{"id":18192,"date":"2020-02-06T14:59:33","date_gmt":"2020-02-06T22:59:33","guid":{"rendered":"http:\/\/devblogs.microsoft.com\/powershell\/?p=18192"},"modified":"2020-02-06T16:04:43","modified_gmt":"2020-02-07T00:04:43","slug":"secrets-management-module-vault-extensions","status":"publish","type":"post","link":"https:\/\/devblogs.microsoft.com\/powershell\/secrets-management-module-vault-extensions\/","title":{"rendered":"Secrets Management Module Vault Extensions"},"content":{"rendered":"
\n

\n<\/span><\/a>Secrets Management Module Vault Extensions<\/h2>\n

A new PowerShell Secrets Management<\/a> module has been published on PowerShell Gallery. It is currently in a pre-release state and still in active development. Even though the module is not complete, we have released it to gather early community feedback. Most of the functionality is implemented, but currently the module only works on Windows with Linux support coming next, followed by macOS. This article describes the Secrets Management module in general, but is mostly about how vault extensions work. For a full overview of Secrets Management see this article<\/a>.<\/p>\n

The Secrets Management module is based on the Secrets Management RFC<\/a>, which you can learn more about from this great Ignite presentation<\/a>.<\/p>\n

\n<\/span><\/a>Secrets Management module<\/h2>\n

The purpose of the Secrets Management module is to provide secure storage and access of secrets in your PowerShell scripts. It consists of an always available local storage solution (or vault), along with a vault extension mechanism that allows registration of other secrets storage\/retrieval solutions. A vault extension can implement a local or remote custom storage solution.<\/p>\n

The Secrets Management module contains commands for registering vault extensions, and manipulating vault secrets.<\/p>\n

For example, this script uses the Secrets Management module to retrieve a NuGet API key in order to publish MyNewModule<\/code> to the PowerShell Gallery, and invoke script remotely using a stored credential:<\/p>\n

\n
Import-Module Microsoft.PowerShell.SecretsManagement\r\n\r\n# Publish a module to the PowerShell Gallery\r\nPublish-Module -Path C:\\Modules\\Publish\\MyNewModule -NuGetApiKey (Get-Secret NuGetApiKey -AsPlainText)\r\n\r\n# Run management script on multiple machines\r\nInvoke-Command -Cn $machines -FilePath .\\MyMgmtScript.ps1 -Credential (Get-Secret MgmtCred)<\/pre>\n<\/div>\n
\n<\/span><\/a>Built-in local vault<\/h2>\n
The Secrets Management module comes with a built-in local vault. It is always present and can be used to safely store and retrieve secrets without any extension vaults registered. On Windows, it is implemented with CredMan<\/a>. Credential Manager encrypts and stores secrets based on the current user context, and only that same user can access those secrets. On Linux, the built-in local vault will likely use Gnome Keyring<\/a> to securely store and retrieve secrets, though others can be added in the future, whether by the PowerShell Team or an external vault extension author.<\/p>\n
This example shows the names and types of credentials created and stored in the built-in local vault:<\/p>\n
\n
Get-SecretInfo\r\n\r\nName                 Vault             TypeName\r\n----                 -----             --------\r\nGitHubPATForRelease  BuiltInLocalVault String\r\nGitRepoAccessToken   BuiltInLocalVault String\r\nLocalAdminCred       BuiltInLocalVault PSCredential\r\nSecretParameters     BuiltInLocalVault Hashtable\r\nPSGalleryPAT         BuiltInLocalVault String<\/pre>\n<\/div>\n
\n<\/span><\/a>Secret data types<\/h2>\n
The Secrets Management module supports five data types, and the built-in local vault supports all five types. However, extension vaults can implement any subset of the supported types:<\/p>\n