Securely saving AZURE_STORAGE_KEY and storage account name in Linux systems

Question

The Azure CLI official documentation states that environmental variables can be used inside bash scripts to store AZURE_STORAGE_ACCOUNT and AZURE_STORAGE_KEY, like this:

Compared to AWS CLI this method is less secure since it stores the AZURE_STORAGE_KEY in plain text in the bash script.

AWS CLI, on the other hand, saves the key and the secret in encrypted format in user's home folder under ~/.aws folder.

Does Azure CLI provide similar functionality, or is there any better way to store the key safely in the system?

Answer 1

Instead of storing them as variables in the bash script themselves, can you store them as environment variables on the system from which the bash script is executing? This is a pretty common practice that will allow your scripts to execute on different systems without having to modify the script on each and every one.

Not sure what you mean by the AWS cli "saves the key and the secret in encrypted format", but if you look at the credentials file in ~/.aws, your access key and secret access key are both in plain text. I'm not sure how the Azure cli manages profiles, but AWS uses the AWS_PROFILE environment variable to distinguish which account the cli should execute as.