Securely automate scheduled file upload from Linux to Azure File share.

Hello EnterpriseArchitect,

For secure automated file uploads from Linux to Azure File Share without SAS keys, use Azure Managed Identity with the Azure CLI or SMB over AD—avoids embedded secrets entirely. This is the gold standard for enterprise Linux hosts.

Recommended Approach: Azure CLI with Managed Identity

1. Set Up Managed Identity:
   • Create a User Assigned Identity: az identity create --resource-group <rg> --name file-upload-identity.
   • Assign Storage role: az role assignment create --assignee <identity-principal-id> --role "Storage File Data SMB Share Contributor" --scope /subscriptions/<sub>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<storage>/fileServices/default.
   • On Linux VM, login: az login --identity (system-assigned) or install MSI extension and use az login --identity -i <user-identity-id>.
2. Automate Upload via Cron:
   • Install Azure CLI: curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash.
   • Script (save as /usr/local/bin/upload-files.sh):

     
          #!/bin/bash
     
          az login --identity
     
          az storage file upload-batch --destination <storage-account>.file.core.windows.net/<share> --source /local/path/to/files/ --destination-path . --account-name <storage-account> --auth-mode login
     
     

   • Make executable: chmod +x /usr/local/bin/upload-files.sh.
   • Add to crontab: crontab -e, then * * * * * /usr/local/bin/upload-files.sh (adjust schedule).

Alternative: SMB with Azure AD Kerberos (No CLI Needed)

• Join Linux to Azure AD via SS64 (System Assigned Managed Identity): Install realmd and sssd, then sudo realm join --user=******@domain.com yourdomain.com.
• Mount share: sudo mount -t cifs //<storage>.file.core.windows.net/<share> /mnt/azurefiles -o vers=3.0,sec=ntlmssp,username=<storage-account>,password=<key-from-env>,dir_mode=0777,file_mode=0777—but swap password for AAD auth.
• Use rsync or cp in cron for uploads.

Managed Identity rotates creds automatically and scopes to RBAC—no keys to leak. For multi-host, use User Assigned. Test with az storage file list --share-name <share> --account-name <storage> --auth-mode login.

Best Regards,

Jerald Felix

Hi @Jerald Felix ,

Linux VM, login: az login --identity (system-assigned) or install MSI extension and use az login --identity -i <user-identity-id>.

How do I install the files from within the Linux system for the above?

@Jerald Felix

The OS is quite old IBM AIX server.