You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/key-vault/event-grid-tutorial.md
+66-68Lines changed: 66 additions & 68 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -13,56 +13,56 @@ ms.author: mbaldwin
13
13
14
14
---
15
15
16
-
# How to: Receive and respond to key vault notifications with Azure Event Grid (preview)
16
+
# Receive and respond to key vault notifications with Azure Event Grid (preview)
17
17
18
-
Key Vault integration with Azure Event Grid, currently in preview, enables users to be notified when the status of a secret stored in key vault has changed. For an overview of the feature, see [Monitoring Key Vault with Azure Event Grid](event-grid-overview.md).
18
+
Azure Key Vault integration with Azure Event Grid (currently in preview) enables user notification when the status of a secret stored in a key vault has changed. For an overview of this feature, see [Monitoring Key Vault with Event Grid](event-grid-overview.md).
19
19
20
-
This guide will show you how to receive Key Vault notifications through Azure Event Grid, and how to respond to status changes with Azure Automation.
20
+
This guide describes how to receive Key Vault notifications through Event Grid, and how to respond to status changes through Azure Automation.
21
21
22
22
## Prerequisites
23
23
24
-
- An Azure Subscription. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
25
-
- A key vault in your Azure Subscription. You can quickly create a new key vault by following the steps in [Set and retrieve a secret from Azure Key Vault using Azure CLI](quick-create-cli.md)
24
+
- An Azure subscription. If you don't have an Azure subscription, create a [free account](https://azure.microsoft.com/free/?WT.mc_id=A261C142F) before you begin.
25
+
- A key vault in your Azure Subscription. You can quickly create a new key vault by following the steps in [Set and retrieve a secret from Azure Key Vault using Azure CLI](quick-create-cli.md).
26
26
27
27
## Concepts
28
28
29
-
Azure Event Grid is an eventing service for the cloud. In this guide, you will subscribe to events for key vault and route events to Azure Automation. When one of the secrets in the key vault is about to expire, Event Grid is notified of the status change and makes an HTTP POST to the endpoint. A web hook then triggers an Azure Automation execution of PowerShell script.
29
+
Event Grid is an eventing service for the cloud. By following the steps in this guide, you'll subscribe to events for Key Vault and route events to Automation. When one of the secrets in the key vault is about to expire, Event Grid is notified of the status change and makes an HTTP POST to the endpoint. A web hook then triggers an Automation execution of a PowerShell script.
30
30
31
-
31
+
32
32
33
-
## Create an Azure Automation account
33
+
## Create an Automation account
34
34
35
-
Create an Azure Automation account through the [Azure portal](https://portal.azure.com).
35
+
Create an Automation account through the [Azure portal](https://portal.azure.com):
36
36
37
37
1. Go to portal.azure.com and log in to your subscription.
38
38
39
-
1. In the search box, type in "Automation Accounts".
39
+
1. In the search box, enter **Automation Accounts**.
40
40
41
-
1. Under the "Services" Section of the drop-down from the search bar, select "Automation Accounts".
41
+
1. Under the **Services** section of the drop-down list on the search bar, select **Automation Accounts**.
42
42
43
-
1.Click Add.
43
+
1.Select **Add**.
44
44
45
-
45
+
46
46
47
-
1.Fill the required information in the "Add Automation Account" Blade and select "Create".
47
+
1.Enter the required information in the **Add Automation Account** pane and then select **Create**.
48
48
49
-
## Create a Runbook
49
+
## Create a runbook
50
50
51
-
After your Azure Automation account is ready, create a runbook.
51
+
After your Automation account is ready, create a runbook.
52
52
53
-
53
+
54
54
55
-
1. Select the automation account you just created.
55
+
1. Select the Automation account you just created.
56
56
57
-
1. Select "Runbooks" under the Process Automation section.
57
+
1. Select **Runbooks** under **Process Automation**.
58
58
59
-
1.Click the "Create a runbook".
59
+
1.Select **Create a runbook**.
60
60
61
-
1. Name your runbook and select "PowerShell" as the runbook type.
61
+
1. Name your runbook and select **PowerShell** as the runbook type.
62
62
63
-
1.Click on the runbook you created, and select the "Edit" Button.
63
+
1.Select the runbook you created and then select the **Edit** button.
64
64
65
-
1. Enter the following code (for testing purposes) and click the "Publish" button. This will output the result of the POST request received.
