Azure Blob Storage Data Migration for the Client-Side Encryption
This section explains how to migrate the client-side encrypted content stored in Azure Blob Storage from the encryption version 1 to the encryption version 2 using BlobDataMigrationTool. To mitigate the security vulnerabilities discovered in client-side encryption version 1, it is recommended that you migrate your Azure Blob data to the client-side encryption version 2. For more information on the security vulnerability, see Microsoft documentation.
You can run this tool by providing site, vault, root folder, folder, and blob options. If any of these options are not provided in the command, the tool will run for the entire system.
windchill com.ptc.windchill.objectstorage.azureblob.tools.BlobDataMigrationTool migrate -u <username> -p <password>
Following is the list of valid arguments:
• -h = <help> — Prints help of the command
• -u = <username> — Administrator user name
• -p = <password> — Administrator password
• -v = <verbose> — Runs the utility in debug mode
• -r = <rootFolderName> — Name of the root folder
• -b = <blob> — Blob path
• -s = <site> — Site name
• -t = <vault> — Vault name
• -f = <folder> — Folder name
After you run the tool, it generates a report in CSV format at windchill/logs/BlobDataMigration. The report lists details such as the mount path, number of files successfully migrated, number of files ignored for migration, number of files failed to migrate, mount type, type of encryption, and total time in seconds to migrate a mount path.
All available mount paths are listed in the report. Files with fileBased mount type and files with server-side encryption will be ignored for migration as the security vulnerability is applicable only to the client-side encryption. The tool also generates a separate text report to list the details of files that failed to migrate. When you run the tool multiple times, the previously migrated files will be ignored.
 |
1. OOTB, the content is stored in Azure Blob Storage using the server-side encryption. For more information on encryption, see Encryption Customization for Azure Blob Storage Mounts.
2. The content migration to client-side encryption version 2 is a one-time activity, and it is applicable only when you are upgrading to Windchill 12.1.2.0 from a previous Windchill release.
|