Skip to content

Commit e24034b

Browse files
author
Stephane Lapointe
committed
initial migration from ScriptCenter to git
1 parent 7d32297 commit e24034b

File tree

18 files changed

+785
-0
lines changed

18 files changed

+785
-0
lines changed

‎app-service/list-outbound-ips-legacy/Get-AppServiceWebAppsOutboundIpAddresses.ps1‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
param(
2+
[Parameter(Mandatory=$true)]
3+
[string[]]
4+
$SubscriptionName,
5+
[switch]
6+
$IncludePossibleOutputIpAddresses
7+
)
8+
$ErrorActionPreference = 'Stop'
9+
10+
$webApps = @()
11+
$SubscriptionName | % {
12+
Write-Host ('Switching to subscription {0}' -f $_)
13+
$subContext = Set-AzureRmContext -SubscriptionName $_
14+
$webApps += Get-AzureRmWebApp
15+
16+
}
17+
18+
$ipMatch = @(
19+
$webApps | % {
20+
$webAppName = $_.Name
21+
$ipAddresses = @($_.OutboundIpAddresses -split ',' | % { @{ IpAddress = $_; Type='Outbound' } })
22+
if($IncludePossibleOutputIpAddresses) {
23+
$ipAddresses += $_.PossibleOutboundIpAddresses -split ',' | % { @{ IpAddress = $_; Type='Possible' } }
24+
}
25+
$ipAddresses | % {
26+
@{
27+
SiteName = $webAppName
28+
IpAddress = $_.IpAddress
29+
Type = $_.Type
30+
}
31+
}
32+
}
33+
)
34+
35+
$ipMatch | Sort-Object {[System.Version]$_.IpAddress} | Group-Object {$_.IpAddress}, {$_.Type} | Select-Object Count, @{Name='IpAddress'; Expression={($_.Name -split ',')[0]}}, @{Name='Type'; Expression={($_.Name -split ',')[1]}}, @{Name='Sites'; Expression={,@($_.Group | % { $_.SiteName }) } }

‎app-service/list-outbound-ips-legacy/README.md‎

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,37 @@
1+
# List App Service web apps outbound IP addresses (legacy)
2+
3+
You'll find in this function an easy way to extract the outbound IP addresses information used by all your App Services in your subscriptions by using the Azure Resource Graph, it is very fast compared to the old version scanning all subscription one at a time (50x faster for me)
4+
5+
## Requirements
6+
Tested with AzureRM.Profile Version 3.2.x & AzureRM.Websites 3.2.x
7+
8+
Tested with AzureRM.Profile Version 5.8.x & AzureRM.Websites 5.2.x
9+
10+
## Usage
11+
```powershell
12+
Login-AzureRmAccount
13+
14+
.\Get-AppServiceWebAppsOutboundIpAddresses.ps1 -SubscriptionName 'mysub1','mysub2' -IncludePossibleOutputIpAddresses
15+
```
16+
17+
You will end up with an output in the like of:
18+
19+
```powershell
20+
Switching to subscription mysub1
21+
Switching to subscription mysub2
22+
23+
Count IpAddress Type Sites
24+
----- ---- ----- ----
25+
2 13.85.17.60 Outbound {sub1-bi-dev-as-webapp, sub2-bi-prod-as-webapp}
26+
1 13.85.17.60 Possible {sub3-bi-dev-as-webapp}
27+
2 13.85.20.144 Outbound {sub1-bi-prod-as-webapp, sub1-bi-dev-as-webapp}
28+
1 13.85.20.144 Possible {sub3-bi-dev-as-webapp}
29+
2 13.85.22.206 Outbound {sub2-bi-prod-as-webapp, sub1-bi-dev-as-webapp}
30+
2 13.85.23.148 Outbound {sub1-bi-dev-as-webapp, sub2-bi-prod-as-webapp}
31+
2 13.85.23.243 Outbound {sub1-bi-dev-as-webapp, sub2-bi-prod-as-webapp}
32+
1 23.96.184.12 Outbound {sub1-dev-functions-mmckydd}
33+
1 23.96.184.209 Outbound {sub1-dev-functions-mmckydd}
34+
1 23.96.186.252 Outbound {sub1-dev-functions-mmckydd}
35+
1 23.96.187.50 Outbound {sub1-dev-functions-mmckydd}
36+
5 23.96.244.71 Outbound {sub1-stg-webapp-web-n7wfdda, sub1-stg-functions-n7wfdda, sub1-stg-webapp-admin-n7wfdda, sub1-dev-ops-functions-stl4tn5...}
37+
```

