PowerShell — a power with curse if not careful — Azure #1 edition

PowerShell — a power with curse if not careful — Azure #1 edition

Photo by Arnold Francisca on Unsplash

It was one of those Friday night where you can get your ex-colleague to ask about their new company. Isn’t that more joyful than usual beer-o-clock with current colleague? Yeah, I prefer the former than later.

So, this dude told me that his company was in disaster just couple of weeks ago. The convo goes like this:

Dude: “I never deployed so many applications configuration changes in my life” Me: “Dang, you are so productive now…” Dude: “Only if you know…”

LOL…. what a bummer… I asking what happened, and he don't bother to say anything. The night is young…

Dude: “The company recently wanted to cut cost…” Me: “I don’t like where this is going…” Dude: “They hire intern…” Me: “OH… here we go… the usual intern, they are innocent…” Dude: …. keep quiet and continue chugging his beer…

Who doesn’t like intern!? They are motivated, smart (sometime), keen to learn, and cute (that’s a bonus there) …

Dude: “The S*hit head told they found some security problem and not-best-practice” Me: “hmmmm” (drink a bit of my beer) Dude: “They found lots of Azure Storage Key never been recycled” Me: “Ooofff… that’s bad indeed…” Dude: “They said, they can help us fixing this problem” Me: “SEEE TOLD YOU!!! Everyone love interns!!!” Dude: “They tell the IT director directly without us…” Me: “Suck!” (glup a big chug of my beer) Dude: “They prepared a powerhell script!” Me: “Powershell….” Dude: “No, it’s a hell…”

Azure now shows how many days the key never rotated.

Director: “Please email me the script, I’ll have a look” Intern: “This is very simply script, everything is automated. We don’t need downtime and should be quick” Director: “Yeah, I see what you are doing there. I think it’s great.” Director: “Let me run it…”

(20 minutes later)

Director: “Lots of users said their app’s not working” Dude: “Hmm.. that’s weird… we dont have any deployment” Director: “Check Azure Health, may be Azure glitches” Dude: “Nope… all green…” Director: “Did you make any config changes or something” Dude: “Nope, I was out for lunch” Intern: “uh…. uh…. I know why…” Dude: “Tell me…’ The intern then explain what happened… Dude: “FFFFF!!!”

foreach subscription in subscriptions…. PERFECT!

Yeap… Dumb and dumber in this case. So, my fella needs to redeploy all their apps because lots of them uses Azure Storage…

Moral Story: This is hard… I pray that IT Director is smarter and more careful. Lots of these ‘Director’ asked for full GOD account access on their personal corporate account. We always told them to have separate privilege account, but dumb and dumber always yell and flex their power.

Move to Managed Identity and use RBAC to Azure Storage Account. It’s great way to consume service.