您如何安全地检索存储帐户键？
我正在尝试在存储帐户中的容器上编程设置访问策略。理想情况下，我想使用托管身份来执行此操作，但是目前看来它不支持（请参阅在这里）。
因此，目前看来我需要使用存储帐户密钥，以便容器客户端可以创建访问策略。这使我进入了我问题的主要部分。将这些密钥存储在钥匙库中并使用托管身份将其检索或直接检索它们是最佳实践吗？将钥匙保留在这样的钥匙保险库中，如遗产尽管（或者也许只是那些特定的方法，因为Azure CLI也是遗产）。因此，看来这已经陷入了以某种方式的裂缝中，因为它在1处被称为遗产，但在另一个地方尚未得到支持。
如果我选择直接路线，那么最好的方法是什么？在这种情况下，我仍然可以使用托管身份吗？看在这里可以，因为它使用Azure Active Directory，这就是我相信背部托管身份的方法。
目前，我应该如何将访问策略设置为容器，这是令人困惑的，但是希望其他人遇到了这一需求，并且有一个很好的例子。
I'm trying to programmatically set access policies on containers within a storage account. Ideally I'd like to do this using Managed Identity but it looks like it's not support at the moment (see here).
So at present it looks like I need to use the storage account key so the container client can create access policies. This brings me to the main part of my question. Is it best practice to store these keys in key vault and retrieve them using the managed identity or retrieve them directly? Keeping keys in key vault like this is stated as legacy though (or perhaps it's just those specific methods as Azure CLI is legacy as well). So it looks like this has fallen through the cracks somehow in that in 1 place it's stated as legacy but in another it's not supported yet.
If I opt for the direct route, what is the best way to do this? Can I still use the managed identity in this case? Looking here it looks like I can, as it uses Azure Active Directory, which is what I believe backs managed identity.
At the moment it's very confusing how I should programmatically set access policies to a container, but hopefully someone else has come across this need and has got a good example.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如您在问题中提到的那样，存储帐户 - 列表密钥 是获取存储帐户访问键的方法。
是的，您肯定可以。请确保您的托管身份有权在存储帐户上执行列表键操作。
所有者和贡献者角色肯定具有该许可，但您也可以选择存储帐户贡献者或存储帐户关键操作员服务角色角色，如果您不想分配托管身份的更强大的角色，例如所有者或贡献者。As you mentioned in the question,
Storage Accounts - List Keysis the way to go for fetching access keys for a storage account.Yes, you most certainly can. Please ensure that your Managed Identity has permissions to perform List Keys operation on the storage account.
OwnerandContributorroles definitely have that permission but you can also opt forStorage Account ContributororStorage Account Key Operator Service Rolerole if you do not want to assign your Managed Identity more powerful roles likeOwnerorContributor.