‎app-service/list-outbound-ips/Get-AzureWebAppsOutboundIpAddresses.ps1‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
#requires -modules Az.ResourceGraph
2+
param(
3+
[string[]]
4+
$SubscriptionName,
5+
[switch]
6+
$IncludePossibleOutputIpAddresses
7+
)
8+
$ErrorActionPreference = 'Stop'
9+
10+
if($SubscriptionName)
11+
{
12+
$subscriptions = Get-AzSubscription
13+
$matchedSubscriptions = $subscriptions | ? { $SubscriptionName -Contains $_.Name } | Select Id, Name
14+
15+
if($matchedSubscriptions.Count -ne $SubscriptionName.Count) {
16+
$notMatchedSubs = ($SubscriptionName | ? { $subscriptions.Name -NotContains $_ }) -join ', '
17+
Write-Warning "The following subscriptions where not available/found in your Azure context and will be ignored: $notMatchedSubs"
18+
}
19+
}
20+
21+
$queryParams = @{
22+
Query = "where type =~ 'Microsoft.Web/sites'
23+
| project subscriptionId,
24+
resourceGroup,
25+
name,
26+
outboundIpAddresses = properties.outboundIpAddresses,
27+
possibleOutboundIpAddresses = properties.possibleOutboundIpAddresses"
28+
}
29+
if($matchedSubscriptions) {
30+
$queryParams.Subscription = $matchedSubscriptions.Id
31+
}
32+
$webApps = Search-AzGraph @queryParams
33+
34+
$ipMatch = @(
35+
$webApps | % {
36+
$webAppName = $_.name
37+
$ipAddresses = @($_.outboundIpAddresses -split ',' | % { @{ IpAddress = $_; Type='Outbound' } })
38+
if($IncludePossibleOutputIpAddresses) {
39+
$ipAddresses += $_.possibleOutboundIpAddresses -split ',' | % { @{ IpAddress = $_; Type='Possible' } }
40+
}
41+
$ipAddresses | % {
42+
@{
43+
SiteName = $webAppName
44+
IpAddress = $_.IpAddress
45+
Type = $_.Type
46+
}
47+
}
48+
}
49+
)
50+
51+
$ipMatch | Sort-Object {[System.Version]$_.IpAddress} | Group-Object {$_.IpAddress}, {$_.Type} | Select-Object Count, @{Name='IpAddress'; Expression={($_.Name -split ',')[0]}}, @{Name='Type'; Expression={($_.Name -split ',')[1]}}, @{Name='Sites'; Expression={,@($_.Group | % { $_.SiteName }) } }

