[Keyvault][2.0.6] "az keyvault secret list" doesn't show "name" of secret, but download/show require it

Description

To use keyvault as a rsa keystore, I’ll need to use download and show when I setting up new local machines (let alone servers in Azure). But both of those require --name of the secret. Unfortunately, the name value is not displayed by the output of list.

Result: I can’t script directly from list, because I have to put a sed from xargs in there to calculate the name from the id value that is returned.

GOAL: the metadata from list has the name value already in it so that you can easily script the keys from there without interpolating xargs/sed.

EXAMPLE:

az keyvault secret list --vault-name xxx
[
  {
    "attributes": {
      "created": "2017-05-28T09:50:49+00:00",
      "enabled": true,
      "expires": null,
      "notBefore": null,
      "updated": "2017-05-28T09:50:49+00:00"
    },
    "contentType": "Password-less private key for dcos demos",
    "id": "https://xxx.vault.azure.net/secrets/<name of key>",
    "managed": null,
    "tags": {
      "file-encoding": "utf-8"
    }
  }

---

Environment summary

Install Method: How did you install the CLI? (e.g. pip, interactive script, apt-get, Docker, MSI, nightly)
Answer here: sudo -H pip install azure-cli

CLI Version: What version of the CLI and modules are installed? (Use az --version)
Answer here: ╰─ az --version azure-cli (2.0.6)

acr (2.0.4) acs (2.0.6) appservice (0.1.6) batch (2.0.4) cdn (0.0.2) cloud (2.0.2) cognitiveservices (0.1.2) command-modules-nspkg (2.0.0) component (2.0.4) configure (2.0.6) core (2.0.6) cosmosdb (0.1.6) dla (0.0.6) dls (0.0.6) feedback (2.0.2) find (0.2.2) interactive (0.3.2) iot (0.1.5) keyvault (2.0.4) lab (0.0.4) monitor (0.0.4) network (2.0.6) nspkg (3.0.0) profile (2.0.4) rdbms (0.0.1) redis (0.2.3) resource (2.0.6) role (2.0.4) sf (1.0.1) sql (2.0.3) storage (2.0.6) vm (2.0.6)

Python (Darwin) 2.7.13 (default, Apr 4 2017, 08:47:57) [GCC 4.2.1 Compatible Apple LLVM 8.1.0 (clang-802.0.38)]

Python location ‘/usr/local/opt/python/bin/python2.7’

OS Version: What OS and version are you using?
Answer here: macOS Sierra, 10.12.5

Shell Type: What shell are you using? (e.g. bash, cmd.exe, Bash on Windows)
Answer here: oh-my-zsh

[shtratos]

Until this is fixed, here’s a workaround I use for reading secrets using bash and jq:

# this prints all the secrets in the keyvault
VAULT_NAME=my-key-vault
for i in `az keyvault secret list --vault-name $VAULT_NAME | jq  --raw-output '.[]|(.id / "/")[4]'`
do 
  az keyvault secret show --vault-name $VAULT_NAME --name $i 
done | jq --raw-output '[(.id / "/")[4], .value] | join("=")'

[squillace]

Hi @schaabs, not sure we should have you do the work for that if the server side is updated in the future. I just wanted THAT updated. But parsing the ID is ‘ok’ for now. I’d let this be the issue to fix the server and close it when that is done.