65
+
1. Enter the following code (for testing purposes) and select the **Publish** button. This action returns the result of the POST request received.
66
66
67
67
```azurepowershell
68
68
param
@@ -88,108 +88,106 @@ write-Error "No input data found."
88
88
}
89
89
```
90
90
91
-
91
+
92
92
93
93
## Create a webhook
94
94
95
-
Now create a webhook, to trigger your newly created runbook.
95
+
Create a webhook to trigger your newly created runbook.
96
96
97
-
1. Select "Webhooks" from the resources section of the runbook you just published.
97
+
1. Select **Webhooks** from the **Resources** section of the runbook you just published.
98
98
99
-
1.Click "Add Webhook".
99
+
1.Select **Add Webhook**.
100
100
101
-
101
+
102
102
103
-
1. Select "Create new Webhook".
103
+
1. Select **Create new Webhook**.
104
104
105
-
1. Name the webhook, set an expiration date, and **copy the URL**.
105
+
1. Name the webhook, set an expiration date, and copy the URL.
106
106
107
107
> [!IMPORTANT]
108
-
> You cannot view the URL after you create it. Make sure you save a copy a secure location where you can access it for the remainder of this guide.
108
+
> You can't view the URL after you create it. Make sure you save a copy in a secure location where you can access it for the remainder of this guide.
109
109
110
-
1.Click "Parameters and run settings", and select "OK". Do not enter any parameters. This will enable the "Create" button.
110
+
1.Select **Parameters and run settings** and then select **OK**. Don't enter any parameters. This will enable the **Create** button.
111
111
112
-
1. Select "OK", and select "Create".
112
+
1. Select **OK** and then select **Create**.
113
113
114
-
114
+
115
115
116
116
## Create an Event Grid subscription
117
117
118
118
Create an Event Grid subscription through the [Azure portal](https://portal.azure.com).
119
119
120
-
1. Open the Azure portal using the following link: https://portal.azure.com/?Microsoft_Azure_KeyVault_ShowEvents=true&Microsoft_Azure_EventGrid_publisherPreview=true
120
+
1. Open the [Azure portal](https://portal.azure.com/?Microsoft_Azure_KeyVault_ShowEvents=true&Microsoft_Azure_EventGrid_publisherPreview=true).
121
121
122
-
1. Go to your key vault and select the "Events" tab. If you cannot see the Events tab, make sure that you are using the [preview version of the portal](https://ms.portal.azure.com/?Microsoft_Azure_KeyVault_ShowEvents=true&Microsoft_Azure_EventGrid_publisherPreview=true).
122
+
1. Go to your key vault and select the **Events** tab. If you can't see it, make sure you're using the [preview version of the portal](https://ms.portal.azure.com/?Microsoft_Azure_KeyVault_ShowEvents=true&Microsoft_Azure_EventGrid_publisherPreview=true).
123
123
124
-
124
+
125
125
126
-
1.Click the "+ Event Subscription" button.
126
+
1.Select the **Event Subscription** button.
127
127
128
128
1. Create a descriptive name for the subscription.
129
129
130
-
1. Choose "Event Grid Schema".
130
+
1. Choose **Event Grid Schema**.
131
131
132
-
1."Topic Resource" should be the key vault you want to monitor for status changes.
132
+
1.**Topic Resource** should be the key vault you want to monitor for status changes.
133
133
134
-
1. For "Filter to Event Types", leave all checked ("9 selected").
134
+
1. For **Filter to Event Types**, leave all options selected (**9 selected**).
135
135
136
-
1. For "Endpoint Type", select "Webhook".
136
+
1. For **Endpoint Type**, select **Webhook**.
137
137
138
-
1.Select "Select an endpoint". In the new context pane, paste the webhook URL from the [Create a webhook](#create-a-webhook) step into the "Subscriber Endpoint" field.
138
+
1.Choose **Select an endpoint**. In the new context pane, paste the webhook URL from the [Create a webhook](#create-a-webhook) step into the **Subscriber Endpoint** field.
139
139
140
-
1. Select "Confirm Selection" on the context pane.
140
+
1. Select **Confirm Selection** on the context pane.
141
141
142
-
1. Select "Create".
142
+
1. Select **Create**.
143
143
144
-
144
+
145
145
146
146
## Test and verify
147
147
148
-
Verify that your Event Grid subscription is property configured. This test assumes that you have subscribed to "Secret New Version Created" notification in the [Create an Event Grid subscription](#create-an-event-grid-subscription), and that you have the necessary privileges to create a new version of a secret in a key vault.
