Question on Azure Blob Storage Upload for azcopy 7.3

Staley, Jonathan 1

Hello,

I have a server that is required to be FIPS compliant. When this server was enabled for FIPS compliance the cron job for azcopy script is no longing uploading files to blob storage. I attempted to update to azcopy v10, but it didn't like the way the current script is written and spit out a error for --source syntax. Is there an easy way to keep the server fips compliant and allow azcopy to just sent the files to blob?

Rafael da Rocha 5,171 Reputation points

2022-10-12T17:47:46.843+00:00

What's the error message? That might point to the problem or what needs to be changed on the script.
Staley, Jonathan 1 Reputation point

2022-10-12T17:55:37.92+00:00

well the error was that 7.3 script was that it utilized --source and v10 doesn't. However I'm not a script guy and not super familiar with the azure/blob storage. So writing a script would take more time then I have, if that makes sense.
SaiKishor-MSFT 17,321 Reputation points

2022-10-12T19:04:12.387+00:00

@Staley, Jonathan Would you be able to share the error message in both cases? https://learn.microsoft.com/en-us/answers/questions/1045386/index.html
Staley, Jonathan 1 Reputation point

2022-10-12T21:52:27.773+00:00

Sadly I cannot provide documentation. However, I ran the azcopy command in verbose so that I can get more detailed information and this is my error:

error:060800A3:digital envelope routines:EVP_digestInit_ex:disabled for fips
Staley, Jonathan 1 Reputation point

2022-10-13T15:29:04.55+00:00

Sadly I cannot provide documentation. However, I ran the azcopy command in verbose so that I can get more detailed information and this is my error:

error:060800A3:digital envelope routines:EVP_digestInit_ex:disabled for fips
SaiKishor-MSFT 17,321 Reputation points

2022-10-13T18:21:00.463+00:00

@Staley, Jonathan I jus received an update from our internal team that AZcopy v7 is not supported. Please use the higher version and share the error details here so we can find out what is causing this issue with it.

For Upgrade, please refer this- https://github.com/Azure/azure-storage-azcopy/blob/main/MigrationGuideV8toV10.md

Thank you!
Staley, Jonathan 1 Reputation point

2022-10-13T20:17:45.233+00:00

Alright. So I update to the newest version. Got it set up in /usr/bin. Edited the script with the link you sent me. However when I use the old --dest-key value for the key to add at the end of the url and then a question mark (i.e. https://azure.blob.blah.blah/test?<key> it gives the following.

copy command failed due to error. no cached token found. please log in with azcopy login command. However this server is command line only. Why is this key not working like it did with v7?
SaiKishor-MSFT 17,321 Reputation points

2022-10-17T10:36:48.143+00:00

Can you share the exact command used here?
Staley, Jonathan 1 Reputation point

2022-10-17T13:20:34.32+00:00

I commented out the key id, and access key (which doesn't show below). Not sure if that is the same as the old destination key in previous version 7.

LOCALSTORAGEDAYS=4
ROTATEDATE=$(date --date=:-$LOCALSTORAGEDAYS days" +%F)
SOURCE=<removed>
DESTURL=<removed>

AWS_ACCESS_KEY_ID=<removed>

AWS_SECRET_ACCESS_KEY=<removed>

azcopy copy $SOURCE $DESTURL --recursive --verbose
SaiKishor-MSFT 17,321 Reputation points

2022-10-17T19:01:11.75+00:00

@Staley, Jonathan Sorry I am still not sure here. What kind of authentication are you using for Azure? When you mean access key, I think you mean that for AWS right?

Here is an example command for uploading a single blob using SAS Token- azcopy cp "/path/to/file.txt" "https://[account].blob.core.windows.net/[container]/[path/to/blob]?[SAS]"
Staley, Jonathan 1 Reputation point

2022-10-17T19:42:26.527+00:00

Yes I believe so. In my azcopy version 7 script it calls it the --source-key. I don't have access to the azure side at the moment but I'm working on that. From my understanding it is a SAS token, I know for sure that once it was generated it has never expired, so it has been the same key for awhile now. Once I have access to azure dashboard how do I access to find or locate this specific key to see if it is a SAS key?

Also yes I mean AWS, I apologize. I am not using Azure for authentication. Just this key.
Staley, Jonathan 1 Reputation point

2022-10-19T14:52:07.707+00:00

I do have an additional question that I am confused about. I have written the script as described below, utilizing the azcopy copy $Source $Destination(?)key. However I am still getting errors. I was curious if someone could explain the difference between the keys? I have read a few articles online but still not quite understanding.

The previous script utilized "access key" that within the dashboard was listed as "key 2". However when I utilize that key for the blob upload I get an error saying "

no cached token found. Please log in with azcopy login command, required key not available."

Does this mean I need to generate a SAS key, and upon generating this what does this do in the background, if anything? Once I generate this key is it as simple as replacing the key in the following command azcopy copy $Source $Destination(?)key

1 answer

SaiKishor-MSFT 17,321 Reputation points

2022-10-17T20:13:38.003+00:00

@Staley, Jonathan Here is how to find the Account SAS key for your Azure Storage Account-

To find the SAS key for the individual Container/Blob, here is how to get it-

Here are details regarding the types of SAS and how to delegate access using SAS- https://learn.microsoft.com/en-us/rest/api/storageservices/delegate-access-with-shared-access-signature

Hope this helps. Please let us know if you have any more questions and we will be glad to assist you further. Thank you!

Remember:

Please accept an answer if correct. Original posters help the community find answers faster by identifying the correct answer. Here is how.

Want a reminder to come back and check responses? Here is how to subscribe to a notification.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Question on Azure Blob Storage Upload for azcopy 7.3

AWS_ACCESS_KEY_ID=<removed>

AWS_SECRET_ACCESS_KEY=<removed>

1 answer

Your answer