mirror of
https://dev.azure.com/effectory/Survey%20Software/_git/Cloud%20Engineering
synced 2026-02-27 18:52:18 +01:00
579ba243bd
updated keyvaults rbac column added scripts to detected unused resources Related work items: #103196
99 lines
4.8 KiB
PowerShell
99 lines
4.8 KiB
PowerShell
#Connect-AzAccount
|
|
|
|
class ResourceCheck {
|
|
[string] $ResourceId = ""
|
|
[string] $ManagementGroupId = ""
|
|
[string] $ManagementGroupName = ""
|
|
[string] $SubscriptionId = ""
|
|
[string] $SubscriptionName = ""
|
|
[string] $ResourceGroup = ""
|
|
[string] $ResourceName = ""
|
|
[string] $Location = ""
|
|
[string] $Tag_Team = ""
|
|
[string] $Tag_Product = ""
|
|
[string] $Tag_Environment = ""
|
|
[string] $Tag_Data = ""
|
|
[string] $Tag_Deployment = ""
|
|
[string] $Tag_CreatedOnDate = ""
|
|
[string] $Prop_EnablePurgeProtection = ""
|
|
[string] $Prop_EnableRbacAuthorization = ""
|
|
[string] $Prop_EnableSoftDelete = ""
|
|
[string] $Prop_PublicNetworkAccess = ""
|
|
}
|
|
|
|
|
|
Write-Host "======================================================================================================================================================================"
|
|
Write-Host "Creating key vault resource overview."
|
|
Write-Host "======================================================================================================================================================================"
|
|
|
|
$subscriptions = Get-AzSubscription | Where-Object State -eq "Enabled"
|
|
|
|
|
|
[string] $date = Get-Date -Format "yyyy-MM-dd HHmm"
|
|
$fileName = ".\$date azure_key_vaults.csv"
|
|
|
|
$managementGroups = Get-AzManagementGroup
|
|
|
|
foreach ($managementGroup in $managementGroups)
|
|
{
|
|
Write-Host "----------------------------------------------------------------------------------------------------------------------------------------------------------------------"
|
|
Write-Host "Management group [$($managementGroup.Name)]"
|
|
|
|
$subscriptions = Get-AzManagementGroupSubscription -Group $managementGroup.Name | Where-Object State -eq "Active"
|
|
|
|
foreach ($subscription in $subscriptions)
|
|
{
|
|
Write-Host "----------------------------------------------------------------------------------------------------------------------------------------------------------------------"
|
|
$scope = $subscription.Id.Substring($subscription.Parent.Length, $subscription.Id.Length - $subscription.Parent.Length)
|
|
$subscriptionId = $scope.Replace("/subscriptions/", "")
|
|
Write-Host "Subscription [$($subscription.DisplayName) - $subscriptionId]"
|
|
Set-AzContext -SubscriptionId $subscriptionId | Out-Null
|
|
Write-Host "----------------------------------------------------------------------------------------------------------------------------------------------------------------------"
|
|
|
|
$allResourceGroups = Get-AzResourceGroup
|
|
[ResourceCheck[]]$Result = @()
|
|
|
|
foreach ($group in $allResourceGroups) {
|
|
|
|
Write-Host $group.ResourceGroupName
|
|
|
|
$allVaults = Get-AzKeyVault -ResourceGroupName $group.ResourceGroupName
|
|
|
|
foreach ($vault in $allVaults) {
|
|
|
|
$vaultWithAllProps = Get-AzKeyVault -ResourceGroupName $group.ResourceGroupName -Name $vault.VaultName
|
|
|
|
$enabledRBAC = $vaultWithAllProps.EnableRbacAuthorization -eq "TRUE"
|
|
|
|
[ResourceCheck] $resourceCheck = [ResourceCheck]::new()
|
|
$resourceCheck.ManagementGroupId = $managementGroup.Id
|
|
$resourceCheck.ManagementGroupName = $managementGroup.DisplayName
|
|
$resourceCheck.ResourceId = $vaultWithAllProps.ResourceId
|
|
$resourceCheck.Location = $vaultWithAllProps.Location
|
|
$resourceCheck.ResourceName = $vaultWithAllProps.VaultName
|
|
$resourceCheck.ResourceGroup = $vaultWithAllProps.ResourceGroupName
|
|
$resourceCheck.SubscriptionId = $subscription.Id
|
|
$resourceCheck.SubscriptionName = $subscription.DisplayName
|
|
$resourceCheck.Tag_Team = $vaultWithAllProps.Tags.team
|
|
$resourceCheck.Tag_Product = $vaultWithAllProps.Tags.product
|
|
$resourceCheck.Tag_Environment = $vaultWithAllProps.Tags.environment
|
|
$resourceCheck.Tag_Data = $vaultWithAllProps.Tags.data
|
|
$resourceCheck.Tag_CreatedOnDate = $vaultWithAllProps.Tags.CreatedOnDate
|
|
$resourceCheck.Tag_Deployment = $vaultWithAllProps.Tags.drp_deployment
|
|
$resourceCheck.Prop_EnablePurgeProtection = $vaultWithAllProps.EnablePurgeProtection
|
|
$resourceCheck.Prop_EnableRbacAuthorization = $enabledRBAC
|
|
$resourceCheck.Prop_EnableSoftDelete = $vaultWithAllProps.EnableSoftDelete
|
|
$resourceCheck.Prop_PublicNetworkAccess = $vaultWithAllProps.PublicNetworkAccess
|
|
|
|
$Result += $resourceCheck
|
|
|
|
|
|
}
|
|
}
|
|
$Result | Export-Csv -Path $fileName -Append -NoTypeInformation
|
|
}
|
|
}
|
|
Write-Host "======================================================================================================================================================================"
|
|
Write-Host "Done."
|
|
|