使用Data Factory v2访问Key Vault托管存储帐户 [英] Accessing a Key Vault Managed Storage Account with Data Factory v2

问题描述

您好，我正在尝试创建到KV托管存储帐户的DF v2链接服务，并且密钥刷新存在问题. KV托管存储帐户似乎既不提供其密钥，也不提供SAS URI.它只是 自行制作SAS令牌.

由于我不确定何时刷新密钥，因此我不知道是否可以使用自动化来更新KV中的SAS URI机密.是唯一的选项来删除自动密钥刷新并使用自定义自动化来处理吗?

任何帮助都会很棒，

Hello, I am attempting to create a DF v2 Linked Service to a KV Managed Storage Account and I am having issues with the key refreshes. It seems that the KV Managed Storage Account doesn't make its keys available nor does it make a SAS URI available. It only makes the SAS token itself. 

As I am not sure when the key refreshes occur, I don't know if I can use automation to update a SAS URI secret in the KV. Is the only option to remove automatic key refreshes and handle that on using custom automation?

Any help would be great,

谢谢.

推荐答案

你好，

您可以按照以下说明指定自动刷新密钥的频率:

You can specify how often automatic key refreshing happens as outlined here:

https://docs.microsoft.com/zh-cn/azure/key-vault/key-vault-ovw-storage-keys#key-regeneration

https://docs.microsoft.com/en-us/azure/key-vault/key-vault-ovw-storage-keys#key-regeneration

我认为您仅在KV中提供了令牌，这是正确的，因此，如果您尝试使用SAS URI访问存储帐户中的特定容器，则需要提供刷新的SAS令牌.  

I think you are correct in saying only the token is made available in KV, so if you are trying to access a particular container in your storage account with the a SAS URI, you need to supply the refreshed SAS token.  

就目前的情况而言，我看不到一种使用KV中的自动刷新SAS令牌创建链接服务的方法.看来ADF链接服务只能使用KV中的存储帐户密钥，而不能使用KV中的SAS URI.

As it stands today I do not see a way to create a linked service with an automatically refreshing SAS token from KV.  It appears ADF linked services can only use Storage Account keys from KV, and not SAS URIs from KV.

如果在您的特定情况下有意义，您可以简单地自动旋转存储帐户密钥并在ADF中创建链接服务，以将KV与存储帐户密钥(而不是SAS)一起使用.

If it makes sense in your particular scenario, you could simply automatically rotate the Storage Account keys and create a linked service in ADF to use KV with the Storage Account keys and not SAS.

除了Azure文档，我发现本文对实现自动存储帐户密钥轮换很有帮助:

In addition to Azure documentation, I found this article helpful in implementing automatic Storage Account key rotation:

http://www.wahidsaleemi.com/2017/08/azure-storage-account-keys-automatic-rotation/

http://www.wahidsaleemi.com/2017/08/azure-storage-account-keys-automatic-rotation/

这篇关于使用Data Factory v2访问Key Vault托管存储帐户的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持IT屋！