Блог

Я следую этому документу, чтобы зашифровать данные с помощью ключа в Azure Key Vault и загрузить в хранилище больших двоичных объектов Azure

https://docs.microsoft.com/en-us/azure/storage/blobs/storage-encrypt-decrypt-blobs-key-vault?WT.mc_id=Portal-Microsoft_Azure_Supportamp;tabs=dotnet11#use-key-vault-secrets

Мне удалось зашифровать и загрузить с помощью ключа в azure key vault, но я получаю ошибку при расшифровке и загрузке данных

             StorageCredentials dcreds = new StorageCredentials("storage-account-name", "storage-account-key");

          


            CloudStorageAccount daccount = new CloudStorageAccount(dcreds, useHttps: true);
            CloudBlobClient dclient = daccount.CreateCloudBlobClient();
            CloudBlobContainer dcontain = dclient.GetContainerReference("container-name");


            KeyVaultKeyResolver dcloudResolver = new KeyVaultKeyResolver(GetToken);

            var drsa = dcloudResolver.ResolveKeyAsync(
                   "https://my-key-vault.vault.azure.net/keys/my-key",
                   CancellationToken.None).GetAwaiter().GetResult();

            BlobEncryptionPolicy dpolicy = new BlobEncryptionPolicy(null, dcloudResolver);
            BlobRequestOptions doptions = new BlobRequestOptions() { EncryptionPolicy = dpolicy };


            CloudBlockBlob dblob = dcontain.GetBlockBlobReference("Data.txt");
            
            using (var np = File.Open(@"Data.txt", FileMode.Create))
                dblob.DownloadToStream(np, null, doptions, null);

 

Data.txt зашифрованный большой двоичный объект находится в контейнере

Трассировка стека ниже

  Microsoft.Azure.Storage.StorageException: "Decryption logic threw error. Please check the inner exception for more details."--->System.AggregateException:
     "One or more errors occurred. (Operation returned an invalid status code 'Forbidden')"--->Microsoft.Azure.KeyVault.Models.KeyVaultErrorException:
     "Operation returned an invalid status code 'Forbidden'"
   at at Microsoft.Azure.KeyVault.KeyVaultClient.<UnwrapKeyWithHttpMessagesAsync>d__58.MoveNext()n
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()n
     at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)n
     at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)n
     at System.Runtime.CompilerServices.ConfiguredTaskAwaitable`1.ConfiguredTaskAwaiter.GetResult()n
     at Microsoft.Azure.KeyVault.KeyVaultClientExtensions.<UnwrapKeyAsync>d__5.MoveNext()
   ---End of inner exception stack trace ---
   at at System.Threading.Tasks.Task`1.GetResultCore(Boolean waitCompletionNotification)n
     at System.Threading.Tasks.Task`1.get_Result()n
     at Microsoft.Azure.KeyVault.KeyVaultKey.<>c.<UnwrapKeyAsync>b__14_0(Task`1 result)n
     at System.Threading.Tasks.ContinuationResultTaskFromResultTask`2.InnerInvoke()n
     at System.Threading.Tasks.Task.<>c.<.cctor>b__277_0(Object obj)n
     at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)n--
     - End of stack trace from previous location ---n
     at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()n
     at System.Threading.ExecutionContext.RunFromThreadPoolDispatchLoop(Thread threadPoolThread, ExecutionContext executionContext, ContextCallback callback, Object state)n
     at System.Threading.Tasks.Task.ExecuteWithThreadLocal(Taskamp; currentTaskSlot, Thread threadPoolThread)n-- - End of stack trace from previous location ---n
     at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()n
     at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)n
     at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)n
     at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()n
     at Microsoft.Azure.Storage.Blob.BlobEncryptionPolicy.<>c__DisplayClass13_1.<DecryptBlob>b__2()n
     at Microsoft.Azure.Storage.Core.Util.CommonUtility.RunWithoutSynchronizationContext[T](Func`1 actionToRun)n
     at Microsoft.Azure.Storage.Blob.BlobEncryptionPolicy.DecryptBlob(Stream userProvidedStream, IDictionary`2 metadata, ICryptoTransformamp; transform, Nullable`1 requireEncryption, Byte[] iv,
     Boolean noPadding)
   ---End of inner exception stack trace ---
   at Microsoft.Azure.Storage.Core.Executor.Executor.<ExecuteAsync>d__1`1.MoveNext()n
   at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()n
     at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)n
     at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)n
     at System.Runtime.CompilerServices.TaskAwaiter`1.GetResult()n
     at Microsoft.Azure.Storage.Core.Executor.Executor.<>c__DisplayClass0_0`1.<ExecuteSync>b__0()n
     at Microsoft.Azure.Storage.Core.Util.CommonUtility.RunWithoutSynchronizationContext[T](Func`1 actionToRun)n
     at Microsoft.Azure.Storage.Core.Executor.Executor.ExecuteSync[T](RESTCommand`1 cmd, IRetryPolicy policy, OperationContext operationContext)n
     at Microsoft.Azure.Storage.Blob.CloudBlob.DownloadRangeToStream(Stream target, Nullable`1 offset, Nullable`1 length, AccessCondition accessCondition, BlobRequestOptions options,OperationContext operationContext)n
     at Microsoft.Azure.Storage.Blob.CloudBlob.DownloadToStream(Stream target, AccessCondition accessCondition, BlobRequestOptions options, OperationContextoperationContext)n
     at decryptBlobUsingVaultKey.Program.Main(String[] args) in / Users / takeatu / Projects / decryptBlobUsingVaultKey / decryptBlobUsingVaultKey / Program.cs:127
 

Ключ в хранилище ключей имеет разрешение на все операции

Я попытался в своей системе получить возможность шифрования токена и дешифрования большого двоичного объекта

попробуйте предоставить разрешение Get

ВЫВОД: