Is there an alternative to assigning a SAS token to a directory within a blob container?

Question

Is there an alternative to assigning a SAS token to a directory within a blob container?

Ander 1

I need to assign a SAS Token to a specific directory in a blob container. For security reasons I can not assign a SAS Token to the whole container but only to a subdivision of it. I know that a folder is a virtual entity and because of that the asignmente of the SAS Token is restricted. I have also tried with the file shares but I am facing the same situation.

What would be the alternative to achieve this effect? I had thought of creating a new container for each of the subdivisions I need, but I do not consider it as clean and easy to maintain as having it organized in subfolders.

If someone has a solution for the problem it would help me a lot. Thank you very much for your help.

Vaibhav Chaudhari 38,921 Reputation points Volunteer Moderator

2022-01-10T15:13:55.053+00:00

Create Azure data lake gen2 (Storage with Hierarchical namespace enabled) then? and you can use Folder level access

1 answer

Your answer

Vaibhav Chaudhari 38,921 Reputation points Volunteer Moderator

2022-01-10T15:13:55.053+00:00

Create Azure data lake gen2 (Storage with Hierarchical namespace enabled) then? and you can use Folder level access

Answer 1

Sumarigo-MSFT 47,471 Microsoft Employee Moderator

@Ander Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

May I know what exactly are you trying to accomplish?

This article describes the options that Azure Storage offers for authorizing access to data: https://learn.microsoft.com/en-us/azure/storage/common/authorize-data-access

Looking forward for your reply!

Please let us know if you have any further queries. I’m happy to assist you further.

----------

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Ander 1 Reputation point

2022-01-11T10:06:13.637+00:00
@Sumarigo-MSFT Thank you for your response.

What I am trying to achieve is to obtain a Sas Token for a directory that is inside a blob container. From what I have investigated it seems that this is not possible, since a SAS Token should be assigned to a particular resource or the entire container.

I have also tried with the file shares and the same thing happens to me.

The alternative I mentioned was instead of having directories inside the blob container to make a container for each of the directories. But it seems a less clean solution to me to have the resource structured like that. That's why I was asking to see if there is any alternative to this problem or a better way to deal with it.

I put an example of the structure so that it can be understood better:

Original structure

Blob Container

Folder 1 (The folder to which I want to assign the SAS Token)
- File 1

Folder 2 (The folder to which I want to assign the SAS Token)
- File 1 - File 2

Alternative

Container 1 (For folder 1)
- File 1

Container 2 (For folder 2)
- File 1 - File 2

I hope this helps

Thank you very much
Sumarigo-MSFT 47,471 Reputation points Microsoft Employee Moderator

2022-01-20T08:55:50.107+00:00

@Ander I assume you are using virtual directories, which are just blobs that are named with a path delimiter. There's no way to assign a SAS to a virtual directory and have it apply to the blobs that are "beneath" that virtual directory. but using application logic, and depending on what he needs, you could create a SAS for each blob beneath that virtual directory (meaning each blob that shares the parent path as part of its name)

If that won't work, then you just needs to use separate containers. storage is designed to do this with containers, separate containers are the easy solution!

The design which you are referring isn't designed yet.

You may leave your feedback here. All the feedback you share in these forums will be monitored and reviewed by the Microsoft engineering teams responsible for building Azure.

Please let us know if you have any further queries. I’m happy to assist you further.

----------

Please do not forget to and “” wherever the information provided helps you, this can be beneficial to other community members.

Share via

Is there an alternative to assigning a SAS token to a directory within a blob container?

1 answer

Your answer