Using Managed Identities in my Azure Function and it fails trying to convert the URI for Blob Container

Question

Using Managed Identities in my Azure Function and it fails trying to convert the URI for Blob Container

Bernard Brown 75

I'm using Managed Identities in Azure. My function is trying to write a file to a container. As I try to get a BlobServiceClient, it fails on creating a new Uri. Per the directions, here is my line of code:

new BlobServiceClient(new Uri(endPoint), new DefaultAzureCredential())

Here is my storage container endpoint: https://mystorageacctname.blob.core.windows.net/

Can someone let me know what I'm doing wrong here?

2 answers

Your answer

Answer 1

Abiola Akinbade 29,405 Volunteer Moderator

Hello Bernard Brown,

Thanks for your question.

I will recommend you verify that the managed identity has the necessary permissions on the storage account (e.g., "Storage Blob Data Contributor" role).

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola

Bernard Brown 75 Reputation points

2024-08-11T03:36:26.9566667+00:00

Hi Abiola,

The function has both the Storage Blob Data Contributor and Storage Table Data Contributor roles. It retrieves data from and writes data to tables as well.
Thanks,

Bernard
Abiola Akinbade 29,405 Reputation points Volunteer Moderator

2024-08-11T04:03:59.9133333+00:00

I meant the managed identity?
Bernard Brown 75 Reputation points

2024-08-11T11:31:04.9233333+00:00

I went under the storage account and added role assignments for the function's managed identity.

Answer 2

TP 124.9K Volunteer Moderator

Hi,

What exception are you getting?

using Azure.Storage.Blobs;
using Azure.Storage.Blobs.Models;
using System;
using System.IO;
using Azure.Identity;

string endPoint = "https://mystorageacctname.blob.core.windows.net/";

var blobServiceClient = new BlobServiceClient(
        new Uri(endPoint),
        new DefaultAzureCredential());

Please click Accept Answer and upvote if the above was helpful.

Thanks.

-TP

Bernard Brown 75

I apologize. I thought I had provided the exception:

Exception while executing function: Functions.MyProcessAsync Result: Failure
Exception: System.UriFormatException: Invalid URI: The format of the URI could not be determined.
   at System.Uri.CreateThis(String uri, Boolean dontEscape, UriKind uriKind, UriCreationOptions& creationOptions)
   at System.Uri..ctor(String uriString)

Bernard Brown 75

I apologize. I thought I had provided the exception and I see that I haven't.

Exception while executing function: Functions.MyProcessAsync Result: Failure
Exception: System.UriFormatException: Invalid URI: The format of the URI could not be determined.
   at System.Uri.CreateThis(String uri, Boolean dontEscape, UriKind uriKind,  UriCreationOptions& creationOptions)
   at System.Uri..ctor(String uriString)

TP 124.9K Reputation points Volunteer Moderator

2024-08-11T19:54:43.37+00:00

Thanks.

What is the precise value (obfuscated for privacy) of endPoint before you make the call to new Uri(endPoint)? Is it absolute as I have in example code above? And endPoint is string, correct?
Bernard Brown 75 Reputation points

2024-08-11T20:07:40.8933333+00:00

The endpoint is the just as you listed in your example. It is the endpoint for the blobs that's listed under endpoints in the storage account.
TP 124.9K Reputation points Volunteer Moderator

2024-08-11T21:16:32.62+00:00

Okay, for troubleshooting purposes please log the value of endPoint right before it is used.

Additionally, please try temporarily modifying your code so that it is a hard-coded string instead of using endPoint variable, (e.g. new Uri("https://mystorageacctname.blob.core.windows.net/") The Uri constructor isn't liking the value you are giving it for whatever reason so the idea with the above steps is to try and figure out why.
Bernard Brown 75 Reputation points

2024-08-11T23:56:46.1633333+00:00

So, the hard coding worked. I added the log statements, but I can't see the values. I didn't know where to check in appInsights. When I ran it locally, the value I hard coded was the same value locally and it was retrieved from the env variables just fine. As this is a value that will be different in each environment, I need to be able to set this in the environment variables and retrieve it.
TP 124.9K Reputation points Volunteer Moderator

2024-08-12T00:53:25.8433333+00:00

That helps a lot. If you want, go ahead and post snippet where you are retrieving the environment variable and assigning its value to endPoint and I'll take a look at it.

Bernard Brown 75

In my Program.cs, I get the env variables:

IConfigurationRoot configuration = new ConfigurationBuilder()
                                  .AddEnvironmentVariables()
                                  .Build();

var blobStorageEndPoint = configuration.GetValue<string>(BlobStorageEndPoint);

Then I create my FileService and add the variables:

sCollection.AddSingleton<IFileService, FileService>(_ => IsNullOrEmpty(blobStorageEndPoint)
                                                      || IsNullOrEmpty(container)
                                                        ? throw new Exception(Messages.FileServiceError)
                                                        : new FileService(storageConn!, container, blobStorageEndPoint
                                                                        , fmcsaFileName));

Then I write a file

await fileService.WriteOutputFile(stream, fileName, logger);

I get a blobClient and upload a file to the storage account in the WriteOutputFile method:

 BlobClient blobClient = GetBlobClient(fileName);

 await blobClient.UploadAsync(stream, true);

Here is how the file service gets the client:

 public static BlobClient CreateBlobClient(string conn, string endPoint, string container, string fileName)
 {
     BlobContainerClient containerClient = CreateBlobContainerClient(conn, endPoint.Trim(), container);

     BlobClient? blobClient = containerClient.GetBlobClient(fileName);

     return blobClient;
 }

Then I get the ContainterClient:

public static BlobContainerClient CreateBlobContainerClient(string conn, string endPoint, string container)
{
    const string TheEndPoint = "https://safetysandboxstacct.blob.core.windows.net/";
    BlobServiceClient blobServiceClient = IsNullOrEmpty(conn)
        // ? new BlobServiceClient(new Uri(TheEndPoint), new DefaultAzureCredential())
        ? new BlobServiceClient(new Uri(endPoint), new DefaultAzureCredential())
        : new BlobServiceClient(conn);
    BlobContainerClient? containerClient = blobServiceClient.GetBlobContainerClient(container);
    return containerClient;
}

And it's at this point that I'm getting the Uri error.

Share via

Using Managed Identities in my Azure Function and it fails trying to convert the URI for Blob Container

2 answers

Your answer