使用PowerShell迁移Azure KeyVault密钥时&字符问题求助

问题现象 #

使用PowerShell脚本迁移Azure Key Vault密钥时，包含&字符的密码仅能写入&之前的内容；尝试转义&后出现如下错误：

'19!7e' is not recognized as an internal or external command, operable program or batch file.

问题原因 #

PowerShell调用az命令时，&会被解析为命令分隔符，直接传递含&的字符串会导致命令被拆分，引发解析错误。之前的转义方式不符合PowerShell的解析规则，无法正确传递特殊字符。

解决方案 #

修改脚本中写入目标密钥库的循环逻辑，避免PowerShell提前解析特殊字符。最可靠的方式是直接传递变量给az命令，而非通过字符串拼接传递参数。

修改后的写入循环代码 #

$secretObjects | ForEach-Object {
    Write-Host " - Setting secret value for '$($_.secretName)'"
    $secretValue = $_.secretValue
    az keyvault secret set --vault-name $destinationVault --name $_.secretName --value $secretValue --disabled $disableDestinationSecrets -o none
}

完整修改后的脚本 #

Param(
    [string] $originVault = 'a',
    [string] $originSubscriptionId = 'b',
    [string] $destinationVault = 'c',
    [string] $destinationSubscriptionId = 'd',
    [string] $disableDestinationSecrets = $true
)

# 1. 设置源订阅ID
Write-Host "Setting origin subscription to: $($originSubscriptionId)..."
az account set -s $originSubscriptionId

# 1.1 获取所有密钥名称
Write-Host "Listing all origin secrets from vault: $($originVault)"
$originSecretKeys = az keyvault secret list --vault-name $originVault  -o json --query "[].name"  | ConvertFrom-Json

# 1.3 遍历密钥，封装为自定义对象
$secretObjects = $originSecretKeys | ForEach-Object {
    Write-Host " - Getting secret value for '$($_)'"
    $secret = az keyvault secret show --name $_ --vault-name $originVault -o json | ConvertFrom-Json
    
    [PSCustomObject]@{
        secretName  = $_;
        secretValue = $secret.value;
    }
}

Write-Host "Done fetching secrets..."

# 2. 设置目标订阅ID
Write-Host "Setting destination subscription to: $($destinationSubscriptionId)..."
az account set -s $destinationSubscriptionId

# 2.2 遍历密钥对象，写入目标密钥库
Write-Host "Writing all destination secrets to vault: $($destinationVault)"

# 修复后的写入逻辑
$secretObjects | ForEach-Object {
    Write-Host " - Setting secret value for '$($_.secretName)'"
    $secretValue = $_.secretValue
    az keyvault secret set --vault-name $destinationVault --name $_.secretName --value $secretValue --disabled $disableDestinationSecrets -o none
}

# 3. 清理变量
Write-Host "Cleaning up and exiting."
Remove-Variable secretObjects
Remove-Variable originSecretKeys

Write-Host "Finished."

内容的提问来源于stack exchange，提问作者Damo