Azure Key Vault：使用PowerShell备份密钥失败求助

Hey there! Let's work through this Azure Key Vault backup issue step by step. Since you haven't shared the exact error message or your script, I'll start with a reliable backup script template, then cover the most common errors and fixes you might run into.

Sample Working Backup Script #

First, let's make sure you're using a solid base script. Here's a tested example that backs up all keys in a specified Key Vault to a local directory:

# Install/Update Azure module if needed
Install-Module -Name Az.KeyVault -Force -AllowClobber -Scope CurrentUser

# Connect to Azure
Connect-AzAccount

# Set variables
$keyVaultName = "your-key-vault-name"
$backupDirectory = "C:\KeyVaultBackups"

# Create backup directory if it doesn't exist
if (-not (Test-Path -Path $backupDirectory)) {
    New-Item -ItemType Directory -Path $backupDirectory | Out-Null
}

# Get all keys in the Key Vault
$keys = Get-AzKeyVaultKey -VaultName $keyVaultName

# Backup each key
foreach ($key in $keys) {
    $backupFilePath = Join-Path -Path $backupDirectory -ChildPath "$($key.Name).backup"
    Backup-AzKeyVaultKey -VaultName $keyVaultName -Name $key.Name -OutputFile $backupFilePath
    Write-Host "Backed up key: $($key.Name) to $backupFilePath"
}

Common Errors & Fixes #

Let's go through the most frequent issues that cause PowerShell errors during this process:

• "The client 'your-user' does not have permission to perform action 'Microsoft.KeyVault/vaults/keys/backup/action' on scope..."

  This is a permission issue. Ensure your Azure AD account has the Key Vault Backup role (or a custom role with the Microsoft.KeyVault/vaults/keys/backup/action permission) assigned to the Key Vault. You can assign this via the Azure Portal or using New-AzRoleAssignment.

• "The term 'Get-AzKeyVaultKey' is not recognized as the name of a cmdlet..."

  The Az.KeyVault module isn't installed or loaded. Run Install-Module -Name Az.KeyVault -Force to install it, then Import-Module Az.KeyVault to load it in your session.

• "Key vault 'your-vault' not found."

  Double-check the Key Vault name is correct, and confirm it's in the Azure subscription you're connected to. Use Get-AzKeyVault to list all vaults in your current subscription to verify.

• "Access denied due to network restrictions."

  If your Key Vault has network policies enabled, ensure your machine's IP is allowed in the Key Vault's firewall settings, or use a private endpoint if you're on a corporate network.

• "Backup failed because key is soft-deleted and not recoverable."

  Soft-deleted keys can't be backed up until they're recovered. Use Undo-AzKeyVaultKeyRemoval to restore the key first, then run the backup.

If You Still Need Help #

If you're still getting errors, please share:

• The full error message (including the error code and stack trace if available)
• A snippet of your script (redact any sensitive info like vault names if needed)
• The version of the Az.KeyVault module you're using (run Get-Module Az.KeyVault to check)

内容的提问来源于stack exchange，提问作者Fuzzy Logic