How to hide sensitve values in error messages in Azure PowerShell?

Question

In azure Powershell I use the command "az vm run-command invoke" to execute scripts to virtual machines, the problem is when for some reason it doesn't work, it prints in the error message all the parameters'value in clear, and these parameters are sensitive data that I don't have to print in the error message for security reason.

This is what I try to execute:

az vm run-command invoke -g $ResourceGroupName -n $VMname[-1] --command-id RunPowerShellScript --scripts @$pathScript --parameters "param1=$($Data1)" `
    "param2=$($Data2)"

In my case, Data1 can be sensitive, I never print that value in the code, but in the error message the value is shown in clear, and I don't have to allow that.

Keep in mind that the script defined in @$pathScript and executed in the machine works well when I add the right parameters.

I tried by puting the code into a try catch block, but this is still throwing the error message and it doesn't print the message added in the catch part

try{
    az vm run-command invoke -g $ResourceGroupName -n $VMname[-1] --command-id RunPowerShellScript --scripts @$pathScript --parameters "param1=$($Data1)" `
    "param2=$($Data2)" 
}catch{
    Write-Error "Error : Please check if your are passing the good arguments - Check the code if you need and debug it"
}

What am I missing?.

is param1 defined as securestring in your script ? – Thomas Jul 06 '21 at 08:38 — Thomas, Jul 06 '21 at 08:38
Good point @Thomas, I'll check that – Elias Arellano Jul 06 '21 at 08:48 — Elias Arellano, Jul 06 '21 at 08:48

score 1 · Answer 1 · answered Jul 06 '21 at 09:16

Since this is an external application you would not be able to catch the error using try/catch. You could instead try redirecting the error stream to $null (2>$null)so that it is not seen and then check the $LASTEXITCODE. Below I just broadly check if $LASTEXITCODE does not equal 0 and generate the error but you may want to check what is the exact exit code that you are getting and only write the error then.

az vm run-command invoke -g $ResourceGroupName -n $VMname[-1] --command-id RunPowerShellScript --scripts @$pathScript --parameters "param1=$($Data1)" `
    "param2=$($Data2)" 2>$null
if ($LASTEXITCODE) {
    Write-Error 'Error : Please check if your are passing the good arguments - Check the code if you need and debug it'
}

How to hide sensitve values in error messages in Azure PowerShell?

1 Answers1