1
1
---
2
2
title : Restore Key Vault key & secret for encrypted VM
3
3
description : Learn how to restore Key Vault key and secret in Azure Backup using PowerShell
4
- ms.topic : conceptual
5
- ms.date : 08 /28/2017
4
+ ms.topic : how-to
5
+ ms.date : 02 /28/2023
6
6
ms.custom : devx-track-azurepowershell
7
7
author : jyothisuri
8
8
ms.author : jsuri
@@ -66,7 +66,7 @@ $secretdata = $encryptionObject.OsDiskKeyAndSecretDetails.SecretData
66
66
$Secret = ConvertTo-SecureString -String $secretdata -AsPlainText -Force
67
67
$secretname = 'B3284AAA-DAAA-4AAA-B393-60CAA848AAAA'
68
68
$Tags = @{'DiskEncryptionKeyEncryptionAlgorithm' = 'RSA-OAEP';'DiskEncryptionKeyFileName' = 'B3284AAA-DAAA-4AAA-B393-60CAA848AAAA.BEK';'DiskEncryptionKeyEncryptionKeyURL' = $encryptionObject.OsDiskKeyAndSecretDetails.KeyUrl;'MachineName' = 'vm-name'}
69
- Set-AzureKeyVaultSecret -VaultName '<target_key_vault_name>' -Name $secretname -SecretValue $Secret -ContentType 'Wrapped BEK' -Tags $Tags
69
+ Set-AzKeyVaultSecret -VaultName '<target_key_vault_name>' -Name $secretname -SecretValue $Secret -ContentType 'Wrapped BEK' -Tags $Tags
70
70
```
71
71
72
72
** Use these cmdlets if your Linux VM is encrypted using BEK and KEK.**
@@ -76,15 +76,15 @@ $secretdata = $encryptionObject.OsDiskKeyAndSecretDetails.SecretData
76
76
$Secret = ConvertTo-SecureString -String $secretdata -AsPlainText -Force
77
77
$secretname = 'B3284AAA-DAAA-4AAA-B393-60CAA848AAAA'
78
78
$Tags = @{'DiskEncryptionKeyEncryptionAlgorithm' = 'RSA-OAEP';'DiskEncryptionKeyFileName' = 'LinuxPassPhraseFileName';'DiskEncryptionKeyEncryptionKeyURL' = <Key_url_of_newly_restored_key>;'MachineName' = 'vm-name'}
79
- Set-AzureKeyVaultSecret -VaultName '<target_key_vault_name>' -Name $secretname -SecretValue $Secret -ContentType 'Wrapped BEK' -Tags $Tags
79
+ Set-AzKeyVaultSecret -VaultName '<target_key_vault_name>' -Name $secretname -SecretValue $Secret -ContentType 'Wrapped BEK' -Tags $Tags
80
80
```
81
81
82
82
Use the JSON file generated above to get secret name and value and feed it to set secret cmdlet to put the secret (BEK) back in the key vault. Use these cmdlets if your ** VM is encrypted using BEK** only.
83
83
84
84
``` powershell
85
85
$secretDestination = 'C:\secret.blob'
86
86
[io.file]::WriteAllBytes($secretDestination, [System.Convert]::FromBase64String($encryptionObject.OsDiskKeyAndSecretDetails.KeyVaultSecretBackupData))
87
- Restore-AzureKeyVaultSecret -VaultName '<target_key_vault_name>' -InputFile $secretDestination -Verbose
87
+ Restore-AzKeyVaultSecret -VaultName '<target_key_vault_name>' -InputFile $secretDestination -Verbose
88
88
```
89
89
90
90
> [ !NOTE]
@@ -120,7 +120,7 @@ $secretname = 'B3284AAA-DAAA-4AAA-B393-60CAA848AAAA'
120
120
$secretdata = $rp1.KeyAndSecretDetails.SecretData
121
121
$Secret = ConvertTo-SecureString -String $secretdata -AsPlainText -Force
122
122
$Tags = @{'DiskEncryptionKeyEncryptionAlgorithm' = 'RSA-OAEP';'DiskEncryptionKeyFileName' = 'B3284AAA-DAAA-4AAA-B393-60CAA848AAAA.BEK';'DiskEncryptionKeyEncryptionKeyURL' = 'https://mykeyvault.vault.azure.net:443/keys/KeyName/84daaac999949999030bf99aaa5a9f9';'MachineName' = 'vm-name'}
123
- Set-AzureKeyVaultSecret -VaultName '<target_key_vault_name>' -Name $secretname -SecretValue $secret -Tags $Tags -SecretValue $Secret -ContentType 'Wrapped BEK'
123
+ Set-AzKeyVaultSecret -VaultName '<target_key_vault_name>' -Name $secretname -SecretValue $secret -Tags $Tags -SecretValue $Secret -ContentType 'Wrapped BEK'
124
124
```
125
125
126
126
> [ !NOTE]
0 commit comments