otty / dotfiles

All tools/Azure CLI

Azure CLI

azure-cli

A set of commands used to create and manage Azure resources.

Detected by az | macOS, Linux, Windows |learn.microsoft.com

Sync it azure-cli.toml

Sync rules

What travels, what stays, what never leaves

Azure CLI in your home directory Every rule on this page, by file

…

[logging]

enable_log_file = yes

log_dir = /Users/octocat/Library/Logs/azuremachine-local

[defaults]

group = octocat-rg

…

Each machine keeps its own copy of these.

keysas_tokenconnection_stringaccess_keystorage_key

Lifted into your secret store; the rest of the file syncs.

· clouds.config Sync

· msal_token_cache.json Never synced

· msal_token_cache.bin Never synced

· service_principal_entries.json Never synced

· service_principal_entries.bin Never synced

Only what the catalog names. A directory that syncs brings everything inside it except what is listed as excluded here.

apps/azure-cli.tomlThe file this page is generated from

id = "azure-cli"

name = "Azure CLI"

homepage = "https://learn.microsoft.com/cli/azure/"

description = "A set of commands used to create and manage Azure resources."

icon = "theSVG:azure"

detect = ["az"]

# https://learn.microsoft.com/cli/azure/azure-cli-configuration: "The

# configuration file itself is located at $AZURE_CONFIG_DIR/config. The default

# value of AZURE_CONFIG_DIR is $HOME/.azure on Linux and macOS, and

# %USERPROFILE%\.azure on Windows" — one location, written here as ~/.azure

# because %USERPROFILE% resolves to the same directory. Confirmed in

# src/azure-cli-core/azure/cli/core/_environment.py:

# os.getenv('AZURE_CONFIG_DIR', None) or os.path.expanduser(os.path.join('~', '.azure'))

# clouds.config holds the custom clouds registered with `az cloud register`:

# CLOUD_CONFIG_FILE = os.path.join(GLOBAL_CONFIG_DIR, 'clouds.config')

# (src/azure-cli-core/azure/cli/core/cloud.py), also INI.

paths = [

"~/.azure/config",

"~/.azure/clouds.config",

]

# Everything else in ~/.azure is state or cache, not configuration:

# azureProfile.json (the signed-in subscriptions), az.json, az.sess,

# commandIndex.json, extensionIndex.json, helpIndex.json,

# extensionHelpIndex.json and versionCheck.json are the session files loaded in

# src/azure-cli-core/azure/cli/core/__init__.py, msal_http_cache.bin is MSAL's

# HTTP cache, and logs/ and commands/ are logs. None of them is named above.

exclude = []

# The token cache and the service-principal store are credentials end to end.

# src/azure-cli-core/azure/cli/core/auth/identity.py builds them as

# self._token_cache_file = os.path.join(config_dir, "msal_token_cache")

# self._secret_file = os.path.join(config_dir, "service_principal_entries")

# and src/azure-cli-core/azure/cli/core/auth/persistence.py appends the

# extension for the mode in use:

# file_extensions = {True: '.bin', False: '.json'}

# so both spellings of each exist in the wild — plaintext JSON where the CLI

# runs unencrypted, the encrypted .bin where it does not.

secret = [

"~/.azure/msal_token_cache.json",

"~/.azure/msal_token_cache.bin",

"~/.azure/service_principal_entries.json",

"~/.azure/service_principal_entries.bin",

]

# Read when the command starts and written back by `az config set`.

side_effect = false

# logging.log_dir is "The directory to write logs to" — an absolute path into

# this machine's disk. It is only in the file because the user moved it, so it

# is part of how they set this machine up and is kept for a rebuild: backup.

[[machine_lines]]

file = "~/.azure/config"

match = { prefix = ["log_dir"] }

scope = "backup"

# The defaults the CLI stores for the data-plane commands include account

# keys: storage.key, storage.sas_token, storage.connection_string,

# batch.access_key and batchai.storage_key are all listed as configurable in

# https://learn.microsoft.com/cli/azure/azure-cli-configuration, and the file

# is INI, so each is written as `<name>=<value>` on its own line.

[[secret_paths]]

file = "~/.azure/config"

match = { prefix = ["key", "sas_token", "connection_string", "access_key", "storage_key"] }

Use it with your dotfile manager

Same data, in the shape your tool already reads

Opens Otty and adds this tool to what it syncs

Opens otty://sync/add/azure-cli. Otty ships with this catalog, so the link only has to name the tool — nothing is downloaded.

Every one of these keeps all credential files out. None of them splits log_dir for you — that part is Otty’s own sync, or a template you write by hand.