HELP: Azure Blob Storage cloud object store TYPE: OBJECT SYNTAX: AZURE(PROVIDER(),CONTAINER/BUCKET='str',PREFIX='str',TIMEOUT=num)
Use Azure Blob Storage cloud object store for archive read.
The archive is read from the specified Azure container. The version to read can be selected by specifying a version number (0 = latest, negative = relative to latest, positive = absolute version ID).
On z/OS this store does not use FLAM's libcurl-based HTTP client, which is not available there, but the z/OS Client Web Enablement Toolkit. That toolkit speaks HTTP/1.1 at most, so the requests are serialised and neither the prefetch nor the write queue can help; and outside 31-bit z/OS UNIX it needs a helper program in a second address space. A cloud archive on z/OS is therefore markedly slower than the same archive on an open platform, and raising DATBUF -- fewer, larger objects -- is the one setting with real effect. The STORE section "Storage Backends and How FLAM Reaches Them" explains the whole arrangement in one place.
ACCOUNT specifies the Azure storage account name (required). CONTAINER specifies the blob container name (required). ACCOUNTKEY provides the base64-encoded storage account key (kept secret). SASTOKEN provides a Shared Access Signature token as an alternative to the account key (kept secret). CLIENTID, CLIENTSECRET, and TENANTID together enable OAuth2 client credentials authentication using an Azure AD application identity; CLIENTSECRET is kept secret. ENDPOINT overrides the default Azure Blob Storage endpoint URL. PREFIX adds a blob name prefix to all objects. PORT overrides the default HTTPS port (0 = default 443).
Authentication modes are evaluated in the following order of precedence:
ACCOUNTKEY, SASTOKEN, and CLIENTSECRET are marked sensitive (CLPFLG_PWD) and are never echoed or logged. To avoid exposing credentials in shell history or process listings, read sensitive parameters from a file using the CLEP file-input syntax:
flcl xcmp store.azure(ACCOUNT=myaccount CONTAINER=mycontainer ACCOUNTKEY=f'~/.fl5cred/az_key.txt') input.dat
The notation f'<path>' reads the parameter value from the named file. Store credential files in a dedicated hidden directory with strict permissions:
mkdir -m 700 ~/.fl5cred echo -n "base64encodedkeyhere==" > ~/.fl5cred/az_key.txt chmod 600 ~/.fl5cred/az_key.txt
For SAS tokens the same pattern applies (SASTOKEN=f'~/.fl5cred/az_sas.txt'). Alternatively, export the credentials as environment variables before invoking flcl (see CAZ Environment Variable Fallbacks below). This is the recommended approach for non-interactive use (scripts, CI, container environments) as the values remain outside the command line entirely.
All connection parameters can also be supplied via environment variables. The CLEP parameter takes precedence when it is set to a non-empty value; the environment variable is consulted only when the parameter is absent or empty:
ACCOUNT -- AZURE_STORAGE_ACCOUNT CONTAINER -- FL_AZURE_CONTAINER ACCOUNTKEY -- AZURE_STORAGE_KEY SASTOKEN -- AZURE_STORAGE_SAS_TOKEN CLIENTID -- AZURE_CLIENT_ID CLIENTSECRET -- AZURE_CLIENT_SECRET TENANTID -- AZURE_TENANT_ID ENDPOINT -- FL_AZURE_ENDPOINT PREFIX -- FL_AZURE_PREFIX
STRING: CONTAINER/BUCKET='str' - Azure blob container name [required; env: FL_AZURE_CONTAINER]STRING: PREFIX='str' - Blob name prefix [default: none; env: FL_AZURE_PREFIX]NUMBER: TIMEOUT=num - Seconds a request may make no progress: connect, or a transfer below 1 KB/s (0 = default) [30]