azure - 使用 powershell 登录 azure 帐户而不弹出窗口

Question

我正在尝试使用 powershell 创建 Azure VM。我还有创建它的脚本。

首先我需要登录 Azure 帐户:

Login-AzureRMAccount

这会弹出一个窗口来输入凭据。

其次我需要运行以下脚本:

$UserName = "username"
$Password = ConvertTo-SecureString "password" -AsPlainText -Force
$psCred = New-Object System.Management.Automation.PSCredential($UserName, $Password)    
New-AzureRmVm `
    -ResourceGroupName "RG1" `
    -Name "VM1" `
    -ImageName "Image1" `
    -Location "West US" `
    -Credential $psCred

这已成功创建虚拟机。
但现在，我需要让这些脚本在有要求时自动运行。我面临的问题是，登录步骤会弹出一个窗口来输入我不想要的凭据。所以我尝试过类似的方法，但没有成功。

$username = "<a href="https://stackoverflow.com/cdn-cgi/l/email-protection" class="__cf_email__" data-cfemail="3d51525a5453535c50587d524f5a5c5354475c49545253135e5250" rel="noreferrer noopener nofollow">[email protected]</a>"
$SecurePassword = ConvertTo-SecureString "password" -AsPlainText -Force
$cred = New-Object System.Management.Automation.PSCredential($username, $SecurePassword)
Login-AzureRmAccount -Credential $cred 

它给出的错误消息是:

Login-AzureRmAccount : accessing_ws_metadata_exchange_failed: Accessing WS metadata exchange failed: The underlying connection was closed: An unexpected error occurred on a send.
At line:4 char:1
+ Login-AzureRmAccount -Credential $cred
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Connect-AzureRmAccount], AadAuthenticationFailedException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Profile.ConnectAzureRmAccountCommand

谁能告诉我这意味着什么以及如何纠正这个问题？谢谢!

Answer 1

如果您计划使用 PowerShell 将任何服务自动化到 Azure 中，那么我建议您使用服务主体而不是您自己的凭据连接 Azure，这将是一个安全的连接方式。

什么是服务主体？

An Azure service principal is a security identity used by user-createdapps, services, and automation tools to access specific Azureresources. Think of it as a 'user identity' (username and password orcertificate) with a specific role, and tightly controlled permissions.It only needs to be able to do specific things, unlike a general useridentity. It improves security if you only grant it the minimumpermissions level needed to perform its management tasks.

关注this tutorial创建服务主体

我还发布了一个示例 PowerShell workflow into Microsoft gallery for creating Service Principal您也可以遵循。

创建服务主体后，您可以使用以下 PowerShell 命令登录 Azure，无需任何弹出窗口

$applicationId = "<service prinicple application id>";
$securePassword = "<service prinicple password>" | ConvertTo-SecureString -AsPlainText -Force
$credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList $applicationId, $securePassword
Connect-AzureRmAccount -ServicePrincipal -Credential $credential -TenantId "<your tenantid>"

更新1:

由于某种原因/错误，上述内容将会失败。引用这个github issue

解决这个问题

在脚本之前添加两行

Import-Module -Name AzureRM.Profile
Remove-AzureRmAccount

<小时/>

更新 2:

AzureRM 将不再接收新的 cmdlet 或功能。不过，AzureRM 模块仍由官方维护，并将在 2020 年 12 月之前修复错误。

您必须使用新的 Azure PowerShell Az module