az storage account keys

Manage storage account keys.

Commands

Name	Description	Type	Status
az storage account keys list	List the access keys or Kerberos keys (if active directory enabled) for a storage account.	Core	GA
az storage account keys renew	Regenerate one of the access keys or Kerberos keys (if active directory enabled) for a storage account.	Core	GA

az storage account keys list

List the access keys or Kerberos keys (if active directory enabled) for a storage account.

az storage account keys list --account-name
                             [--expand-key-type]
                             [--resource-group]

Examples

List the access keys for a storage account.

az storage account keys list -g MyResourceGroup -n MyStorageAccount

List the access keys and Kerberos keys (if active directory enabled) for a storage account.

az storage account keys list -g MyResourceGroup -n MyStorageAccount --expand-key-type kerb

Required Parameters

--account-name -n

The storage account name.

Optional Parameters

--expand-key-type

Preview

Specify the expanded key types to be listed.

Default value: kerb

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc

Default value: json

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.

az storage account keys renew

Regenerate one of the access keys or Kerberos keys (if active directory enabled) for a storage account.

Kerberos key is generated per storage account for Azure Files identity based authentication either with Azure Active Directory Domain Service (Azure AD DS) or Active Directory Domain Service (AD DS). It is used as the password of the identity registered in the domain service that represents the storage account. Kerberos key does not provide access permission to perform any control or data plane read or write operations against the storage account.

az storage account keys renew --account-name
                              --key {key1, key2, primary, secondary}
                              [--key-type {kerb}]
                              [--resource-group]

Examples

Regenerate one of the access keys for a storage account.

az storage account keys renew -g MyResourceGroup -n MyStorageAccount --key primary

Regenerate one of the Kerberos keys for a storage account.

az storage account keys renew -g MyResourceGroup -n MyStorageAccount --key secondary --key-type kerb

Required Parameters

--account-name -n

The storage account name.

--key

The key options to regenerate.

Accepted values: key1, key2, primary, secondary

Optional Parameters

--key-type

The key type to regenerate. If --key-type is not specified, one of access keys will be regenerated by default.

Accepted values: kerb

--resource-group -g

Name of resource group. You can configure the default group using az configure --defaults group=<name>.

Global Parameters

--debug

Increase logging verbosity to show all debug logs.

--help -h

Show this help message and exit.

--only-show-errors

Only show errors, suppressing warnings.

--output -o

Output format.

Accepted values: json, jsonc, none, table, tsv, yaml, yamlc

Default value: json

--query

JMESPath query string. See http://jmespath.org/ for more information and examples.

--subscription

Name or ID of subscription. You can configure the default subscription using az account set -s NAME_OR_ID.

--verbose

Increase logging verbosity. Use --debug for full debug logs.