使用 PowerShell 中的 REST API 调用取消删除 Azure Blob

Question

我正在尝试使用 PowerShell 执行 REST API 调用，从 Azure 存储中取消删除软删除的 blob。

我使用了下面的脚本：

# Variables
$storageAccountName = "mystorageAccountName"
$containerName = "mycontainerName"
$blobName = "myblobName"

$resGroup = "myResourceGroup"
$subId = "mySubscriptionID"
$tenantID = "myTenantID"

# Authenticate to your Azure account (interactive login)
Connect-AzAccount -Subscription $subID -TenantId $tenantID

# Get storage account key
$storageAccountKey = (Get-AzStorageAccountKey -ResourceGroupName $resGroup -AccountName $storageAccountName)[0].Value

# Construct the URL to undelete the blob
$uri = "https://$storageAccountName.blob.core.windows.net/$containerName/"+$blobName+"?comp=undelete"

# Generate current date/time for the x-ms-date header
$date = Get-Date

# Construct the headers
$headers = @{
    "x-ms-date" = $date.ToString("R")
    "x-ms-version" = "2017-04-17"
    "Authorization" = "SharedKey "+$storageAccountName+":"+$storageAccountKey
}

# Invoke the REST API call to undelete the blob
$response = Invoke-RestMethod -Uri $uri -Method POST -Headers $headers

# Output the response
$response

我收到以下错误（签名混淆）：

Invoke-RestMethod:
Line |
  30 |  $response = Invoke-RestMethod -Uri $uri -Method Post -Headers $header …
     |              ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     |  AuthenticationFailedServer failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
RequestId:37c8df54-401e-0004-4b5a-7f6f96000000
Time:2024-03-26T08:48:52.3955857ZThe MAC signature found in the HTTP request 'pWOmdziTwlN6KOHkf1P/0wKI9NwKsVky4t40OZfqL+40W6vTs6QXYT1ByMfgXWuicBmTHwfGH==' is not the same as any computed signature. Server used following string to sign: 'POST


application/x-www-form-urlencoded


x-ms-date:Tue, 26 Mar 2024 08:48:53 GMT
x-ms-version:2017-04-17
/<mystorageAccountName>/<mycontainerName>/<myblobName>
comp:undelete'.

我正在连接到 Azure，使用的帐户对整个订阅具有贡献者访问权限。

Answer 1

问题出在授权标头上：

"Authorization" = "SharedKey "+$storageAccountName+":"+$storageAccountKey

您无法在授权标头中传递帐户密钥。您必须根据此处提供的说明计算其值：https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-with-shared-key。