<p>Instead of storing them as variables in the bash script themselves, can you store them as environment variables on the system from which the bash script is executing? This is a pretty common practice that will allow your scripts to execute on different systems without having to modify the script on each and every one. </p>

<p>Not sure what you mean by the AWS cli "saves the key and the secret in encrypted format", but if you look at the credentials file in ~/.aws, your access key and secret access key are both in plain text. I'm not sure how the Azure cli manages profiles, but AWS uses the AWS_PROFILE environment variable to distinguish which account the cli should execute as. </p>

CC BY-SA 4.0
2019-08-12T19:40:11.720Z
Correct, my mistake. AWS indeed stores them in plain text after all.
W.M.
CC BY-SA 4.0
2019-08-12T14:16:27.453Z
2019-08-12T14:16:27.453Z
Preston Martin
<p>The <code>Azure CLI</code> official documentation states that environmental variables can be used inside bash scripts to store <code>AZURE_STORAGE_ACCOUNT</code> and <code>AZURE_STORAGE_KEY</code>, like this:</p>

<p><a href="https://i.sstatic.net/RPjlX.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/RPjlX.png" alt="enter image description here"></a></p>

<p>Compared to <code>AWS CLI</code> this method is less secure since it stores the <code>AZURE_STORAGE_KEY</code> in plain text in the bash script.</p>

<p><code>AWS CLI</code>, on the other hand, saves the key and the secret in encrypted format in user's home folder under <code>~/.aws</code> folder.</p>

<p>Does <code>Azure CLI</code> provide similar functionality, or is there any better way to store the key safely in the system?</p>

CC BY-SA 4.0
2019-08-12T14:11:54.827Z
Can you link the documentation, or quote the particular excerpt you are referring to?
Preston Martin
<azure><security><encryption>
Securely saving AZURE_STORAGE_KEY and storage account name in Linux systems
W.M.
# Securely saving AZURE_STORAGE_KEY and storage account name in Linux systems

(Asked by: username_0 on 2019-08-09)

The `Azure CLI` official documentation states that environmental variables can be used inside bash scripts to store `AZURE_STORAGE_ACCOUNT` and `AZURE_STORAGE_KEY`, like this:

[![enter image description here](https://i.sstatic.net/RPjlX.png)](https://i.sstatic.net/RPjlX.png)

Compared to `AWS CLI` this method is less secure since it stores the `AZURE_STORAGE_KEY` in plain text in the bash script.

`AWS CLI`, on the other hand, saves the key and the secret in encrypted format in user's home folder under `~/.aws` folder.

Does `Azure CLI` provide similar functionality, or is there any better way to store the key safely in the system?

**Tags:** azure, security, encryption

> **Comments:**
> **username_1**: Can you link the documentation, or quote the particular excerpt you are referring to?  

---

## 1 answers

### Answer by username_1 on 2019-08-12. Score: 1 | Accepted answer

Instead of storing them as variables in the bash script themselves, can you store them as environment variables on the system from which the bash script is executing? This is a pretty common practice that will allow your scripts to execute on different systems without having to modify the script on each and every one.

Not sure what you mean by the AWS cli "saves the key and the secret in encrypted format", but if you look at the credentials file in ~/.aws, your access key and secret access key are both in plain text. I'm not sure how the Azure cli manages profiles, but AWS uses the AWS\_PROFILE environment variable to distinguish which account the cli should execute as.

> **Comments:**
> **username_0**: Correct, my mistake. AWS indeed stores them in plain text after all.  

---

