key.yaml

name: Rotate Storage

on:
  workflow_dispatch:
  inputs:
      description: "Target Azure Environment to deploy to."
      required: true
      type: choice # This ensures you get a dropdown
      options: # Options must be provided for the 'choice' type
        - dev
        - staging
        - prod
          default: dev
      employee_Id:
        description: "8 Digit employee ID (required only for prod)"
        required: true
        default: "NA"


jobs:
  RotateStorageKeys:
    name: Rotate Storage Account Keys if older than 300 days
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Code
        uses: actions/checkout@v3

      - name: Azure CLI Login
        uses: azure/login@v1
        with:
          creds: ${{ secrets.AZURE_CREDENTIALS }}


      - name: Check Storage Account Keys Age and Rotate if necessary
        id: rotate_keys
        run: |
          # Set variables
          resource_group="${{secrets.AZURE_RESOURCE_GROUP}}"
          storage_account="${{secrets.AZURE_STORAGE_ACCOUNT}}"
          key_age_limit=30 # in days

          # Function to check and rotate a key if necessary
          check_and_rotate_key() {
              key_index=$1
              key_name=$2

              # Get the key creation date
              key_creation_date=$(az storage account keys list --resource-group $resource_group --account-name $storage_account --query "[$key_index].creationTime" --output tsv)

              # Convert creation date to a Unix timestamp
              key_creation_timestamp=$(date -d $key_creation_date +%s)

              # Get the current date as a Unix timestamp
              current_date=$(date +%s)

              # Calculate the difference in days
              age_in_days=$(( (current_date - key_creation_timestamp) / 86400 ))

              # Check if the key is older than the defined limit
              if [ $age_in_days -ge $key_age_limit ]; then
                  echo "$key_name is $age_in_days days old, triggering rotation."

                  # # Trigger key rotation
                  az storage account keys renew --resource-group $resource_group --account-name $storage_account --key $key_name
                  echo "$key_name rotated successfully."

                  # Set output variable to indicate key rotation
                  echo "::set-output name=KeyRotated::true"
              else
                  echo "$key_name is $age_in_days days old, no action required."
                  echo "::set-output name=KeyRotated::false"
              fi
          }

          # Check and rotate the primary key if necessary
          check_and_rotate_key 0 "primary"

          # Check and rotate the secondary key if necessary
          check_and_rotate_key 1 "secondary"