Skip to content

Azure Storage Setup using CLI

Jump to bottom
Franknaw edited this page Aug 24, 2021 · 18 revisions

Azure Storage Setup using CLI

Todo: Provide screenshots of corresponding Azure consoles.

Install Azure CLI CentOS 8

sudo sh -c 'echo -e "[azure-cli]
name=Azure CLI
baseurl=https://packages.microsoft.com/yumrepos/azure-cli
enabled=1
gpgcheck=1
gpgkey=https://packages.microsoft.com/keys/microsoft.asc" > /etc/yum.repos.d/azure-cli.repo'
  • sudo yum install azure-cli
  • az login --use-device-code

Create Group - to be used for storage account

[tnaw@sublevel ~]$ az group create --name migration --location "East US"
{
  "id": "/subscriptions/b0f019f4-10cd-4344-a744-db53ca2b95e9/resourceGroups/migration",
  "location": "eastus",
  "managedBy": null,
  "name": "migration",
  "properties": {
    "provisioningState": "Succeeded"
  },
  "tags": null,
  "type": "Microsoft.Resources/resourceGroups"
}

Create Storage Account

az storage account create \
    --name vhdsuploads \
    --resource-group migration \
    --location "East US" \
    --sku Standard_LRS \
    --encryption-services blob \
    --allow-blob-public-access false \
    --access-tier cool

Results:
{
  "accessTier": "Hot",
  "allowBlobPublicAccess": null,
  "allowCrossTenantReplication": null,
  "allowSharedKeyAccess": null,
  "azureFilesIdentityBasedAuthentication": null,
  "blobRestoreStatus": null,
  "creationTime": "2021-07-29T16:37:38.938008+00:00",
  "customDomain": null,
  "enableHttpsTrafficOnly": true,
  "enableNfsV3": null,
  "encryption": {
    "encryptionIdentity": null,
    "keySource": "Microsoft.Storage",
    "keyVaultProperties": null,
    "requireInfrastructureEncryption": null,
    "services": {
      "blob": {
        "enabled": true,
        "keyType": "Account",
        "lastEnabledTime": "2021-07-29T16:37:39.094225+00:00"
      },
      "file": {
        "enabled": true,
        "keyType": "Account",
        "lastEnabledTime": "2021-07-29T16:37:39.094225+00:00"
      },
      "queue": null,
      "table": null
    }
  },
  "extendedLocation": null,
  "failoverInProgress": null,
  "geoReplicationStats": null,
  "id": "/subscriptions/b0f019f4-10cd-4344-a744-db53ca2b95e9/resourceGroups/migration/providers/Microsoft.Storage/storageAccounts/vhdsuploads",
  "identity": null,
  "isHnsEnabled": null,
  "keyCreationTime": {
    "key1": "2021-07-29T16:37:39.094225+00:00",
    "key2": "2021-07-29T16:37:39.094225+00:00"
  },
  "keyPolicy": null,
  "kind": "StorageV2",
  "largeFileSharesState": null,
  "lastGeoFailoverTime": null,
  "location": "eastus",
  "minimumTlsVersion": null,
  "name": "vhdsuploads",
  "networkRuleSet": {
    "bypass": "AzureServices",
    "defaultAction": "Allow",
    "ipRules": [],
    "resourceAccessRules": null,
    "virtualNetworkRules": []
  },
  "primaryEndpoints": {
    "blob": "https://vhdsuploads.blob.core.windows.net/",
    "dfs": "https://vhdsuploads.dfs.core.windows.net/",
    "file": "https://vhdsuploads.file.core.windows.net/",
    "internetEndpoints": null,
    "microsoftEndpoints": null,
    "queue": "https://vhdsuploads.queue.core.windows.net/",
    "table": "https://vhdsuploads.table.core.windows.net/",
    "web": "https://vhdsuploads.z13.web.core.windows.net/"
  },
  "primaryLocation": "eastus",
  "privateEndpointConnections": [],
  "provisioningState": "Succeeded",
  "resourceGroup": "migration",
  "routingPreference": null,
  "sasPolicy": null,
  "secondaryEndpoints": null,
  "secondaryLocation": null,
  "sku": {
    "name": "Standard_ZRS",
    "tier": "Standard"
  },
  "statusOfPrimary": "available",
  "statusOfSecondary": null,
  "tags": {},
  "type": "Microsoft.Storage/storageAccounts"
}

