Секреты и учётные данные

$secret=Read-Host "Secret" -AsSecureString
$valueType = if($null -eq $secret){'<null>'}else{$secret.GetType().FullName}
[pscustomobject]@{ Value=$secret; Type=$valueType; Count=@($secret).Count }

$blob=$secret|ConvertFrom-SecureString
Set-Content .\secret.txt $blob

$key=1..32
$blob=$secret|ConvertFrom-SecureString -Key $key

$cred=Get-Credential
$cred | Select-Object UserName,@{n="PasswordType";e={$_.Password.GetType().Name}}

$plain=$cred.GetNetworkCredential().Password
$valueType = if($null -eq $plain){'<null>'}else{$plain.GetType().FullName}
[pscustomobject]@{ Value=$plain; Type=$valueType; Count=@($plain).Count }

$result = Invoke-Command server1 { param($c) $c.UserName } -ArgumentList $cred
$resultType = if($null -eq $result){'<null>'}else{$result.GetType().FullName}
[pscustomobject]@{ Result=$result; Type=$resultType; Count=@($result).Count }

Register-SecretVault -Name Local -ModuleName Microsoft.PowerShell.SecretStore -DefaultVault
Get-Secret -Name ApiToken

$result = Get-SecretInfo | Select-Object Name,Type,VaultName
$shape = if($null -eq $result){'<null>'}elseif($result -is [array]){'array'}else{$result.GetType().Name}
[pscustomobject]@{ Shape=$shape; Values=@($result) }

$result = Set-SecretStoreConfiguration -Authentication None -Interaction None
$items = @($result)
[pscustomobject]@{ Count=$items.Count; First=$items | Select-Object -First 1; IsNull=($null -eq $result) }

$safe=$headers.Clone();$safe.Authorization="[REDACTED]";Write-Verbose ($safe|ConvertTo-Json -Compress)

$result = catch{Write-Error ("Operation failed: {0}" -f $_.FullyQualifiedErrorId)}
$items = @($result)
[pscustomobject]@{ Count=$items.Count; First=$items | Select-Object -First 1; IsNull=($null -eq $result) }

# Сценарий для ревью: Start-Transcript включён на сеансе с Get-Credential.
$context = [pscustomobject]@{ User=[Environment]::UserName; Host=$Host.Name; At=[datetimeoffset]::UtcNow }
$headers = @{ Authorization = "Bearer $env:API_TOKEN" }
Write-Information (ConvertTo-Json @{ Context=$context; Headers=$headers }) -InformationAction Continue
Invoke-RestMethod -Uri $uri -Headers $headers -ErrorAction Stop

$result = & { Get-SecretVault;Get-SecretStoreConfiguration }
$items = @($result)
[pscustomobject]@{ Count=$items.Count; First=$items | Select-Object -First 1; IsNull=($null -eq $result) }

# Сценарий для ревью: DPAPI blob не читается на новом сервере.
$context = [pscustomobject]@{ User=[Environment]::UserName; Host=$Host.Name; At=[datetimeoffset]::UtcNow }
$headers = @{ Authorization = "Bearer $env:API_TOKEN" }
Write-Information (ConvertTo-Json @{ Context=$context; Headers=$headers }) -InformationAction Continue
Invoke-RestMethod -Uri $uri -Headers $headers -ErrorAction Stop

# Сценарий для ревью: Секрет неожиданно попал в лог.
$context = [pscustomobject]@{ User=[Environment]::UserName; Host=$Host.Name; At=[datetimeoffset]::UtcNow }
$headers = @{ Authorization = "Bearer $env:API_TOKEN" }
Write-Information (ConvertTo-Json @{ Context=$context; Headers=$headers }) -InformationAction Continue
Invoke-RestMethod -Uri $uri -Headers $headers -ErrorAction Stop

# Сценарий для ревью: Секрет зашит в ps1 и удалён последующим коммитом.
$context = [pscustomobject]@{ User=[Environment]::UserName; Host=$Host.Name; At=[datetimeoffset]::UtcNow }
$headers = @{ Authorization = "Bearer $env:API_TOKEN" }
Write-Information (ConvertTo-Json @{ Context=$context; Headers=$headers }) -InformationAction Continue
Invoke-RestMethod -Uri $uri -Headers $headers -ErrorAction Stop

# Сценарий для ревью: Vault даёт сценарию доступ ко всем секретам команды.
$context = [pscustomobject]@{ User=[Environment]::UserName; Host=$Host.Name; At=[datetimeoffset]::UtcNow }
$headers = @{ Authorization = "Bearer $env:API_TOKEN" }
Write-Information (ConvertTo-Json @{ Context=$context; Headers=$headers }) -InformationAction Continue
Invoke-RestMethod -Uri $uri -Headers $headers -ErrorAction Stop

# Сценарий для ревью: Секрет передаётся через обычный параметр string.
$context = [pscustomobject]@{ User=[Environment]::UserName; Host=$Host.Name; At=[datetimeoffset]::UtcNow }
$headers = @{ Authorization = "Bearer $env:API_TOKEN" }
Write-Information (ConvertTo-Json @{ Context=$context; Headers=$headers }) -InformationAction Continue
Invoke-RestMethod -Uri $uri -Headers $headers -ErrorAction Stop