Portal - .easec

When you work in a big environment, like me, and have lot of Azure DevOps organizations, is it time to automate some work to keep the environment strong. One thing that could be a hazzle is managing secrets.

This blog post describes steps needed to put up a flow for notifications from key vault when secrets is on the way to expired (30 days), with Azure Logics Apps.

The event Microsoft.KeyVault.SecretNearExpiry is used. It´s trigged 30 days before the expiration date.

Prerequisites:

You need a existing key vault and a subscription in Azure.

Task 1: Connect to portal Azure

1.     Start your web browser and connect to the following URL:

portal.azure.com

2.     Log in with your credentials.

Task 2: Create a Logic App via Event Grid

1.     In the Azure portal, go to your key vault, select Events – Get Started and click Logic Apps.

2.     On Logic Apps Designer, click Sign in.

3.     Choose your tenant and click on Sign in.

4.     Choose your account, and the status is changed with that account. Click Continue.

5.     On the When a resource event occurs screen, do the following:

• Leave Subscription and Resource Name (will changes) as default.
• Select Microsoft.KeyVault.vaults for the Resource Type.
• Select Microsoft.KeyVault.SecretNearExpiry for Event Type Item - 1.

6.     Click on + New Step. This will open a window to Choose an action.

7.     Click on All and choose Office 365 Outlook.

8.     Select the Send an email (v2) action.

9.     Click on Sign in. It´s the account used for sending notifications when secrets is about to expired. Should be a Microsoft 365 account in this case, you could choose other provider.

10.     Build your template:

• To: Enter the email address to receive the notification emails.

• Subject: Write the text for your subject. Click on Add dynamic content – See more (in box “Add dynamic content from apps and connectors used in this flow.”).
• 
  

• In Body, put in Event Id:, in box for Dynamic content, click on ID.

Your email template may look like this example:

11.     Click Save as.

12.     Enter a name for new logic app and click Create.

Task 3: Test and verify

1.     Go to your key vault on the Azure portal.

2.     Click on Secrets.

3.     Create a new secret – click on Generate/Import.

4.     For testing and verify purpose, set the Activation date, and the Expiration date to 29 days ahead. Click on Create.

5.     On the Events tab in your key vault, select the Logic Apps that you just created.

6.     Wait a couple of minutes (depending on your configuration), event will be fired, and email should be sent to configured mailbox.

7.     Check your mailbox, there will be an email on these issue. The test is completed.