PowerShell script to manage Azure VMs during maintenance events. The script processes webhook data to determine the maintenance event type and manages Azure VMs accordingly by stopping services in 'pre' mode and starting them in 'post' mode.

Invoke-AzMaintenance.ps1

<#
    .SYNOPSIS
    This script manages Azure VMs during maintenance events by stopping and starting services based on the specified mode.

    .DESCRIPTION
    The script processes webhook data to determine the maintenance event type and manages Azure VMs accordingly. It stops services in 'pre' mode and starts them in 'post' mode.

    .PARAMETER ScriptMode
    Specifies the mode of the script. Valid values are 'Pre' and 'Post'.

    .PARAMETER WebhookData
    The data received from the webhook, containing details about the maintenance event.

    .NOTES
    Author: Blake Drumm ([email protected])
    Creation Date: August 14th, 2024
#>
param
(
	[Parameter(Mandatory = $true)]
	[ValidateSet('Pre', 'Post')]
	[string]$ScriptMode,
	[Parameter(Mandatory = $true)]
	[object]$WebhookData
)


# Validate ScriptMode
if ($ScriptMode -notin ('pre', 'post'))
{
	Throw 'ScriptMode parameter incorrect. Must be pre or post'
	exit
}

Write-Output "Ensuring that the runbook does not inherit an AzContext..."
Disable-AzContextAutosave -Scope Process

Write-Output "Connecting to Azure with System Managed Identity..."
Connect-AzAccount -Identity

# Process Webhook Data
$notificationPayload = ConvertFrom-Json -InputObject $WebhookData.RequestBody
$eventType = $notificationPayload[0].eventType

if ($eventType -ne "Microsoft.Maintenance.PreMaintenanceEvent")
{
	Write-Output "Webhook not triggered as part of pre-patching for maintenance run"
	return
}

$maintenanceRunId = $notificationPayload[0].data.CorrelationId
$resourceSubscriptionIds = $notificationPayload[0].data.ResourceSubscriptionIds

if ($resourceSubscriptionIds.Count -eq 0)
{
	Write-Output "Resource subscriptions are not present."
	return
}

Write-Output "Querying ARG to get machine details [MaintenanceRunId=$maintenanceRunId][ResourceSubscriptionIdsCount=$($resourceSubscriptionIds.Count)]"

$argQuery = @"
    maintenanceresources  
    | where type =~ 'microsoft.maintenance/applyupdates' 
    | where properties.correlationId =~ '$($maintenanceRunId)' 
    | where id has '/providers/microsoft.compute/virtualmachines/' 
    | project id, resourceId = tostring(properties.resourceId) 
    | order by id asc 
"@

$allMachines = [System.Collections.ArrayList]@()
$skipToken = $null

do
{
	$res = Search-AzGraph -Query $argQuery -First 1000 -SkipToken $skipToken -Subscription $resourceSubscriptionIds
	$skipToken = $res.SkipToken
	$allMachines.AddRange($res.Data)
}
while ($skipToken -ne $null -and $skipToken.Length -ne 0)

if ($allMachines.Count -eq 0)
{
	Write-Output "No Machines were found."
	return
}

# Define pre- and post-scripts as script blocks
$preScriptBlock = {
	# Stop the Printer service
	$serviceName = 'Spooler'
	try
	{
		Write-Output "Stopping service $serviceName..."
		Stop-Service -Name $serviceName -Verbose -Force -ErrorAction Stop
		Write-Output "$(Get-Service -Name $serviceName)"
	}
	catch
	{
		Write-Output "Error stopping $serviceName. $($_)"
		throw "Error stopping $serviceName. $($_)"
	}
}

$postScriptBlock = {
	# Start the Printer service
	$serviceName = 'Spooler'
	try
	{
		Write-Output "Starting service $serviceName..."
		Start-Service -Name $serviceName -Verbose -ErrorAction Stop
		Write-Output "$(Get-Service -Name $serviceName)"
	}
	catch
	{
		Write-Output "Error starting $serviceName. $($_)"
		throw "Error starting $serviceName. $($_)"
	}
}

# Convert the script block into a string explicitly
$preScriptString = [scriptblock]::create($preScriptBlock)
$postScriptString = [scriptblock]::create($postScriptBlock)

# Manage jobs for each VM
$azVMJobs = @()
$allMachines | ForEach-Object {
	$vmResourceId = $_.resourceId
	$vmResourceIdSplit = $vmResourceId -split "/"
	$subscriptionId = $vmResourceIdSplit[2]
	$rg = $vmResourceIdSplit[4]
	$name = $vmResourceIdSplit[8]
	
	Write-Output "Setting context for Subscription Id: $subscriptionId"
	Set-AzContext -Subscription $subscriptionId
	
	Write-Output "Invoking command on '$($name)' ..."
	if ($ScriptMode -eq 'pre')
	{
		$azVMJobs += Invoke-AzVMRunCommand -ResourceGroupName $rg -Name $name -CommandId 'RunPowerShellScript' -ScriptString $preScriptString -AsJob
	}
	elseif ($ScriptMode -eq 'post')
	{
		$azVMJobs += Invoke-AzVMRunCommand -ResourceGroupName $rg -Name $name -CommandId 'RunPowerShellScript' -ScriptString $postScriptString -AsJob
	}
}

# Wait for jobs to complete and check results
$jobTimeoutTime = (Get-Date).AddSeconds(120)
while ((Get-Date) -le $jobTimeoutTime)
{
	Start-Sleep -Seconds 1
}

foreach ($patchJob in $azVMJobs)
{
	Write-Output "Checking job results for VM: $($patchJob.Id)"
	$jobStatus = Get-Job -Id $patchJob.Id
	
	if (!$jobStatus.HasMoreData -or $jobStatus.State -eq 'Failed')
	{
		Write-Output "Job Id ($($patchJob.Id)) Failed"
		
		# If the pre-script fails, cancel the maintenance
		if ($ScriptMode -eq 'pre')
		{
			Write-Output "Pre-script failed, canceling the maintenance with Correlation ID: $maintenanceRunId"
			Invoke-AzRestMethod `
								-Path "$($maintenanceRunId)?api-version=2023-09-01-preview" `
								-Payload '{"properties":{"status":"Cancel"}}' `
								-Method PUT
			return
		}
	}
	else
	{
		Write-Output "Job Id ($($patchJob.Id)) succeeded"
	}
	$patchJob | Stop-Job -PassThru | Remove-Job -Force
}

# Wait if pre-script mode was executed successfully
if ($ScriptMode -eq 'pre')
{
	# 10 minutes = 600 seconds
	$waitTimeInSeconds = 600
	Write-Output "Waiting $waitTimeInSeconds seconds for connections to drain."
	Start-Sleep -Seconds $waitTimeInSeconds
	Write-Output "Wait time complete."
}

catch
{
	Write-Error "$($_.Exception.Message)"
	Write-Error "Error trace: $($_.ScriptStackTrace)"
	throw
}
<#
    Copyright (c) Microsoft Corporation. MIT License
    
    Permission is hereby granted, free of charge, to any person obtaining a copy
    of this software and associated documentation files (the "Software"), to deal
    in the Software without restriction, including without limitation the rights
    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
    copies of the Software, and to permit persons to whom the Software is
    furnished to do so, subject to the following conditions:
    
    The above copyright notice and this permission notice shall be included in all
    copies or substantial portions of the Software.
    
    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
    WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
    CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
#>