I’m trying to back up my Azure API Management (APIM) config to Blob Storage using the Azure CLI. I followed the official docs, but I’m hitting an issue around exposing the storage account key.

Curious how others are handling this in a more secure way in real setups. The example from Microsoft docs looks like this:

apiManagementName="myapim"; apiManagementResourceGroup="apimresourcegroup"; storageAccountName="backupstorageaccount"; storageResourceGroup="storageresourcegroup"; containerName="backups"; backupName="ContosoBackup.apimbackup";

storageKey=$(az storage account keys list \ --resource-group $storageResourceGroup \ --account-name $storageAccountName \ --query [0].value \ --output tsv)

az apim backup \ --resource-group $apiManagementResourceGroup \ --name $apiManagementName \ --storage-account-name $storageAccountName \ --storage-account-key $storageKey \ --storage-account-container $containerName \ --backup-name $backupName

Is there a better way to do this without exposing the storage key?…