在 PowerShell 脚本中加密 Azure 存储帐户密钥

Question

I'm developing a new powershell script in order to download any blobs from a specific container and the problem is due to security reasons because I do not want to paste in text plain the azure account key. So I have implemented a solution using 'ConvertTo-SecureString' command but the problem still exists because when I create a connection string to the blob, there appears a message who said: "Server Failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. HTTP Status Code 403 - HTTP Error".

With the key in plain text I'm able to create the connection string properly and then list and download all blobs from the container. I tried other solutions for example ' $Credential= New-Object System.Management.Automation.PSCredential ('$ShareUser, $SharePassword)' but there is other problem related with the input is not valid base64 string.

Do you know how to avoid this issues and create a secure connection string with an Azure Storage Account?

Best regards and thanks in advance

Here a part of my powershell script

$SecurePassword= Read-Host -AsSecureString | ConvertFrom-SecureString
$SecurePassword | Out-File -FilePath C:\test_blob\pass_file.xml

$ConfigFile= 'C:\Users\\config_file.xml'

IF (Test-Path) { 

[xml]$Config= Get-Content $ConfigFile 

[string] $Server = $Config.Config.Server;
[string] $SharePassword = $Config.Config.SharePassword;

 } ELSE
{
write-host "File do not exists: $ConfigFile"

}


 #BlobStorageInformation   

$StorageAccountName='test_acc'
$Container='test'
$DestinationFolder= 'C:\Users\user1\Blobs'


$Context = New-AzStorageConext -StorageAccountName $StorageAccountName -StorageAccountKey $SharePassword

#List of Blobs 

$ListBlob=@()
$ListBlob+= Get-AzStorageBlob -context $Context -container $Container | Where-Object {$_.LastModified -lt (Get-Date).AddDAys(-1)}

Answer 1

Why would you maintain the password files or enter storage key manually when you have az powershell. Just login using az powershell, set the subscription and enjoy !

$ResourceGroupName = "YOURRESOURCEGROUPNAME"
$StorageAccountName = "YOURSTORAGEACCOUNTNAME"
$ContainerName = "YOURCONTAINERNAME"
$LocalPath = "D:\Temp"
        
Write-Output 'Downloading Content from Azure blob to local...'
$storageKey = (Get-AzStorageAccountKey -ResourceGroupName $ResourceGroupName -AccountName $StorageAccountName).value[0]
$storageContext = New-AzStorageContext -StorageAccountName $StorageAccountName -StorageAccountKey $storageKey
$blobs = Get-AzStorageBlob -Container $ContainerName -Context $storageContext
foreach($blob in $blobs)
{
        Get-AzStorageBlobContent -Container $ContainerName -Context $storageContext -Force -Destination $LocalPath -Blob $blob.Name
}
Write-Output 'Content Downloaded Successfully !!!'