Mask password in JSON to be imported by PowerShell - json

Question

I'm importing values from JSON to PowerShell to use it as a connection string to SQL.
Here is the current JSON file I've:
{
"Databases": [{
"InstanceName": "test-01\\ins01",
"DatabaseName": "test_logs",
"User": "dba",
"Password": "P#ssw0rd"
}
]
}
Since one of these values is a password. I'd like to know how can I mask the password in the JSON file in the meantime stay able to retrieve it in PowerShell?

Answer 1

As that was being said before, you will have to use the ConvertFrom-SecureString & ConvertTo-SecureString powershell cmdlets.
Around this, there is 2 methods:
First idea, as explained on this blog, is to directly store the secured password to your Json file, like this:
$secure = ConvertTo-SecureString -String 'P#$$w0rd' -AsPlainText -Force
$cred = New-Object -typename PSCredential -ArgumentList #('company\admin',$secure)
$cred | Select Username,#{Name="Password";Expression = { $_.password | ConvertFrom-SecureString }} | Convertto-Json
And then convert the secured password back from your JSON file:
$file = Get-Content -Path c:\temp\admin.json | ConvertFrom-Json
$secure = ConvertTo-SecureString $file.Password -ErrorAction Stop
But you will be abble to uncrypt the SecureString only on the same computer.
So the 2nd method is to use the ConvertTo-SecureString and specify an AES file, as it's well explained on this other blog.
So, basically you create the AES file:
$KeyFile = "C:\AES.key"
$Key = New-Object Byte[] 16 # You can use 16, 24, or 32 for AES
[Security.Cryptography.RNGCryptoServiceProvider]::Create().GetBytes($Key)
$Key | out-file $KeyFile
And you store the secured password in your json, like above but with the -Key option:
$cred | Select Username,#{Name="Password";Expression = { $_.password | ConvertFrom-SecureString }} -key $Key | Convertto-Json
And the same way to revert back the secured password:
$secure = ConvertTo-SecureString $file.Password -Key $key -ErrorAction Stop
Hope this help.