‎app-service/list-outbound-ips/README.md‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
# List App Service web apps outbound IP addresses
2+
3+
You'll find in this function an easy way to extract the outbound IP addresses information used by all your App Services in your subscriptions by using the Azure Resource Graph, it is very fast compared to the old version scanning all subscription one at a time (50x faster for me)
4+
5+
## Requirements
6+
Tested with Az.ResourceGraph Version 0.7.x
7+
8+
## Usage
9+
```powershell
10+
Connect-AzAccount
11+
12+
# for all subscriptions
13+
.\Get-AzureWebAppsOutboundIpAddresses.ps1
14+
15+
# for only a subset of your subscriptions
16+
.\Get-AzureWebAppsOutboundIpAddresses.ps1 -SubscriptionName 'mysub1','mysub2' -IncludePossibleOutputIpAddresses
17+
```
18+
19+
You will end up with an output in the like of:
20+
21+
```powershell
22+
Count IpAddress Type Sites
23+
----- ---- ----- ----
24+
2 13.85.17.60 Outbound {sub1-bi-dev-as-webapp, sub2-bi-prod-as-webapp}
25+
1 13.85.17.60 Possible {sub3-bi-dev-as-webapp}
26+
2 13.85.20.144 Outbound {sub1-bi-prod-as-webapp, sub1-bi-dev-as-webapp}
27+
1 13.85.20.144 Possible {sub3-bi-dev-as-webapp}
28+
2 13.85.22.206 Outbound {sub2-bi-prod-as-webapp, sub1-bi-dev-as-webapp}
29+
2 13.85.23.148 Outbound {sub1-bi-dev-as-webapp, sub2-bi-prod-as-webapp}
30+
2 13.85.23.243 Outbound {sub1-bi-dev-as-webapp, sub2-bi-prod-as-webapp}
31+
1 23.96.184.12 Outbound {sub1-dev-functions-mmckydd}
32+
1 23.96.184.209 Outbound {sub1-dev-functions-mmckydd}
33+
1 23.96.186.252 Outbound {sub1-dev-functions-mmckydd}
34+
1 23.96.187.50 Outbound {sub1-dev-functions-mmckydd}
35+
5 23.96.244.71 Outbound {sub1-stg-webapp-web-n7wfdda, sub1-stg-functions-n7wfdda, sub1-stg-webapp-admin-n7wfdda, sub1-dev-ops-functions-stl4tn5...}
36+
```

‎application-gateway/README.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
# List all expiring soon certificates in Azure Application Gateway
2+
3+
Did you ever had developers or engineers coming to your desk in panic realizing their Azure Application Gateway' certificates expired without them knowing it in advance. Causing them downtime in their release pipeline, dev or worst, their production environment!
4+
5+
## Requirements
6+
Tested with Azure PowerShell Az v1.x.x
7+
8+
Tested with Azure PowerShell Az.ResourceGraph module v0.7.6
9+
10+
## The problematic
11+
Did you ever had developers or engineers coming to your desk in panic realizing their Azure Application Gateway' certificates expired without them knowing it in advance. Causing them downtime in their release pipeline, dev or worst, their production environment!
12+
13+
## What is proposed
14+
Be proactive instead of reactive with this little script. Using this, you can get the list the certificates in your Azure Application Gateway that are soon due to expire. You have full control over the desired time period to be considered as expiring soon.
15+
16+
It is build so that you can take the output and do whatever you want with it after, whenever it's convert it to JSON, CSV, XML.
17+
18+
## Overview
19+
This is an overview of the usage you can do of the script Get-AzureAppGatewayExpiringCertificates
20+
21+
```powershell
22+
Connect-AzAccount
23+
24+
# Will list certificates if they expires 120 days from today
25+
$audit = .\Get-AzureAppGatewayExpiringCertificates.ps1 -ExpiresInDay 180 -Verbose
26+
27+
$audit
28+
29+
VERBOSE: Iteration #1
30+
VERBOSE: Sent top=100 skip=0 skipToken=
31+
VERBOSE: Received results: 17
32+
VERBOSE: 17
33+
34+
Name Value
35+
---- -----
36+
SubscriptionId 00000000-0000-0000-0000-000000000000
37+
Thumbprint 4956BCC058BCA4BCB1349357AB474CCDBB37C28AB
38+
ResourceGroup poc-prod-common
39+
SubscriptionName my-company-subscription
40+
NotAfter 3/4/2019 4:51:03 PM
41+
Cert [Subject]...
42+
Name poc-prod-common-ag
43+
CertificateName Wildcard_domain_com
44+
ImpactedListeners {Internal-Https-Demo API-Https-Demo Portal-Https-Demo … }
45+
46+
47+
# or if you want the information in JSON you can do:
48+
$audit | ConvertTo-Json
49+
```

