Create an account SAS with .NET

Je li ova stranica od pomoći?

Imate dodatne povratne informacije?

Povratne informacije će biti poslane kompaniji Microsoft: pritiskom na dugme za slanje, vaše povratne informacije će se koristiti za unapređivanje proizvoda i usluga kompanije Microsoft. Pravila privatnosti.

A shared access signature (SAS) enables you to grant limited access to containers and blobs in your storage account. When you create a SAS, you specify its constraints, including which Azure Storage resources a client is allowed to access, what permissions they have on those resources, and how long the SAS is valid.

Every SAS is signed with a key. You can sign a SAS in one of two ways:

• With a key created using Azure Active Directory (Azure AD) credentials. A SAS that is signed with Azure AD credentials is a user delegation SAS. A client that creates a user delegation SAS must be assigned an Azure RBAC role that includes the Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey action. For more information, see Create a user delegation SAS.
• With the storage account key. Both a service SAS and an account SAS are signed with the storage account key. The client that creates a service SAS must either have direct access to the account key or be assigned the Microsoft.Storage/storageAccounts/listkeys/action permission.

Note

A user delegation SAS offers superior security to a SAS that is signed with the storage account key. Microsoft recommends using a user delegation SAS when possible. For more information, see Grant limited access to data with shared access signatures (SAS).

This article shows how to use the storage account key to create an account SAS with the Azure Storage client library for .NET.

Create an account SAS

.NET v12 SDK

A account SAS is signed with the account access key. Use the StorageSharedKeyCredential class to create the credential that is used to sign the SAS. Next, create a new AccountSasBuilder object and call the ToSasQueryParameters to get the SAS token string.

private static string GetAccountSASToken(StorageSharedKeyCredential key)
{
    // Create a SAS token that's valid for one hour.
    AccountSasBuilder sasBuilder = new AccountSasBuilder()
    {
        Services = AccountSasServices.Blobs | AccountSasServices.Files,
        ResourceTypes = AccountSasResourceTypes.Service,
        ExpiresOn = DateTimeOffset.UtcNow.AddHours(1),
        Protocol = SasProtocol.Https
    };

    sasBuilder.SetPermissions(AccountSasPermissions.Read |
        AccountSasPermissions.Write);

    // Use the key to get the SAS token.
    string sasToken = sasBuilder.ToSasQueryParameters(key).ToString();

    Console.WriteLine("SAS token for the storage account is: {0}", sasToken);
    Console.WriteLine();

    return sasToken;
}

.NET v11 SDK

To create an account SAS for a container, call the CloudStorageAccount.GetSharedAccessSignature method.

The following code example creates an account SAS that is valid for the Blob and File services, and gives the client permissions read, write, and list permissions to access service-level APIs. The account SAS restricts the protocol to HTTPS, so the request must be made with HTTPS. Remember to replace placeholder values in angle brackets with your own values:

static string GetAccountSASToken()
{
    // To create the account SAS, you need to use Shared Key credentials. Modify for your account.
    const string ConnectionString = "DefaultEndpointsProtocol=https;AccountName=<storage-account>;AccountKey=<account-key>";
    CloudStorageAccount storageAccount = CloudStorageAccount.Parse(ConnectionString);

    // Create a new access policy for the account.
    SharedAccessAccountPolicy policy = new SharedAccessAccountPolicy()
        {
            Permissions = SharedAccessAccountPermissions.Read | SharedAccessAccountPermissions.Write | SharedAccessAccountPermissions.List,
            Services = SharedAccessAccountServices.Blob | SharedAccessAccountServices.File,
            ResourceTypes = SharedAccessAccountResourceTypes.Service,
            SharedAccessExpiryTime = DateTime.UtcNow.AddHours(24),
            Protocols = SharedAccessProtocol.HttpsOnly
        };

    // Return the SAS token.
    return storageAccount.GetSharedAccessSignature(policy);
}

Use an account SAS from a client

To use the account SAS to access service-level APIs for the Blob service, construct a Blob service client object using the SAS and the Blob storage endpoint for your storage account.

.NET v12 SDK

private static void UseAccountSAS(Uri blobServiceUri, string sasToken)
{
    var blobServiceClient = new BlobServiceClient
        (new Uri($"{blobServiceUri}?{sasToken}"), null);

    BlobRetentionPolicy retentionPolicy = new BlobRetentionPolicy();
    retentionPolicy.Enabled = true;
    retentionPolicy.Days = 7;

    blobServiceClient.SetProperties(new BlobServiceProperties()
    {
        HourMetrics = new BlobMetrics()
        {
            RetentionPolicy = retentionPolicy,
            Version = "1.0"
        },
        MinuteMetrics = new BlobMetrics()
        {
            RetentionPolicy = retentionPolicy,
            Version = "1.0"
        },
        Logging = new BlobAnalyticsLogging()
        {
            Write = true,
            Read = true,
            Delete = true,
            RetentionPolicy = retentionPolicy,
            Version = "1.0"
        }
    });

    // The permissions granted by the account SAS also permit you to retrieve service properties.

    BlobServiceProperties serviceProperties = blobServiceClient.GetProperties().Value;
    Console.WriteLine(serviceProperties.HourMetrics.RetentionPolicy);
    Console.WriteLine(serviceProperties.HourMetrics.Version);
}

.NET v11 SDK

In this snippet, replace the <storage-account> placeholder with the name of your storage account.

static void UseAccountSAS(string sasToken)
{
    // Create new storage credentials using the SAS token.
    StorageCredentials accountSAS = new StorageCredentials(sasToken);
    // Use these credentials and the account name to create a Blob service client.
    CloudStorageAccount accountWithSAS = new CloudStorageAccount(accountSAS, "<storage-account>", endpointSuffix: null, useHttps: true);
    CloudBlobClient blobClientWithSAS = accountWithSAS.CreateCloudBlobClient();

    // Now set the service properties for the Blob client created with the SAS.
    blobClientWithSAS.SetServiceProperties(new ServiceProperties()
    {
        HourMetrics = new MetricsProperties()
        {
            MetricsLevel = MetricsLevel.ServiceAndApi,
            RetentionDays = 7,
            Version = "1.0"
        },
        MinuteMetrics = new MetricsProperties()
        {
            MetricsLevel = MetricsLevel.ServiceAndApi,
            RetentionDays = 7,
            Version = "1.0"
        },
        Logging = new LoggingProperties()
        {
            LoggingOperations = LoggingOperations.All,
            RetentionDays = 14,
            Version = "1.0"
        }
    });

    // The permissions granted by the account SAS also permit you to retrieve service properties.
    ServiceProperties serviceProperties = blobClientWithSAS.GetServiceProperties();
    Console.WriteLine(serviceProperties.HourMetrics.MetricsLevel);
    Console.WriteLine(serviceProperties.HourMetrics.RetentionDays);
    Console.WriteLine(serviceProperties.HourMetrics.Version);
}

Next steps

• Grant limited access to Azure Storage resources using shared access signatures (SAS)
• Create an account SAS