148
+
Verify that your Event Grid subscription is properly configured. This test assumes you have subscribed to the "Secret New Version Created" notification in the [Create an Event Grid subscription](#create-an-event-grid-subscription), and that you have the necessary permissions to create a new version of a secret in a key vault.
149
149
150
-
150
+
151
151
152
-
152
+
153
153
154
-
1. Go to your key vault on the Azure portal
154
+
1. Go to your key vault on the Azure portal.
155
155
156
-
1. Create a new secret. For testing purposes, set expiration to date to next day.
156
+
1. Create a new secret. For testing purposes, set the expiration to date to the next day.
157
157
158
-
1.Navigate to the events tab in your key vault.
158
+
1.On the **Events** tab in your key vault, select the Event Grid subscription you created.
159
159
160
-
1.Select the event grid subscription you created.
160
+
1.Under **Metrics**, check whether an event was captured. Two events are expected: SecretNewVersion and SecretNearExpiry. These events validate that Event Grid successfully captured the status change of the secret in your key vault.
161
161
162
-
1. Under metrics, see if an event was captured. Two events are expected: SecretNewVersion and SecretNearExpiry. This validates that event grid successfully captured the status change of the secret in your key vault.
162
+
163
163
164
-
164
+
1. Go to your Automation account.
165
165
166
-
1.Go to your Azure Automation account.
166
+
1.Select the **Runbooks** tab, and then select the runbook you created.
167
167
168
-
1. Select the "Runbooks" tab, and select the runbook you created.
168
+
1. Select the **Webhooks** tab, and confirm that the "last triggered" time stamp is within 60 seconds of when you created the new secret. This result confirms that Event Grid made a POST to the webhook with the event details of the status change in your key vault and that the webhook was triggered.
169
169
170
-
1. Select the "Webhooks" tab, and confirm that the "last triggered" timestamp is within 60 seconds of when you created the new secret. This confirms that Event Grid made a POST to the webhook with the event details of the status change in your key vault, and the webhook was triggered.
170
+
171
171
172
-
172
+
1. Return to your runbook and select the **Overview** tab.
173
173
174
-
1.Return to your Runbook and select the "Overview" Tab.
174
+
1.Look at the **Recent Jobs** list. You should see that a job was created and that the status is complete. This confirms that the webhook triggered the runbook to start executing its script.
175
175
176
-
1. Look at the Recent Jobs list. You should see that a job was created and that the status is complete. This confirms that the webhook triggered the runbook to start executing its script.
176
+
177
177
178
-
179
-
180
-
1. Select the recent job and look at the POST request that was sent from event grid to the webhook. Examine the JSON and make sure that the parameters for your key vault and event type are correct. If the "event type" parameter in the JSON object matches the event which occurred in the key vault (in this example, Microsoft.KeyVault.SecretNearExpiry) the test was successful.
178
+
1. Select the recent job and look at the POST request that was sent from Event Grid to the webhook. Examine the JSON and make sure that the parameters for your key vault and event type are correct. If the "event type" parameter in the JSON object matches the event that occurred in the key vault (in this example, Microsoft.KeyVault.SecretNearExpiry), the test was successful.
181
179
182
180
## Troubleshooting
183
181
184
-
### Unable to create event subscription
182
+
### You can't create an event subscription
185
183
186
-
Reregister Event Grid and Key Vault provider in your azure subscription resource providers. See [Azure resource providers and types](../azure-resource-manager/resource-manager-supported-services.md).
184
+
Reregister Event Grid and the key vault provider in your Azure subscription resource providers. See [Azure resource providers and types](../azure-resource-manager/resource-manager-supported-services.md).
187
185
188
186
## Next steps
189
187
190
-
Congratulations! If you have followed all the steps above, you are now ready to programmatically respond to status changes of secrets stored in your key vault.
188
+
Congratulations! If you've correctly followed all these steps, you're now ready to programmatically respond to status changes of secrets stored in your key vault.
191
189
192
-
If you have been using a polling-based system to look for status changes of secrets in your key vaults, migrate to using this notification feature. You can also replace the test script in your runbook with code to programmatically renew your secrets when they are about to expire.
190
+
If you've been using a polling-based system to search for status changes of secrets in your key vaults, you can now start using this notification feature. You can also replace the test script in your runbook with code to programmatically renew your secrets when they're about to expire.
0 commit comments