‎application-gateway/expiring-certificates/Get-AzureAppGatewayExpiringCertificates.ps1‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,44 @@
1+
[CmdletBinding()]
2+
param(
3+
$ExpiresInDays = 90
4+
)
5+
6+
$pageSize = 100
7+
$iteration = 0
8+
$searchParams = @{
9+
Query = 'where type =~ "Microsoft.Network/applicationGateways" | project id, subscriptionId, subscriptionDisplayName, resourceGroup, name, sslCertificates = properties.sslCertificates | order by id'
10+
First = $pageSize
11+
Include = 'displayNames'
12+
}
13+
14+
$results = do {
15+
$iteration += 1
16+
Write-Verbose "Iteration #$iteration"
17+
$pageResults = Search-AzGraph @searchParams
18+
$searchParams.Skip += $pageResults.Count
19+
$pageResults
20+
Write-Verbose $pageResults.Count
21+
} while ($pageResults.Count -eq $pageSize)
22+
23+
$90daysfromNow = (Get-Date).AddDays($ExpiresInDays)
24+
$results | % {
25+
$record = $_
26+
27+
$record.sslCertificates | % {
28+
$sslCertRecord = $_
29+
$cert = [System.Security.Cryptography.X509Certificates.X509Certificate2]([System.Convert]::FromBase64String($_.properties.publicCertData.Substring(60,$_.properties.publicCertData.Length-60)))
30+
if ($cert.NotAfter -le $90daysfromNow) {
31+
@{
32+
SubscriptionId = $record.subscriptionId
33+
SubscriptionName = $record.subscriptionDisplayName
34+
ResourceGroup = $record.resourceGroup
35+
Name = $record.Name
36+
Cert = $cert
37+
CertificateName = $sslCertRecord.name
38+
NotAfter = $cert.NotAfter
39+
Thumbprint = $cert.Thumbprint
40+
ImpactedListeners = ,@($sslCertRecord.properties.httpListeners | ForEach-Object { ($_.id -split'/')[-1] } )
41+
}
42+
}
43+
}
44+
}

‎azure-ad/expiring-app-credentials/Get-AzADAppExpiringCredentials.ps1‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,33 @@
1+
[CmdletBinding()]
2+
param(
3+
[Parameter(HelpMessage = 'Will output credentials if withing this number of days, use 0 to report only expired and valid as of today')]
4+
$ExpiresInDays = 90
5+
)
6+
7+
Write-Host 'Gathering necessary information...'
8+
$applications = Get-AzADApplication
9+
$servicePrincipals = Get-AzADServicePrincipal
10+
11+
$appWithCredentials = @()
12+
$appWithCredentials += $applications | Sort-Object -Property DisplayName | % {
13+
$application = $_
14+
$sp = $servicePrincipals | ? ApplicationId -eq $application.ApplicationId
15+
Write-Verbose ('Fetching information for application {0}' -f $application.DisplayName)
16+
$application | Get-AzADAppCredential -ErrorAction SilentlyContinue | Select-Object -Property @{Name='DisplayName'; Expression={$application.DisplayName}}, @{Name='ObjectId'; Expression={$application.Id}}, @{Name='ApplicationId'; Expression={$application.ApplicationId}}, @{Name='KeyId'; Expression={$_.KeyId}}, @{Name='Type'; Expression={$_.Type}},@{Name='StartDate'; Expression={$_.StartDate -as [datetime]}},@{Name='EndDate'; Expression={$_.EndDate -as [datetime]}}
17+
}
18+
19+
Write-Host 'Validating expiration data...'
20+
$today = (Get-Date).ToUniversalTime()
21+
$limitDate = $today.AddDays($ExpiresInDays)
22+
$appWithCredentials | Sort-Object EndDate | % {
23+
if($_.EndDate -lt $today) {
24+
$_ | Add-Member -MemberType NoteProperty -Name 'Status' -Value 'Expired'
25+
} elseif ($_.EndDate -le $limitDate) {
26+
$_ | Add-Member -MemberType NoteProperty -Name 'Status' -Value 'ExpiringSoon'
27+
} else {
28+
$_ | Add-Member -MemberType NoteProperty -Name 'Status' -Value 'Valid'
29+
}
30+
}
31+
32+
$appWithCredentials
33+
Write-Host 'Done.'

