1+ #! /bin/bash
2+ set -e
3+
4+ # Function to display usage
5+ display_usage () {
6+ echo " Create Azure Key Vault certificate with managed identity access policy."
7+ echo " "
8+ echo " Usage:"
9+ echo -e " $0 [-v | --vault] vault_name name of the vault"
10+ echo -e " $0 [-c | --create] identity_cert_name name of the certificate"
11+ echo -e " $0 [-rg | --resource-group] resource_group_name name of the resource group"
12+ echo -e " $0 [-l | --location] location location of the vault"
13+ echo -e " $0 [-mi | --managed-identity] managed_identity_name name of the managed identity to access the ceritificate"
14+ echo -e " $0 [-h | --help"
15+ echo " "
16+ }
17+
18+ # Check if the correct number of arguments is provided
19+ if [ $# -le 1 ]; then
20+ display_usage
21+ exit 1
22+ fi
23+
24+ # Parse command-line arguments
25+ while [[ " $# " -gt 0 ]]; do
26+ case $1 in
27+ -v|--vault) vault_name=" $2 " ; shift ;;
28+ -c|--create) cert_name=" $2 " ; shift ;;
29+ -rg|--resource_group) resource_group=" $2 " ; shift ;;
30+ -l|--location) location=" $2 " ; shift ;;
31+ -mi|--managed_identity) managed_identity_name=" $2 " ; shift ;;
32+ -h|--help) display_usage; exit 0 ;;
33+ * ) echo " Unknown parameter passed: $1 " ; display_usage; exit 1 ;;
34+ esac
35+ shift
36+ done
37+
38+ echo " Vault Name: $vault_name "
39+ echo " Certificate Name: $cert_name "
40+ echo " Resource Group: $resource_group "
41+ echo " Location: $location "
42+ echo " Managed Identity Name: $managed_identity_name "
43+
44+ # Check if required arguments are provided
45+ if [ -z " $vault_name " || [ -z " $cert_name " || [ -z " $resource_group " || [ -z " $location " || [ -z " $managed_identity_name " ; then
46+ echo " Error: Vault name, certificate name, resource group, location, and managed identity name are required."
47+ display_usage
48+ exit 1
49+ fi
50+
51+ # Check if the Key Vault exists and if it has '--enable-rbac-authorization' specified
52+ vault_properties=$( az keyvault show --name " $vault_name " " $resource_group " " properties" )
53+ if echo " $vault_properties " | grep -q ' "enableRbacAuthorization": true' ; then
54+ echo " The Key Vault is configured with '--enable-rbac-authorization'."
55+ echo " You cannot set access policies directly on this Key Vault."
56+ echo " Ensuring that the necessary RBAC roles are assigned to the managed identity."
57+
58+ # Get the managed identity principal ID
59+ managed_identity_principal_id=$( az identity show --name " $managed_identity_name " " $resource_group " " principalId" )
60+ if [ -z " $managed_identity_principal_id " ; then
61+ echo " Error: Failed to retrieve the managed identity principal ID."
62+ exit 1
63+ fi
64+
65+ # Array of roles to assign
66+ roles=(" Key Vault Certificate User" " Key Vault Crypto User" " Reader"
67+
68+ # Loop through each role and assign it to the managed identity
69+ for role in " ${roles[@]} " ; do
70+ az role assignment create --role " $role " " $managed_identity_principal_id " " /subscriptions/$( az account show --query ' id' ) $resource_group /providers/Microsoft.KeyVault/vaults/$vault_name "
71+ if [ $? -ne 0 ]; then
72+ echo " Error: Failed to assign the '$role ' role to the managed identity."
73+ exit 1
74+ fi
75+ done
76+
77+ echo " Successfully assigned the 'Key Vault Certificate User' role to the managed identity."
78+ fi
79+
80+ # Your script logic to create the certificate goes here
81+
82+ # Create the JSON file dynamically
83+ JSON_FILE=" /tmp/identity_cert_policy.json"
84+ cat << EOF > $JSON_FILE
85+ {
86+ "issuerParameters": {
87+ "certificateTransparency": null,
88+ "name": "Self"
89+ },
90+ "keyProperties": {
91+ "curve": "P-384",
92+ "exportable": false,
93+ "keyType": "EC",
94+ "reuseKey": true
95+ },
96+ "lifetimeActions": [
97+ {
98+ "action": {
99+ "actionType": "AutoRenew"
100+ },
101+ "trigger": {
102+ "daysBeforeExpiry": 90
103+ }
104+ }
105+ ],
106+ "secretProperties": {
107+ "contentType": "application/x-pkcs12"
108+ },
109+ "x509CertificateProperties": {
110+ "keyUsage": ["digitalSignature"],
111+ "subject": "CN=Member",
112+ "validityInMonths": 12
113+ }
114+ }
115+ EOF
116+
117+ # Create the certificate in Azure Key Vault
118+ az keyvault certificate create --vault-name $vault_name -n $cert_name -p @$JSON_FILE
119+ az keyvault key show --vault-name $vault_name --name $cert_name
120+ rm $JSON_FILE
0 commit comments