如何通过新建Web应用对多Azure App Service根目录执行文件操作？

核心思路 #

借助Azure App Service的Kudu REST API操作目标Web App的文件系统，用新创建的Web App作为执行端，调用每个目标Web App的Kudu API完成文件复制、删除、下载操作。

前置准备 #

• 为每个目标Web App获取发布凭据：在Azure门户的Web App -> 部署中心 -> FTP/FTPS凭据中查看，或通过Azure CLI命令az webapp deployment list-publishing-profiles --name <webapp-name> --resource-group <rg-name>提取。
• 确保新Web App能访问目标Web App的Kudu端点（默认公网可访问，私有网络环境需配置VNet集成）。

具体实现步骤 #

1. 封装Kudu API调用逻辑 #

以下以C#为例，编写代码封装文件操作的API调用：

文件下载

调用Kudu的GET /api/vfs/{path}接口：

public async Task DownloadFile(string webAppName, string credentialsUsername, string credentialsPassword, string filePath, string localSavePath)
{
    var kuduUrl = $"https://{webAppName}.scm.azurewebsites.net/api/vfs/{Uri.EscapeDataString(filePath)}";
    var handler = new HttpClientHandler { Credentials = new NetworkCredential(credentialsUsername, credentialsPassword) };
    
    using var client = new HttpClient(handler);
    var response = await client.GetAsync(kuduUrl);
    response.EnsureSuccessStatusCode();
    
    using var stream = await response.Content.ReadAsStreamAsync();
    using var fileStream = new FileStream(localSavePath, FileMode.Create);
    await stream.CopyToAsync(fileStream);
}

文件删除

调用Kudu的DELETE /api/vfs/{path}接口：

public async Task DeleteFile(string webAppName, string credentialsUsername, string credentialsPassword, string filePath)
{
    var kuduUrl = $"https://{webAppName}.scm.azurewebsites.net/api/vfs/{Uri.EscapeDataString(filePath)}";
    var handler = new HttpClientHandler { Credentials = new NetworkCredential(credentialsUsername, credentialsPassword) };
    
    using var client = new HttpClient(handler);
    var response = await client.DeleteAsync(kuduUrl);
    response.EnsureSuccessStatusCode();
}

文件复制

Kudu无直接复制接口，通过「下载源文件→上传至目标路径」实现：

public async Task CopyFile(string srcWebAppName, string srcCredsUser, string srcCredsPwd, string srcFilePath, 
                          string destWebAppName, string destCredsUser, string destCredsPwd, string destFilePath)
{
    // 下载源文件到临时路径
    var tempPath = Path.GetTempFileName();
    await DownloadFile(srcWebAppName, srcCredsUser, srcCredsPwd, srcFilePath, tempPath);
    
    // 上传至目标路径
    var destKuduUrl = $"https://{destWebAppName}.scm.azurewebsites.net/api/vfs/{Uri.EscapeDataString(destFilePath)}";
    var handler = new HttpClientHandler { Credentials = new NetworkCredential(destCredsUser, destCredsPwd) };
    
    using var client = new HttpClient(handler);
    using var fileStream = new FileStream(tempPath, FileMode.Open);
    var content = new StreamContent(fileStream);
    
    var response = await client.PutAsync(destKuduUrl, content);
    response.EnsureSuccessStatusCode();
    
    File.Delete(tempPath);
}

2. 批量管理逻辑 #

在新Web App的配置文件（如appsettings.json）中维护目标Web App列表：

"TargetWebApps": [
    {
        "Name": "WebApp-01",
        "PublishUsername": "$WebApp-01",
        "PublishPassword": "your-publish-password"
    },
    {
        "Name": "WebApp-02",
        "PublishUsername": "$WebApp-02",
        "PublishPassword": "your-publish-password"
    }
]

遍历列表执行批量操作的示例：

public async Task BatchCleanLogFiles()
{
    var targetApps = Configuration.GetSection("TargetWebApps").Get<List<WebAppConfig>>();
    foreach (var app in targetApps)
    {
        await DeleteFile(app.Name, app.PublishUsername, app.PublishPassword, @"site\wwwroot\LogFiles\expired-logs.log");
    }
}

3. 安全注意事项 #

• 禁止硬编码发布凭据，建议将凭据存储在Azure Key Vault中，新Web App通过托管身份访问Key Vault获取。
• 限制新Web App的访问权限，仅允许特定IP或授权用户访问，防止未授权操作。
• 操作前先在测试环境验证，避免误删或覆盖核心文件。

替代方案 #

若不想编写代码，可使用Azure Automation Runbook配合PowerShell脚本实现批量操作，逻辑一致：通过调用Kudu API或Az.Websites模块命令完成文件操作。

内容的提问来源于stack exchange，提问作者Meghraj