Document Details
Backup Azure Restore Key Secret
❌
This page contains Windows bias
About This Page
This page is part of the Azure documentation. It contains code examples and configuration instructions for working with Azure services.
Bias Analysis
Bias Types:
⚠️
powershell_heavy
⚠️
windows_first
⚠️
windows_tools
⚠️
missing_linux_example
Summary:
The documentation is heavily biased toward Windows and PowerShell usage. All examples use PowerShell cmdlets, Windows file paths (e.g., C:\), and Windows-centric tools and workflows. Linux is only mentioned in passing, with no Bash, Azure CLI, or Linux-native examples provided. The documentation assumes the user is operating in a Windows environment, even for Linux VM scenarios.
Recommendations:
- Provide equivalent Azure CLI and Bash examples for all PowerShell commands, especially for Linux users.
- Use platform-agnostic file paths or provide both Windows (C:\) and Linux (/home/user/) path examples.
- Include explicit instructions for restoring keys and secrets from Linux or macOS environments, not just Windows.
- Mention and demonstrate cross-platform tools (e.g., Azure CLI, REST API) alongside PowerShell.
- Reorder sections or examples so that Linux and Windows are given equal prominence, or clarify when steps are identical across platforms.
Create pull request
Scan History
| Date | Scan ID | Status | Bias Status |
|---|---|---|---|
| 2025-08-21 00:01 | #87 | in_progress | ❌ Biased |
| 2025-08-11 00:00 | #77 | completed | ✅ Clean |
| 2025-08-10 00:00 | #76 | completed | ✅ Clean |
| 2025-08-09 00:00 | #75 | completed | ✅ Clean |
| 2025-08-08 00:00 | #74 | completed | ✅ Clean |
| 2025-08-07 00:00 | #73 | completed | ✅ Clean |
| 2025-08-06 00:00 | #72 | completed | ✅ Clean |
| 2025-08-05 00:00 | #71 | completed | ✅ Clean |
| 2025-08-03 00:00 | #69 | completed | ✅ Clean |
| 2025-08-01 00:00 | #67 | completed | ✅ Clean |
| 2025-07-31 00:00 | #66 | completed | ✅ Clean |
| 2025-07-30 00:00 | #65 | completed | ✅ Clean |
| 2025-07-29 00:01 | #64 | completed | ✅ Clean |
| 2025-07-28 00:00 | #63 | completed | ✅ Clean |
| 2025-07-27 00:00 | #62 | completed | ✅ Clean |
| 2025-07-26 00:01 | #61 | completed | ✅ Clean |
| 2025-07-25 00:00 | #60 | completed | ✅ Clean |
| 2025-07-24 00:00 | #59 | completed | ✅ Clean |
| 2025-07-23 00:00 | #58 | completed | ✅ Clean |
| 2025-07-22 00:01 | #57 | completed | ✅ Clean |
| 2025-07-21 00:00 | #56 | completed | ✅ Clean |
| 2025-07-19 13:51 | #54 | completed | ✅ Clean |
| 2025-07-13 21:37 | #48 | completed | ✅ Clean |
| 2025-07-09 13:09 | #3 | cancelled | ✅ Clean |
| 2025-07-08 04:23 | #2 | cancelled | ❌ Biased |
Flagged Code Snippets
$properties = $details.properties
$storageAccountName = $properties["Target Storage Account Name"]
$containerName = $properties["Config Blob Container Name"]
$encryptedBlobName = $properties["Encryption Info Blob Name"]
Set-AzCurrentStorageAccount -Name $storageaccountname -ResourceGroupName '<rg-name>'
$destination_path = 'C:\vmencryption_config.json'
Get-AzStorageBlobContent -Blob $encryptedBlobName -Container $containerName -Destination $destination_path
$encryptionObject = Get-Content -Path $destination_path | ConvertFrom-Json
$keyDestination = 'C:\keyDetails.blob'
[io.file]::WriteAllBytes($keyDestination, [System.Convert]::FromBase64String($encryptionObject.OsDiskKeyAndSecretDetails.KeyBackupData))
Restore-AzKeyVaultKey -VaultName '<target_key_vault_name>' -InputFile $keyDestination
$secretdata = $encryptionObject.OsDiskKeyAndSecretDetails.SecretData
$Secret = ConvertTo-SecureString -String $secretdata -AsPlainText -Force
$secretname = 'B3284AAA-DAAA-4AAA-B393-60CAA848AAAA'
$Tags = @{'DiskEncryptionKeyEncryptionAlgorithm' = 'RSA-OAEP';'DiskEncryptionKeyFileName' = 'B3284AAA-DAAA-4AAA-B393-60CAA848AAAA.BEK';'DiskEncryptionKeyEncryptionKeyURL' = $encryptionObject.OsDiskKeyAndSecretDetails.KeyUrl;'MachineName' = 'vm-name'}
Set-AzKeyVaultSecret -VaultName '<target_key_vault_name>' -Name $secretname -SecretValue $Secret -ContentType 'Wrapped BEK' -Tags $Tags
$secretdata = $encryptionObject.OsDiskKeyAndSecretDetails.SecretData
$Secret = ConvertTo-SecureString -String $secretdata -AsPlainText -Force
$secretname = 'B3284AAA-DAAA-4AAA-B393-60CAA848AAAA'
$Tags = @{'DiskEncryptionKeyEncryptionAlgorithm' = 'RSA-OAEP';'DiskEncryptionKeyFileName' = 'LinuxPassPhraseFileName';'DiskEncryptionKeyEncryptionKeyURL' = <Key_url_of_newly_restored_key>;'MachineName' = 'vm-name'}
Set-AzKeyVaultSecret -VaultName '<target_key_vault_name>' -Name $secretname -SecretValue $Secret -ContentType 'Wrapped BEK' -Tags $Tags
$secretDestination = 'C:\secret.blob'
[io.file]::WriteAllBytes($secretDestination, [System.Convert]::FromBase64String($encryptionObject.OsDiskKeyAndSecretDetails.KeyVaultSecretBackupData))
Restore-AzKeyVaultSecret -VaultName '<target_key_vault_name>' -InputFile $secretDestination -Verbose
$rp1 = Get-AzRecoveryServicesBackupRecoveryPoint -RecoveryPointId $rp[0].RecoveryPointId -Item $backupItem -KeyFileDownloadLocation 'C:\Users\downloads'
Restore-AzureKeyVaultKey -VaultName '<target_key_vault_name>' -InputFile 'C:\Users\downloads'
$secretname = 'B3284AAA-DAAA-4AAA-B393-60CAA848AAAA'
$secretdata = $rp1.KeyAndSecretDetails.SecretData
$Secret = ConvertTo-SecureString -String $secretdata -AsPlainText -Force
$Tags = @{'DiskEncryptionKeyEncryptionAlgorithm' = 'RSA-OAEP';'DiskEncryptionKeyFileName' = 'B3284AAA-DAAA-4AAA-B393-60CAA848AAAA.BEK';'DiskEncryptionKeyEncryptionKeyURL' = 'https://mykeyvault.vault.azure.net:443/keys/KeyName/84daaac999949999030bf99aaa5a9f9';'MachineName' = 'vm-name'}
Set-AzKeyVaultSecret -VaultName '<target_key_vault_name>' -Name $secretname -SecretValue $secret -Tags $Tags -SecretValue $Secret -ContentType 'Wrapped BEK'