How do I get createdTime for all resources using Get-AzResource?

[shueybubbles]

With Azure CLI, I can do this:

az rest --method GET --url "https://management.azure.com/subscriptions/<subid>/resources" --url-parameters "@params.txt"

where params.txt has this:

{'api-version':'2020-06-01', '$expand':'createdTime'}

However, that just gives back a single object and working with it in powershell is not particularly easy.
I've tried using Get-AzResource -expandProperties but there's no timestamp property on the returned objects, even if I pass the result through ConvertTo-Json the CreatedTime value is null on all objects.

To reframe the discussion - my goal is to write a script that identifies Azure resources created in a subscription that were created in the last 7 days and more than 12 hours old. For each resource I want to know who created it and when. Unfortunately it seems that metadata availability varies wildly based on the resource type. Is there some known way to achieve this goal?

[dingmeng-xue]

The equivalent cmdlet of az rest in Azure PowerShell is Invoke-AzRestMethod. Below script can reach the same goal.

Invoke-AzRestMethod 'https://management.azure.com/subscriptions/{}/resources?api-version=2020-06-01&expand=createdTime'

Get-AzResource cmdlet puts all expand properties into properties bag. So, you can get it via below script.

(Get-AzResource -Name eventhub-test-0721 -ExpandProperties).Properties.createdAt

[shueybubbles]

Get-AzResource does not returned createdAt for every resource.
I can only get the createdTime for an AKV with az rest

eg:

invoke-AzRestMethod 'https://management.azure.com/subscriptions/subid/resources?api-version=2020-06-01&$expand=createdTime'

Has this in the output:

        {
            "id": "/subscriptions/subid/resourceGroups/SqlToolsSecretStore_RG/providers/Microsoft.KeyVault/vaults/SqlToolsSecretStore",
            "name": "SqlToolsSecretStore",
            "type": "Microsoft.KeyVault/vaults",
            "location": "westus2",
            "createdTime": "2017-09-28T20:17:17.0477763Z",
            "tags": {  }
        },

But Get-AzResource has this:

$r = Get-AzResource -Name SqlToolsSecretStore -ExpandProperties
$r.Properties

sku                          : @{family=A; name=standard}
tenantId                     : 72f988bf-86f1-41af-91ab-2d7cd011db47
accessPolicies               : {@{tenantId=72f988bf-86f1-41af-91ab-2d7cd011db47; objectId=xxx permissions=},
                               @{tenantId=72f988bf-86f1-41af-91ab-2d7cd011db47; objectId=xxx; permissions=},
                               @{tenantId=72f988bf-86f1-41af-91ab-2d7cd011db47; objectId=xxx; permissions=},
                               @{tenantId=72f988bf-86f1-41af-91ab-2d7cd011db47; objectId=xxx; permissions=}…}
enabledForDeployment         : True
enabledForDiskEncryption     : False
enabledForTemplateDeployment : False
enableSoftDelete             : True
softDeleteRetentionInDays    : 90
enableRbacAuthorization      : False
enablePurgeProtection        : True
vaultUri                     : https://xxxx.vault.azure.net/
provisioningState            : Succeeded
publicNetworkAccess          : Enabled

[dingmeng-xue]

We can reproduce this issue as well and are asking service team.

[dingmeng-xue]

answer from Keyvault team

System metadata was a feature that was added more recently in ARM. The data is not backfilled. Given that newer vaults will have the data and older ones not.

[shueybubbles]

thx

[shueybubbles]

@dingmeng-xue is there any way to get the id of the user who created a resource?

[dingmeng-xue]

Ugly but works. However, the problem is some resource providers don't support system metadata. If odata $expand is required, you need to append it when constructing $path. I didn't dig into it.

It shows 2 areas for improvement.

1. The schema of return of Get-AzResource doesn't support createdBy or other system meta data. If it is adopted widely, those properties should be added.
2. It's sweet that Invoke-AzRestMethod can make ApiVersion optional because resource provider and type can be resolved from -Path or -ResourceProviderName and -ResourceType. The cache of mapping between API version and type should be considered because it will bring better performance and be reused by Get-AzResource (If my memory is correct, it resolves API version when fetching specific resource)

$ret = @()
$resources = Get-AzResource -ResourceGroupName dixue-petclinic 
foreach ($rec in $resources) {
  $type = $rec.Type -split "/"
  $apiVersion = ((Get-AzResourceProvider -ProviderNamespace $type[0]).ResourceTypes | Where-Object ResourceTypeName -eq $type[1]).ApiVersions | Sort-Object -Descending | Select-Object -First 1
  $path = $rec.Id+"?api-version="+$apiVersion
  $response = (Invoke-AzRestMethod -Path $path).Content | ConvertFrom-Json
  $ret += @{
     id = $rec.Id
     createdBy=$response.systemData.createdBy
  }
}
$ret

[shueybubbles]

thx, I will try to incorporate this!
It feels like "Who created this expensive/insecure resource and when?" is one of the most basic questions anyone managing Azure resources would ask. Activity logs are not easy to search either and they may not be retained long enough.

[dingmeng-xue]

It's important feature. ARM provides guideline. However for the time being, it can be implemented on RP side because of no mechanism to sync provisioning state except client queries result through ARM.