如何从交互式 PowerShell 会话调用 Azure REST API

Question

I want to be able to call Azure REST API methods from an interactive PowerShell session. There are instructions on how to do this with a Service Principal here but I want to be able to call these methods using my own credentials rather than switching to a different set. This will make it easier to work out the methods I need to call locally and also to gather information from Azure on an ad hoc basis.

An example of a call I'd like to make that can't be done with existing PowerShell cmdlets is

https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ApiManagement/service/{serviceName}/products/{productId}/policies/policy?api-version=2019-01-01

Answer 1

When you login to Azure with Login-AzureRmAccount or Login-AzAccount and then call an AzureRm or Az cmdlet a bearer token will be obtained by from Azure and stored in your context object. You can retrieve your context object with Get-AzureRmContext or Get-AzContext and parse the token from that object.

    $Context = Get-AzContext
    $Cache = $Context.TokenCache
    $CacheItems = $Cache.ReadItems()
    $Token = ($CacheItems | Where-Object { $_.Resource -eq "https://management.core.windows.net/" })

The token will last for an hour, if it expires you'll need to renew it by calling an Azure cmdlet again (though it may be possible to renew it programatically).

This code could be wrapped in a function like

function Invoke-AzureRestApi {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$true)]
        [String]$Uri
    )

    $Context = Get-AzContext
    $Cache = $Context.TokenCache
    $CacheItems = $Cache.ReadItems()
    $Token = ($CacheItems | Where-Object { $_.Resource -eq "https://management.core.windows.net/" })
    $Headers = @{Authorization = "Bearer $($Token.AccessToken)"}

    Invoke-RestMethod -Method GET -Uri $Uri -Headers $Headers

}

# run an Az or AzureRm cmdlet to get a token prior to calling the function
Invoke-AzureRestApi -Uri https://management.azure.com/subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/Microsoft.ApiManagement/service/{serviceName}/products/{productId}/policies/policy?api-version=2019-01-01

# A simpler example to test the function (though this particular example can be more easily achieved with Get-AzResourceGroup)
Invoke-AzureRestApi -Uri https://management.azure.com/subscriptions/{subscriptionId}/resourcegroups?api-version=2019-08-01

UPDATE (31/8/2021): the token can now be retrieved simply using the Get-AzAccessToken cmdlet

function Invoke-AzureRestApi {
    [CmdletBinding()]
    param(
        [Parameter(Mandatory=$true)]
        [String]$Uri
    )
    
    $Token = Get-AzAccessToken
    $Headers = @{Authorization = "Bearer $($Token.Token)"}
    Invoke-RestMethod -Method GET -Uri $Uri -Headers $Headers
}

Answer 2

you could just use Get-AzResource to achieve the same outcome, without the headache of dealing with tokens.

Your particular example call doesnt make a lot of sense, it can be replaced with Get-AzResourceGroup