支持的加密：需要 Microsoft 安全开发生命周期 (SDL) 批准的加密算法（例如，rsa-sha2-256，ecdsa-sha2-nistp256）。
SFTP 配置：
在存储帐户上启用 SFTP。
创建具有适当权限的本地用户身份。
为用户配置主目录，以定义他们在容器内的起始位置。
权限
权限
符号
描述
读取
r
读取文件内容。
写入
w
上传文件和创建目录。
列出
l
列出目录的内容。
删除
d
删除文件或目录。
创建
c
创建文件或目录。
修改所有权
o
更改拥有用户或组。
修改权限
p
更改文件或目录上的 ACL。
枚举
# Get storage accountsazstorageaccountlist#Get the account name from here# BLOB STORAGE## List containersazstoragecontainerlist--account-name<name>## Check if public access is allowedazstoragecontainershow-permission \--account-name <acc-name> \-n <container-name>## Make a container publicazstoragecontainerset-permission \--public-access container \--account-name <acc-name> \-n <container-name>## List blobs in a containerazstoragebloblist \--container-name <containername> \--account-name <accountname>## Download blobazstorageblobdownload \--account-name <accountname> \--container-name <containername> \--name <blobname> \--file </path/to/local/file>## Create container policyazstoragecontainerpolicycreate \--account-name mystorageaccount \--container-name mycontainer \--name fullaccesspolicy \--permissions racwdl \--start 2023-11-22T00:00Z \--expiry 2024-11-22T00:00Z# QUEUEazstoragequeuelist--account-name<name>azstoragemessagepeek--account-name<name>--queue-name<queue-name># ACCESS KEYSazstorageaccountkeyslist--account-name<name>## Check key policies (expiration time?)azstorageaccountshow-n<name>--query"{KeyPolicy:keyPolicy}"## Once having the key, it's possible to use it with the argument --account-key## Enum blobs with account keyazstoragebloblist \--container-name <containername> \--account-name <accountname> \--account-key "ZrF40pkVKvWPUr[...]v7LZw=="## Download a file using an account keyazstorageblobdownload \--account-name <accountname> \--account-key "ZrF40pkVKvWPUr[...]v7LZw==" \--container-name <containername> \--name <blobname> \--file </path/to/local/file>## Upload a file using an account keyazstorageblobupload \--account-name <accountname> \--account-key "ZrF40pkVKvWPUr[...]v7LZw==" \--container-name <containername> \--file </path/to/local/file># SAS## List access policiesazstorage<container|queue|share|table> policylist \--account-name <accname> \--container-name <containername>## Generate SAS with all permissions using an access keyazstorage<container|queue|share|table|blob> generate-sas \--permissions acdefilmrtwxy \--expiry 2024-12-31T23:59:00Z \--account-name <acc-name> \-n <container-name>## Generate SAS with all permissions using via user delegationazstorage<container|queue|share|table|blob> generate-sas \--permissions acdefilmrtwxy \--expiry 2024-12-31T23:59:00Z \--account-name <acc-name> \--as-user --auth-modelogin \-n <container-name>## Generate account SASazstorageaccountgenerate-sas \--expiry 2024-12-31T23:59:00Z \--account-name <acc-name> \--services qt \--resource-types sco \--permissions acdfilrtuwxy## Use the returned SAS key with the param --sas-token## e.g.azstorageblobshow \--account-name <accountname> \--container-name <containername> \--sas-token 'se=2024-12-31T23%3A59%3A00Z&sp=racwdxyltfmei&sv=2022-11-02&sr=c&sig=ym%2Bu%2BQp5qqrPotIK5/rrm7EMMxZRwF/hMWLfK1VWy6E%3D' \--name 'asd.txt'#Local-Users## List usersazstorageaccountlocal-userlist \--account-name <storage-account-name> \--resource-group <resource-group-name>## Get userazstorageaccountlocal-usershow \--account-name <storage-account-name> \--resource-group <resource-group-name> \--name <local-user-name>## List keysazstorageaccountlocal-userlist \--account-name <storage-account-name> \--resource-group <resource-group-name>
# Get storage accountsGet-AzStorageAccount| fl# Get rules to access the storage accountGet-AzStorageAccount| select -ExpandProperty NetworkRuleSet# Get IPs(Get-AzStorageAccount| select -ExpandProperty NetworkRuleSet).IPRules# Get containers of a storage accountGet-AzStorageContainer-Context (Get-AzStorageAccount-name <NAME>-ResourceGroupName <NAME>).context# Get blobs inside containerGet-AzStorageBlob-Container epbackup-planetary -Context (Get-AzStorageAccount-name <name>-ResourceGroupName <name>).context# Get a blob from a containerGet-AzStorageBlobContent-Container <NAME>-Context (Get-AzStorageAccount-name <NAME>-ResourceGroupName <NAME>).context -Blob <blob_name>-Destination .\Desktop\filename.txt# Create a Container PolicyNew-AzStorageContainerStoredAccessPolicy`-Context (Get-AzStorageAccount-Name <NAME>-ResourceGroupName <NAME>).Context `-Container <container-name>`-Policy <policy-name>`-Permission racwdl `-StartTime (Get-Date"2023-11-22T00:00Z") `-ExpiryTime (Get-Date"2024-11-22T00:00Z")#Get Container policyGet-AzStorageContainerStoredAccessPolicy`-Context (Get-AzStorageAccount-Name <NAME>-ResourceGroupName <NAME>).Context `-Container "storageaccount1994container"# Queue ManagementGet-AzStorageQueue-Context (Get-AzStorageAccount-Name <NAME>-ResourceGroupName <NAME>).Context(Get-AzStorageQueue-Name <NAME>-Context (Get-AzStorageAccount-name <NAME>-ResourceGroupName <NAME>).Context).QueueClient.PeekMessage().Value#Blob ContainerGet-AzStorageBlob-Container <container-name>-Context $(Get-AzStorageAccount-name "teststorageaccount1998az"-ResourceGroupName "testStorageGroup").ContextGet-AzStorageBlobContent`-Container <container-name>`-Blob <blob-name>`-Destination <local-path>`-Context $(Get-AzStorageAccount-name "teststorageaccount1998az"-ResourceGroupName "testStorageGroup").ContextSet-AzStorageBlobContent`-Container <container-name>`-File <local-file-path>`-Blob <blob-name>`-Context $(Get-AzStorageAccount-name "teststorageaccount1998az"-ResourceGroupName "testStorageGroup").Context# Shared Access Signatures (SAS)Get-AzStorageContainerAcl`-Container <container-name>`-Context (Get-AzStorageAccount-Name <NAME>-ResourceGroupName <NAME>).ContextNew-AzStorageBlobSASToken`-Context $ctx `-Container <container-name>`-Blob <blob-name>`-Permission racwdl `-ExpiryTime (Get-Date"2024-12-31T23:59:00Z")
