Uploading blobs to a Azure Storage account where allow Blob public access is disabled

Question

I would like to have my Azure Storage account not be accessible with anonymous access. That is why I configured my Azure Storage account to not be publicly accessible via the following setting:

After configuring this, I created myself a read SAS Token which I use in my service which will fetch the files. This works fine, but now I want to be able to upload my new and changed files from my Azure DevOps pipelines. Problem is that no matter what I try, it always returns the service is not accessible publicly.

My SAS Token which I use on the service side looks as follows:

Using the SAS Token to the storage account returns this:

How will I be able to upload blobs via the Node.js @azure/storage-blob library with the AllowBlobPublicAccess set to disabled?

Answer 1

@Elio Struyf
I tried, but was unable to reproduce this issue. I tested this by setting Blob public access to disabled then generated an account SAS with the same settings as yours. Using the samples available here I was able to use the generated SAS token with anonymousCred.js and added the code to create and upload a blob:

  // Create a blob  
  const content = "hello";  
  const blobName = "newblob" + new Date().getTime();  
  const blockBlobClient = containerClient.getBlockBlobClient(blobName);  
  const uploadBlobResponse = await blockBlobClient.upload(content, Buffer.byteLength(content));  
  console.log(`Upload block blob ${blobName} successfully`, uploadBlobResponse.requestId);  

Can you try checking the sample code to see if there are any differences? If you are still having issues let us know and we can investigate the issue further.

-------------------------------

Please don’t forget to "Accept the answer" and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

Thanks, found the issue while going over it once again. It was the usage of the container client its createIfNotExists method. It specified "container" access level to be used if the container did not exist. Although the container itself already exists, it takes this access level into account. I now removed the access level, and it works fine.