Create Role Assignment

az ad signed-in-user show --query objectId -o tsv | az role assignment create \
    --role "Storage Blob Data Contributor" \
    --assignee @- \
    --scope "/subscriptions/b0f019f4-10cd-4344-a744-db53ca2b95e9/resourceGroups/migration/providers/Microsoft.Storage/storageAccounts/vhdsuploads"

Results:
{
  "canDelegate": null,
  "condition": null,
  "conditionVersion": null,
  "description": null,
  "id": "/subscriptions/b0f019f4-10cd-4344-a744-db53ca2b95e9/resourceGroups/migration/providers/Microsoft.Storage/storageAccounts/vhdsuploads/providers/Microsoft.Authorization/roleAssignments/29ed7da1-fc46-4cf0-8f1e-bf76fa27374c",
  "name": "29ed7da1-fc46-4cf0-8f1e-bf76fa27374c",
  "principalId": "80cfa147-43c9-40d3-b1eb-be1641938506",
  "principalType": "User",
  "resourceGroup": "migration",
  "roleDefinitionId": "/subscriptions/b0f019f4-10cd-4344-a744-db53ca2b95e9/providers/Microsoft.Authorization/roleDefinitions/ba92f5b4-2d11-453d-a403-e96b0029c9fe",
  "scope": "/subscriptions/b0f019f4-10cd-4344-a744-db53ca2b95e9/resourceGroups/migration/providers/Microsoft.Storage/storageAccounts/vhdsuploads",
  "type": "Microsoft.Authorization/roleAssignments"
}

Create Storage Container

az storage container create \
    --account-name vhdsuploads \
    --name vhd \
    --auth-mode login \
    --public-access off

Upload Test File

az storage blob upload \
    --account-name vhdsuploads \
    --container-name vhd \
    --name test \
    --file vhd-test.txt \
    --auth-mode login

Results:
Finished[#############################################################]  100.0000%
{
  "etag": "\"0x8D952BA8D000066\"",
  "lastModified": "2021-07-29T17:59:03+00:00"
}

List Blob Container

az storage blob list \
    --account-name vhdsuploads \
    --container-name vhd \
    --output table \
    --auth-mode login

Results:
Name    Blob Type    Blob Tier    Length    Content Type    Last Modified              Snapshot
------  -----------  -----------  --------  --------------  -------------------------  ----------
test    BlockBlob    Cool         15        text/plain      2021-07-29T17:59:03+00:00

Download all blobs

az storage blob download-batch -d . -s vhd --pattern ARW* --account-name vhdsuploads --auth-mode login

Authorize Blob Container with a SAS (Shared Access Signature) Token

SAS is a secure way to grant limited access to the resources in your storage account to the external world (clients, apps), without compromising your account keys

  • From the container settings select "Shared Access Tokens"
    • From the "Shared Access Tokens" console select
      • Signing method: "Account Key"
      • Permissions: "read, write, list"
      • Set start and expiry date
      • Click "Generate SAS token and URL"
      • Copy and use the "Blob SAS Token" via CLI
az storage blob upload `
    --account-name vhdsuploads `
    --container-name vhd `
    --name "Name to give File upload" `
    --file "The actual file" `
    --sas-token "<token>"

Results:
Finished[#############################################################]  100.0000%
{
  "etag": "\"0x8D95838995D3718\"",
  "lastModified": "2021-08-05T17:43:56+00:00"
}

Revoke SAS Token

az storage account revoke-delegation-keys \
    --name vhdsuploads \
    --resource-group migration

az storage account revoke-delegation-keys `
    --name vhdsuploads `
    --resource-group migration

Check permissions

 az storage account show -n vhdsuploads --query networkRuleSet
{
  "bypass": "AzureServices",
  "defaultAction": "Allow",
  "ipRules": [],
  "resourceAccessRules": [],
  "virtualNetworkRules": []
}

Clone this wiki locally