Using SAS token to upload Blob content

Question

I'm having difficulty in using a Blob SAS token to write a file to a Blob in Azure via Powershell.

The code I'm using to generate the SAS token is:

$storageContext = Get-AzureRmStorageAccount -ResourceGroupName $resourceGroup -Name $storageName

$token = New-AzureStorageBlobSASToken -Container $conName -Context $storageContext.Context -Blob $blobName -ExpiryTime $expiry -Permission rw -FullUri

This generates a token as expected: https://name.blob.core.windows.net/container/test.json?sv=2015-04-05&sr=b&sig=abc123&se=2017-03-07T12%3A58%3A52Z&sp=rw

If I use this in the browser it's working fine and downloading the file as expected. However, I can't use this to upload a file. Whenever I try I'm receiving a (403) Forbidden. The code I'm using to upload is:

$accountContext = New-AzureStorageContext -SasToken $sasToken

Get-AzureStorageContainer -Context $accountContext.Context | Set-AzureStorageBlobContent -File $blobFile

I've successfully been using a method similar to this to set Blob content after making a call to Add-AzureRmAccount to authenticate.

I've also tried to use a Container SAS token but I keep getting a 403 error with that.

The fact that the token works for a read leads me to believe that I'm missing something in my Powershell script - can anyone shed any light on what that is?

Gaurav Mantri · Accepted Answer · 2017-03-07 11:31:06Z

4

The fact that the token works for a read leads me to believe that I'm missing something in my Powershell script - can anyone shed any light on what that is?

I believe the problem is with the following line of code:

Get-AzureStorageContainer -Context $accountContext.Context

Two things here:

This cmdlet tries to list the blob containers in your storage account. In order to list blob containers using SAS, you would need an Account SAS where as the SAS you're using is a Container SAS.
Your SAS only has Read and Write permission. For listing containers, you would need List permission as well.

I would recommend simply using Set-AzureStorageBlobContent Cmdlet and provide necessary information to it instead of getting the container name through pipeline.

Set-AzureStorageBlobContent -File $blobFile -Container $conName -Context $accountContext.Context -Blob $blobName

answered Mar 7, 2017 at 11:31

Gaurav Mantri

137k17 gold badges246 silver badges282 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Fermin Over a year ago

I've confirmed that the call to Get-AzureStorageContainer is throwing a 403 when creating a Blob SAS. I changed my code to create a Container SAS with rwl and call Set-AzureStorageBlobContent directly but still getting a 403.

Gaurav Mantri Over a year ago

Can you update your question with the latest code you're using? Thanks.

Fermin Over a year ago

I've resolved the issue. What you have said is working, I was using the -FullUri flag when creating a SAS token. Removing this flag gave me the query string part of the token only which is now allowing me to upload the blob. Thanks.

Collectives™ on Stack Overflow

Using SAS token to upload Blob content

1 Answer 1

3 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related