{"id":503,"date":"2018-06-15T11:58:21","date_gmt":"2018-06-15T11:58:21","guid":{"rendered":"http:\/\/www.ciraltos.com\/?p=503"},"modified":"2023-03-24T00:12:51","modified_gmt":"2023-03-24T05:12:51","slug":"variables-in-azure-automation","status":"publish","type":"post","link":"https:\/\/www.ciraltos.com\/staging2\/variables-in-azure-automation\/","title":{"rendered":"Variables in Azure Automation"},"content":{"rendered":"

\"AzureAutomation\"Shared Resources in Azure Automation allow for the reuse of credentials, modules, scheduled, connections, certificates and variables. Variable assets provide a way to share values between multiple runbooks as well as between multiple jobs from the same runbook. In this post, I outline how to reference variables that are encrypted and non-encrypted in an Azure Automation runbook.<\/p>\n

A little context always helps understanding. In this case, I need to reference a secure key in my runbook. The simple way to do this would be to reference the key directly in the script by setting a variable like this:<\/p>\n

$secureKey = \u20180123456789abcdef==\u2019<\/pre>\n
This will work, but it has some drawbacks. The first and most obvious is the security implications of keeping the key directly in the code. Anyone with access to the runbook or source files could view the key.<\/p>\n
Another drawback is that the key sometimes needs to be regenerated. Once regenerated, the value will need to be updated in every runbook that uses it. This is manageable with a small number of runbooks, but this won\u2019t scale well in larger environments.<\/p>\n
These drawbacks can be avoided with the use of an Azure Automation Variable. The key value is referenced, not added to the code. The value can be set in one location and called from multiple runbooks. There is no need to update individual runbooks when the Variable changes.<\/p>\n
Non-Encrypted Variables<\/h2>\n
Variables can be created in the portal by going into the Automation account and select Variable, New Variable. The following commands can be used to create the asset and update the value. Reference Microsoft\u2019s complete documentation here<\/a>.<\/p>\n
New-AzureRmAutomationVariable -ResourceGriopName \u201cResource Group\u201d -automationAccoiuntName \u201cAutoamtion Account\u201d -name \u201cVariable Name\u201d -Encrypted $false -Value \u201cVariable Value\u201d<\/pre>\n
To retrieve the value of a variable, use the Get-AzureRmAutoamtionVariable to assign the value to a new variable in the Runbook scope.<\/p>\n
$automationValue = (Get-AzureRmAutomationVariable -ResourceGrupName \u201cResource Group\u201d -AutomationAccountName \u201cAutomation Account\u201d -name \u201cVariable Name\u201d).Value<\/pre>\n
This can be set and retrieved in PowerShell by logging into Azure with an account that has rights to the Automation Account.<\/p>\n
\"\"<\/a><\/p>\n
\"\"<\/a><\/p>\n
Encrypted Variables<\/h2>\n
That\u2019s all fine and good, but what if you want to encrypt the variable? Encrypted variables are secured by a unique key generated for each Automation Account. There are a couple rules with encrypted variables to keep in mind:<\/p>\n