‎azure-ad/expiring-app-credentials/README.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# Audit expiring soon Azure AD application credentials (keys/certificates)
2+
3+
Too often you'll have developers or engineers coming to your desk in panic realizing their Azure AD application credential expired without them knowing it in advance. Be proactive instead of reactive and periodically audit soon to be expired Azure AD application credentials.
4+
5+
## Requirements
6+
Tested with Azure PowerShell Az v1.x.x
7+
8+
## The problematic
9+
Too often you'll have developers or engineers coming to your desk in panic realizing their Azure AD application credential expired without them knowing it in advance and it causes them downtime in their release pipeline, dev or worst, their production environment!
10+
11+
## What is proposed
12+
Be proactive instead of reactive with this little script. Using this, you can get the list of your application in Azure AD that credentials are soon due to expire. You have full control over the desired time period for the credentials to be considered as expiring soon.
13+
14+
## Overview
15+
This is an overview of the usage you can do of the script Get-AzADAppExpiringCredentials
16+
```powershell
17+
Connect-AzAccount
18+
19+
# Will mark entries as ExpiringSoon if they ends 120 days from today
20+
$audit = & .\Get-AzADAppExpiringCredentials.ps1 -ExpiresInDays 120 -Verbose
21+
22+
Gathering necessary information...
23+
VERBOSE: Fetching information for application ADAuditPlus Reporting
24+
VERBOSE: Fetching information for application app registration
25+
...
26+
Validating expiration data...
27+
Done.
28+
29+
$audit | Group-Object -Property Status
30+
31+
Count Name Group
32+
----- ---- -----
33+
54 Expired {@{DisplayName=AutomationAccount_E+6heptOMzz8vX9ooTYFZq8DJYKweTDdIFrQmOo3BXs=; Objec...
34+
11 ExpiringSoon {@{DisplayName=AutomationAccountQwerty_e1yHxjl45+GwXIxG/mwqMnARwn5i6C5zSMAAIxZyzw...
35+
173 Valid {@{DisplayName=ADAuditPlus Reporting; ObjectId=; ApplicationId=9db46068-49a0-45ae-b2...
36+
37+
# or if you want the information in JSON you can do:
38+
$audit | ConvertTo-Json
39+
40+
[
41+
{
42+
"DisplayName": "AutomationAccountQwerty_e1yHxjl45",
43+
"ObjectId": null,
44+
"ApplicationId": {
45+
"value": "e918c692-7aff-46f0-a3f6-488ded8f879a",
46+
"Guid": "e918c692-7aff-46f0-a3f6-488ded8f879a"
47+
},
48+
"KeyId": "baaf958b-bc2a-43ea-ab1f-0255662cd2bb",
49+
"Type": "Password",
50+
"StartDate": {
51+
"value": "2016-05-11T14:55:30",
52+
"DateTime": "Wednesday, May 11, 2016 2:55:30 PM"
53+
},
54+
"EndDate": {
55+
"value": "2018-05-11T14:55:30",
56+
"DateTime": "Thursday, May 11, 2018 2:55:30 PM"
57+
},
58+
"Status": "ExpiringSoon"
59+
},
60+
...
61+
]
62+
```

0 commit comments

Comments
 (0)