解密并将blob复制到其他blob存储帐户？

Question

我正在使用这种方法来加密文件并将它们存储在Azure块blob中.我想将加密的blob复制到另一个blob存储帐户并在此过程中对其进行解密.我知道可以执行"复制blob"操作,该操作完全在Azure内部运行,并且不会通过我的本地计算机在传输过程中下载blob内容.我相信这是通过这种CloudBlockBlob.StartCopy方法实现的.但是,是否可以使用加密文件执行此操作并将其解密到传输到其他存储帐户？

在上面的链接之后,我的代码如下所示.blob.OpenRead有效,但blob2.StartCopy不起作用.

BlobEncryptionPolicy policy = new BlobEncryptionPolicy(null, cloudResolver);
BlobRequestOptions options = new BlobRequestOptions() { EncryptionPolicy = policy };
CloudBlockBlob blob = container.GetBlockBlobReference("MyFile.txt");
//var blobStream = blob.OpenRead(null, options); //this works

CloudBlockBlob blob2 = container2.GetBlockBlobReference("MyFile2.txt");
blob2.StartCopy(blob, null, null, options, null); //this fails with: The remote server returned an error: (404) Not Found.

Answer 1

答案是加密是在存储客户端库中完成的,因此如果您对新的存储帐户执行复制blob,它仍将被加密.

您的代码失败的原因是因为源blob位于Private容器中.要使跨帐户副本生效,源Blob应可公开访问.在同一存储帐户中,您可以从私有容器中复制blob.AFAIK,该错误与加密无关.

您可以做的是在源blob上创建SAS URL,然后使用以下StartCopy方法覆盖:

public string StartCopy(
    Uri source,
    AccessCondition sourceAccessCondition = null,
    AccessCondition destAccessCondition = null,
    BlobRequestOptions options = null,
    OperationContext operationContext = null
)

以下是执行此操作的示例代码:

    private static void StartCopyAcrossAccount()
    {
        var sourceAccount = new CloudStorageAccount(new StorageCredentials("source-account-name", "source-account-key"), true);
        var sourceContainer = sourceAccount.CreateCloudBlobClient().GetContainerReference("source-container");
        var sourceBlob = sourceContainer.GetBlockBlobReference("blob-name");
        var sourceBlobSas = sourceBlob.GetSharedAccessSignature(new Microsoft.WindowsAzure.Storage.Blob.SharedAccessBlobPolicy()
            {
                SharedAccessExpiryTime = DateTime.UtcNow.AddHours(1),
                Permissions = Microsoft.WindowsAzure.Storage.Blob.SharedAccessBlobPermissions.Read
            });
        var sourceBlobSasUrl = sourceBlob.Uri.AbsoluteUri + sourceBlobSas;

        var targetAccount = new CloudStorageAccount(new StorageCredentials("target-account-name", "target-account-key"), true);
        var targetContainer = targetAccount.CreateCloudBlobClient().GetContainerReference("target-container");
        var targetBlob = targetContainer.GetBlockBlobReference("blob-name");

        var copyId = targetBlob.StartCopy(new Uri(sourceBlobSasUrl), null, null);
    }