Purge Key Vaults and Managed HSMs

eng/common/TestResources/Remove-TestResources.ps1

@@ -61,6 +61,21 @@ if (!$PSBoundParameters.ContainsKey('ErrorAction')) {
     $ErrorActionPreference = 'Stop'
 }
 
+# Support actions to invoke on exit.
+$exitActions = @({
+    if ($exitActions.Count -gt 1) {
+        Write-Verbose 'Running registered exit actions.'
+    }
+})
+
+trap {
+    # Like using try..finally in PowerShell, but without keeping track of more braces or tabbing content.
+    $exitActions.Invoke()
+}
+
+# Source helpers to purge resources.
+. "$PSScriptRoot\..\scripts\Helpers\Resource-Helpers.ps1"
+
 function Log($Message) {
     Write-Host ('{0} - {1}' -f [DateTime]::Now.ToLongTimeString(), $Message)
 }
@@ -86,18 +101,6 @@ function Retry([scriptblock] $Action, [int] $Attempts = 5) {
     }
 }
 
-# Support actions to invoke on exit.
-$exitActions = @({
-    if ($exitActions.Count -gt 1) {
-        Write-Verbose 'Running registered exit actions.'
-    }
-})
-
-trap {
-    # Like using try..finally in PowerShell, but without keeping track of more braces or tabbing content.
-    $exitActions.Invoke()
-}
-
 if ($ProvisionerApplicationId) {
     $null = Disable-AzContextAutosave -Scope Process
 
@@ -213,17 +216,11 @@ $verifyDeleteScript = {
     }
 }
 
-# Get any Key Vaults that will be deleted so they can be purged later if soft delete is enabled.
-$vaults = Get-AzKeyVault -ResourceGroupName "$ResourceGroupName" | ForEach-Object {
-    # Enumerating vaults from a resource group does not return all properties we required.
-    Get-AzKeyVault -VaultName $_.VaultName | Where-Object { $_.EnableSoftDelete }
-}
-
-# You may add additional resource checks that require the resource group to be deleted first before purging here.
-$purgeRequired = $vaults -or $false
+# Get any resources that can be purged after the resource group is deleted.
+$purgeableResources = Get-PurgeableResources $ResourceGroupName
 
 Log "Deleting resource group '$ResourceGroupName'"
-if ($Force -and !$purgeRequired) {
+if ($Force -and !$purgeableResources) {
     Remove-AzResourceGroup -Name "$ResourceGroupName" -Force:$Force -AsJob
     Write-Verbose "Running background job to delete resource group '$ResourceGroupName'"
 
@@ -233,17 +230,8 @@ if ($Force -and !$purgeRequired) {
     Remove-AzResourceGroup -Name "$ResourceGroupName" -Force:$Force
 }
 
-# Purge any soft deleted vaults since there is now a limit per-subscription.
-foreach ($vault in $vaults) {
-    Log "Attempting to purge Key Vault '$($vault.VaultName)'"
-
-    if ($vault.EnablePurgeProtection) {
-        # We will try anyway but will ignore errors
-        Write-Warning "Key Vault '$($vault.VaultName)' has purge protection enabled and may not be purged for $($vault.SoftDeleteRetentionInDays) days"
-    }
-
-    Remove-AzKeyVault -VaultName $vault.VaultName -Location $vault.Location -InRemovedState -Force -ErrorAction Ignore
-}
+# Now purge the resources that should have been deleted with the resource group.
+Remove-PurgeableResources $purgeableResources
 
 $exitActions.Invoke()
 

eng/common/scripts/Helpers/Resource-Helpers.ps1

@@ -0,0 +1,71 @@
+# Add 'AzsdkResourceType' member to outputs since actual output types have changed over the years.
+
+function Get-PurgeableResources {
+    param (
+        [Parameter(Position=0)]
+        [ValidateNotNullOrEmpty()]
+        [string] $ResourceGroupName
+    )
+
+    # Get any Key Vaults that will be deleted so they can be purged later if soft delete is enabled.
+    Get-AzKeyVault @PSBoundParameters | ForEach-Object {
+        # Enumerating vaults from a resource group does not return all properties we required.
+        Get-AzKeyVault -VaultName $_.VaultName | Where-Object { $_.EnableSoftDelete } `
+            | Add-Member -MemberType NoteProperty -Name AzsdkResourceType -Value 'Key Vault' -PassThru
+    }
+
+    # Get any Managed HSMs in the resource group, for which soft delete cannot be disabled.
+    Get-AzKeyVaultManagedHsm @PSBoundParameters `
+        | Add-Member -MemberType NoteProperty -Name AzsdkResourceType -Value 'Managed HSM' -PassThru
+}
+
+function Remove-PurgeableResources {
+    param (
+        [Parameter(Mandatory=$true, Position=0, ValueFromPipeline=$true)]
+        [psobject[]] $Resource
+    )
+
+    $subscriptionId = (Get-AzContext).Subscription.Id
+
+    foreach ($r in $Resource) {
+        Log "Attempting to purge $($r.AzsdkResourceType) '$($r.VaultName)'"
+
+        switch ($r.AzsdkResourceType) {
+            'Key Vault' {
+                if ($r.EnablePurgeProtection) {
+                    # We will try anyway but will ignore errors
+                    Write-Warning "Key Vault '$($r.VaultName)' has purge protection enabled and may not be purged for $($r.SoftDeleteRetentionInDays) days"
+                }
+
+                Remove-AzKeyVault -VaultName $r.VaultName -Location $r.Location -InRemovedState -Force -ErrorAction Continue
+            }
+
+            'Managed HSM' {
+                if ($r.EnablePurgeProtection) {
+                    # We will try anyway but will ignore errors
+                    Write-Warning "Managed HSM '$($r.Name)' has purge protection enabled and may not be purged for $($r.SoftDeleteRetentionInDays) days"
+                }
+
+                $response = Invoke-AzRestMethod -Method POST -Path "/subscriptions/$subscriptionId/providers/Microsoft.KeyVault/locations/$($r.Location)/deletedManagedHSMs/$($r.Name)/purge?api-version=2021-04-01-preview" -ErrorAction Ignore
+                if ($response.StatusCode -ge 200 -and $response.StatusCode -lt 300) {
+                    Write-Warning "Successfully requested that Managed HSM '$($r.Name)' be purged, but may take a few minutes before it is actually purged."
+                } elseif ($response.Content) {
+                    $content = $response.Content | ConvertFrom-Json
+                    if ($content.error) {
+                        $err = $content.error
+                        Write-Warning "Failed to deleted Managed HSM '$($r.Name)': ($($err.code)) $($err.message)"
+                    }
+                }
+            }
+
+            default {
+                Write-Warning "Cannot purge resource type $($r.AzsdkResourceType). Add support to https://github.com/Azure/azure-sdk-tools/blob/main/eng/common/scripts/Helpers/Resource-Helpers.ps1."
+            }
+        }
+    }
+}
+
+# The Log function can be overridden by the sourcing script.
+function Log($Message) {
+    Write-Host ('{0} - {1}' -f [DateTime]::Now.ToLongTimeString(), $Message)
+}