How to provide a SAS token to Azure CLI within PowerShell

4
votes

I'm using the Azure CLI 2.0 from PowerShell to manage a storage account. I have a SAS token (which I am storing in a variable) and I want to use it in a command. Here's the script I'm running:

$sasToken = 'st=2017-11-13T10%3A55%3A06Z&se=2017-11-13T11%3A27%3A06Z&sp=w&spr=https&sv=2017-04-17&sr=c&sig=%2BA6LDTwHes6JdxEAHXSvbYc70y30OcznjMVSyFbCXog%3D'

az storage blob upload `
    --account-name mystorageaccount `
    --container-name mycontainer `
    --file c:\temp\file.txt `
    --name file.txt `
    --sas-token $sasToken

When I run this, I get this error:

The specified resource does not exist.
'se' is not recognized as an internal or external command,
operable program or batch file.
'sp' is not recognized as an internal or external command,
operable program or batch file.
'spr' is not recognized as an internal or external command,
operable program or batch file.
'sv' is not recognized as an internal or external command,
operable program or batch file.
'sr' is not recognized as an internal or external command,
operable program or batch file.
'sig' is not recognized as an internal or external command,
operable program or batch file.

It appears to me that PowerShell is truncating the SAS token every time it sees an ampersand, and the Azure CLI isn't getting this as all part of the same string.

Is there a way to force PowerShell to call the Azure CLI with the SAS token exactly as-is?

2
powershellazure-cli

2 Answers

7
votes

Try wrapping the SAS token in a 2nd set of quotes:

$sasToken = '"st=2017-11-13T10%3A55%3A06Z&se=2017-11-13T11%3A27%3A06Z&sp=w&spr=https&sv=2017-04-17&sr=c&sig=%2BA6LDTwHes6JdxEAHXSvbYc70y30OcznjMVSyFbCXog%3D"'

so that the CLI command looks like this:

--sas-token "st=2017-11-13T10%3A55%3A06Z&se=2017-11-13T11%3A27%3A06Z&sp=w&spr=https&sv=2017-04-17&sr=c&sig=%2BA6LDTwHes6JdxEAHXSvbYc70y30OcznjMVSyFbCXog%3D"

1
votes

If you are getting the SAS key from the Azure CLI, do note that if you run it with "-o json" you will get as output the value of the SAS key in quotes. You can directly assign this to a variable and it can be used by the azure CLI without issues (at least, I could place it in an AKV secret)

This is the function I wrote to get that variable as part of my ps1 code:

function Get-SASToken {
    param (
        # Storage Account 
        [Parameter(Mandatory=$true)][alias("a")][string]$StorageAccount,
        # Storage Container name
        [Parameter(Mandatory=$true)][alias("c")][string]$StorageContainer,
        # Parameter help description
        [Parameter(Mandatory=$true)][alias("p")][string]$SAPolicy
    )
    echo (az storage container generate-sas --account-name $StorageAccount -n $StorageContainer --policy-name $SAPolicy -o json)

}