In Customer Service and Support we have a great opportunity to see exactly how our customers are using Azure IoT tech and where their most frequent pain points are. We've come across an interesting scenario, for which we've tried to help out:
Let's say you need to upload files from a device to a blob storage. You can easily link your IoT Hub to a storage account in the Azure Portal! However, your company has security policies that require you to regenerate your Azure resource keys every X days/months. This breaks the Hub-Blob link and you then have to re-link them again... manually... every single time...
Thus in the interest of public laziness and efficiency, we wrote a small Powershell script that does that for you! You can find it here as a gist.
We'll be dissecting a bit of the script below and going into some detail on IoT Hub file upload mechanics, so if you're already familiar with that, feel free to just get the gist above and skip the rest.
--------- Azure IoT Hub File Upload ----------
When you're linking a storage container (located inside a storage account) to an IoT Hub, you're essentially just telling the Hub to fetch the storage connection string (connString), which is then kept in configuration inside the Hub. There is no continuously synchronizing relationship between the storage account and the IoT Hub.
Thus when the storage connString changes, the one that is in the IoT Hub config is no longer valid and must be fetched again, otherwise you'll get an "unauthorized" style of exception on the device side when it tries to contact the storage account directly.
You can get more details on file upload here, but in a quick visual overview:
- The device requests the IoT Hub to get an access token for its linked storage account. This token is specific for the file being uploaded.
The IoT Hub then takes the storage connString in its configuration, builds a SAS URI and sends it to the device. The IoT Hub acts only as an intermediary for the access tokens, not participating in the upload process directly. - The device authenticates against the storage account API and uploads the promised file.
- When the upload is complete the device then notifies the IoT Hub of completion and how long it took.
-------------------------------------------------------
---------- iotHubStorReLinker.ps1 -----------
If you're just getting started with Azure Powershell commands, check this link out. At the moment there's a new cross platform module (Az) that is replacing the older one (AzureRM), so you can identify new/old commands based on their prefix.
To use the script you'll need to define these three parameters:
# --------- Config Parameters ------------- <------- Start here! -----
$IoTHubName = "_____________"
$IoTHubResourceGroup = "_____________"
$StorageAccountResourceGroup = "_____________"
# -----------------------------------------
In a very high-level description, this script does the following:
- Takes the IoT Hub configuration
- Gets the storage account linked to that IoT Hub
- Regenerates the storage account keys
- Retrieves one of the newly regenerated keys
- Builds a new storage connection string for the IoT Hub (based on one of the keys regenerated in 4))
- Changes the previously saved IoT Hub config to include the new storage connection string, and then applies the config to the IoT Hub
-------------------------------------------------------
Huge thanks to @JPRodrig, for helping out with the script and reviewing
If this content was helpful and you'd like to see more posts like these, please feel free to let us know in the comments below or in a private message.