小编del*_*iel的帖子

我是 OPA/Rego 的新手，我正在尝试编写一个策略来检查 Azure 网络安全组是否包含我在阵列上定义的所有规则

package sample
default compliant = false
toSet(arr) = {x | x := arr[_]}
checkProperty(rule, index, propertySingular, propertyPlural) = true
{
    object.get(input.properties.securityRules[index].properties, propertySingular, "") == object.get(rule, propertySingular, "")
    count(toSet(object.get(input.properties.securityRules[index].properties, propertyPlural, [])) - toSet(object.get(rule, propertyPlural, []))) == 0
}
existRule(rule) = true
{
    input.properties.securityRules[i].name == rule.name
    input.properties.securityRules[i].properties.provisioningState == rule.provisioningState
    input.properties.securityRules[i].properties.description == rule.description
    input.properties.securityRules[i].properties.protocol == rule.protocol
    checkProperty(rule, i, "sourcePortRange", "sourcePortRanges")
    checkProperty(rule, i, "destinationPortRange", "destinationPortRanges")
    checkProperty(rule, i, "sourceAddressPrefix", "sourceAddressPrefixes")
    checkProperty(rule, i, "destinationAddressPrefix", "destinationAddressPrefixes")
    input.properties.securityRules[i].properties.access == rule.access
    input.properties.securityRules[i].properties.priority == rule.priority …

我正在尝试下载多个 KeyVault 上的证书，包括它们的私钥。通过 Azure 门户，我可以毫无问题地完成此操作，只需转到KeyVault，选择证书并单击“以 PFX/PEM 格式下载”

由于我必须在几个密钥库上重复相同的操作，因此我一直在寻找一种自动化的方法来执行此操作。到目前为止，我得出以下结论：

$objCertificate = (Get-AzKeyVaultCertificate -VaultName <Key Vault> -Name <Certificate Name>).Certificate
$bytCertificate = $objCertificate.Export('pfx',<Password>)
$strCertificate = [System.Convert]::ToBase64String($bytCertificate)
$strPath = Join-Path $env:TEMP "$($objCertificate.Subject).pfx"
$bytCertificate | Set-Content -Path $strPath -Force -Encoding Byte

问题是它仅使用公钥下载证书，我还需要包含在其中的私钥，就像我通过门户下载证书时一样。你知道我可能会错过什么吗？