (input:string, lookup: string) {
strlen(input) - indexof(reverse(input), reverse(lookup)) - strlen(lookup)
};
AzureDiagnostics
| where OperationName contains "SecretNearExpiry" or OperationName contains "SecretExpired"
| extend KeyVaultName = column_ifexists('eventGridEventProperties_data_VaultName_s', 'N/A')
| extend KeyVaultType = column_ifexists('eventGridEventProperties_data_ObjectType_s', 'N/A')
| extend Name = column_ifexists('eventGridEventProperties_data_ObjectName_s', 'N/A')
| extend EventType =  column_ifexists('eventGridEventProperties_eventType_s', 'N/A')
| extend EventType =  substring(EventType, (lastIndexof(EventType, '.') + 1))
| extend Expiry = column_ifexists('eventGridEventProperties_data_EXP_d', 0)
| extend Expiry = format_datetime(unixtime_seconds_todatetime(Expiry), 'yyyy/MM/dd HH:mm:ss')
| where Name != '' or EventType != ''
| where TimeGenerated > datetime_add('year', -10, now())
| project KeyVaultName, KeyVaultType, Name, EventType, Expiry
| order by Expiry

Answer 1

无法使用 KQL 日志获取密钥

一般来说，keyvault 是为了安全地存储信息。这意味着监视器 Kusto 查询语言 (KQL) 主要用于监视和查询日志，并且无法提供直接访问来获取密钥或秘密信息的指标。

我们可以使用powershell来实现这个需求。

Powershell.ps1

$keyVaultName = "sakkbvksv"
$daysThreshold = 7  

$expirationThresholdDate = (Get-Date).AddDays($daysThreshold)

$allSecrets = Get-AzKeyVaultSecret -VaultName $keyVaultName
$allSecrets | ForEach-Object {
    Write-Output "Secret Name: $($_.Name), Expires On: $($_.Expires)"
}

$allKeys = Get-AzKeyVaultKey -VaultName $keyVaultName
$allKeys | ForEach-Object {
    Write-Output "Key Name: $($_.Name), Expires On: $($_.Attributes.Expires)"
}

$secrets = $allSecrets | Where-Object {
    $_.Expires -ne $null -and ($_.Expires -lt $expirationThresholdDate -or $_.Expires -lt (Get-Date))
}

$keys = $allKeys | Where-Object {
    $_.Attributes.Expires -ne $null -and ($_.Attributes.Expires -lt $expirationThresholdDate -or $_.Attributes.Expires -lt (Get-Date))
}

Write-Output "`nExpiring or Expired Secrets:"
$secrets | ForEach-Object {
    [PSCustomObject]@{
        Name       = $_.Name
        ExpiresOn  = $_.Expires
        Status     = if ($_.Expires -lt (Get-Date)) { "Expired" } else { "Expiring Soon" }
    }
}

Write-Output "`nExpiring or Expired Keys:"
$keys | ForEach-Object {
    [PSCustomObject]@{
        Name       = $_.Name
        ExpiresOn  = $_.Attributes.Expires
        Status     = if ($_.Attributes.Expires -lt (Get-Date)) { "Expired" } else { "Expiring Soon" }
    }
}

输出：

参考：

https://learn.microsoft.com/en-us/azure/key-vault/general/monitor-key-vault-reference

快速入门 - 从 Azure Key Vault 设置和检索机密 |微软学习