search

PowerShell / Modules

MIT License
112 stars 25 forks source link

[SecretsManagement] Add 'List' capability to Get-Secret (Provider may opt not to implement) #25

Closed JustinGrote closed 4 years ago

JustinGrote commented 4 years ago

Summary of the new feature/enhancement

As a user, I want Get-Secret to return all the known secrets if no arguments are provided, similar to how I understand Get-ChildItem, Get-Alias, Get-AWSRegion, etc. to behave.

Proposed technical implementation details (optional)

A vault may choose to not implement this feature due to technical or security limitations, in which case it would return an exception and Secrets Management would handle the exception with a warning message or simply not returning output.

JustinGrote commented 4 years ago

@PaulHigin should I move this to the Powershell-RFC discussion instead or is it relevant here?

PaulHigin commented 4 years ago

@JustinGrote Since Secrets Management is in development now, this is the right place for all related issues.

PaulHigin commented 4 years ago

We thought about doing this, but couldn't think of a good use scenario. We were also worried about the security of dumping all secrets at once. So currently you can dump all secret information (without the actual secret), but have to retrieve a secret object one at a time.

JustinGrote commented 4 years ago

@PaulHigin thanks for the info. I'd say we can close that as sufficient, as long as the related pipeline support gets implemented, in which case you can explicity do it via: get-secretinfo | get-secret

in addition to get-secretinfo 'jwg' | get-secret,

etc. so that get-secret still requires a specified secret object, but it will loop through multiple requested to it. I will submit that as a separate issue now that you have answered the "RFC vs Issue" question.