Resolving SAS Token Generation Error for Azure Blob Container

Question

What could be causing an error when a user tries to generate a SAS token for a specific Blob storage container in Azure, and how can it be resolved?

 "PS - Based on common issues that we have seen from customers and other sources, we are posting these questions to help the Azure community."

Answer 1

Greetings!

The error arises because the user has only the Storage Blob Data Contributor role at the container level and lacks the 'Microsoft.Storage/storageAccounts/listKeys/action' permission at the storage account level. This permission is necessary for generating SAS tokens using the account key signing method.

To fix the issue, the user should generate the SAS token using the User Delegation Key signing method. This method requires the 'Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action' permission, which the 'Storage Blob Data Contributor role' at the container level provides.

Additionally, it's worth noting that the Storage Blob Data Contributor role at the container level provides permissions to read and write blob data, but not to manage the container itself. If the user needs to manage the container, they may need additional permissions or a different role.

The resources provided are accurate and helpful for learning more about SAS tokens, role-based access control (RBAC) in Azure, and the Azure Storage Blob Data Contributor role.

Resources:

• Learn more about SAS tokens
• Role-based access control (RBAC) in Azure
• Azure Storage Blob Data Contributor role

Hope this helps. If you have any follow-up questions, please let me know. I would be happy to help.

Please do not forget to "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.