You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/cognitive-services/Translator/document-translation/how-to-guides/create-sas-tokens.md
+9-9Lines changed: 9 additions & 9 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -5,7 +5,7 @@ ms.topic: how-to
5
5
manager: nitinme
6
6
ms.author: lajanuar
7
7
author: laujan
8
-
ms.date: 05/27/2022
8
+
ms.date: 12/17/2022
9
9
---
10
10
11
11
# Create SAS tokens for your storage containers
@@ -18,7 +18,7 @@ At a high level, here's how SAS tokens work:
18
18
19
19
* If the storage service verifies that the SAS is valid, the request is authorized.
20
20
21
-
* If the SAS token is deemed invalid, the request is declined and the error code 403 (Forbidden) is returned.
21
+
* If the SAS token is deemed invalid, the request is declined, and the error code 403 (Forbidden) is returned.
22
22
23
23
Azure Blob Storage offers three resource types:
24
24
@@ -42,14 +42,14 @@ To get started, you'll need the following resources:
42
42
43
43
* A **standard performance**[Azure Blob Storage account](https://portal.azure.com/#create/Microsoft.StorageAccount-ARM). You'll create containers to store and organize your files within your storage account. If you don't know how to create an Azure storage account with a storage container, follow these quickstarts:
44
44
45
-
*[Create a storage account](../../../storage/common/storage-account-create.md). When you create your storage account, select **Standard** performance in the **Instance details** > **Performance** field.
46
-
*[Create a container](../../../storage/blobs/storage-quickstart-blobs-portal.md#create-a-container). When you create your container, set **Public access level** to **Container** (anonymous read access for containers and files) in the **New Container** window.
45
+
*[Create a storage account](../../../../storage/common/storage-account-create.md). When you create your storage account, select **Standard** performance in the **Instance details** > **Performance** field.
46
+
*[Create a container](../../../../storage/blobs/storage-quickstart-blobs-portal.md#create-a-container). When you create your container, set **Public access level** to **Container** (anonymous read access for containers and files) in the **New Container** window.
47
47
48
48
## Create SAS tokens in the Azure portal
49
49
50
50
<!-- markdownlint-disable MD024 -->
51
51
52
-
Go to the [Azure portal](https://portal.azure.com/#home) and navigate to your container or a specific file as follows and continue with the steps below:
52
+
Go to the [Azure portal](https://portal.azure.com/#home) and navigate to your container or a specific file as follows and continue with these steps:
53
53
54
54
| Create SAS token for a container| Create SAS token for a specific file|
55
55
|:-----:|:-----:|
@@ -87,9 +87,9 @@ Go to the [Azure portal](https://portal.azure.com/#home) and navigate to your co
87
87
88
88
Azure Storage Explorer is a free standalone app that enables you to easily manage your Azure cloud storage resources from your desktop.
89
89
90
-
* You'll need the [**Azure Storage Explorer**](../../../vs-azure-tools-storage-manage-with-storage-explorer.md) app installed in your Windows, macOS, or Linux development environment.
90
+
* You'll need the [**Azure Storage Explorer**](../../../../vs-azure-tools-storage-manage-with-storage-explorer.md) app installed in your Windows, macOS, or Linux development environment.
91
91
92
-
* After the Azure Storage Explorer app is installed, [connect it to the storage account](../../../vs-azure-tools-storage-manage-with-storage-explorer.md?tabs=windows#connect-to-a-storage-account-or-service) you're using for Document Translation. Follow the steps below to create tokens for a storage container or specific blob file:
92
+
* After the Azure Storage Explorer app is installed, [connect it to the storage account](../../../../vs-azure-tools-storage-manage-with-storage-explorer.md?tabs=windows#connect-to-a-storage-account-or-service) you're using for Document Translation. Follow these steps to create tokens for a storage container or specific blob file:
93
93
94
94
### [SAS tokens for storage containers](#tab/Containers)
95
95
@@ -141,7 +141,7 @@ You can include your SAS URL with REST API requests in two ways:
141
141
142
142
* Append the **SAS query string** to your existing sourceURL and targetURL values.
143
143
144
-
Here is a sample REST API request:
144
+
Here's a sample REST API request:
145
145
146
146
```json
147
147
{
@@ -171,5 +171,5 @@ That's it! You've learned how to create SAS tokens to authorize how clients acce
171
171
## Next steps
172
172
173
173
> [!div class="nextstepaction"]
174
-
> [Get Started with Document Translation](get-started-with-document-translation.md)
174
+
> [Get Started with Document Translation](../quickstarts/get-started-with-rest-api.md)
Copy file name to clipboardExpand all lines: articles/cognitive-services/Translator/document-translation/how-to-guides/create-use-managed-identities.md
+22-23Lines changed: 22 additions & 23 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -7,7 +7,7 @@ manager: nitinme
7
7
ms.service: cognitive-services
8
8
ms.subservice: translator-text
9
9
ms.topic: how-to
10
-
ms.date: 02/28/2022
10
+
ms.date: 12/17/2022
11
11
ms.author: lajanuar
12
12
---
13
13
@@ -24,7 +24,7 @@ Managed identities for Azure resources are service principals that create an Azu
24
24
25
25
* You can use managed identities to grant access to any resource that supports Azure AD authentication, including your own applications. Managed identities eliminate the need for you to include shared access signature tokens (SAS) with your HTTP requests.
26
26
27
-
* To grant access to an Azure resource, you'll assign an Azure role to a managed identity using [Azure role-based access control (Azure RBAC)](../../../role-based-access-control/overview.md).
27
+
* To grant access to an Azure resource, you'll assign an Azure role to a managed identity using [Azure role-based access control (`Azure RBAC`)](../../../../role-based-access-control/overview.md).
28
28
29
29
* There's no added cost to use managed identities in Azure.
30
30
@@ -34,29 +34,28 @@ Managed identities for Azure resources are service principals that create an Azu
34
34
>
35
35
> * Managed identities are a safer way to grant access to data without having SAS tokens included with your HTTP requests.
36
36
37
-
38
37
## Prerequisites
39
38
To get started, you'll need:
40
39
41
40
* An active [**Azure account**](https://azure.microsoft.com/free/cognitive-services/)—if you don't have one, you can [**create a free account**](https://azure.microsoft.com/free/).
42
41
43
-
* A [**single-service Translator**](https://portal.azure.com/#create/Microsoft.CognitiveServicesTextTranslation) (not a multi-service Cognitive Services) resource assigned to a **non-global** region. For detailed steps, _see_[Create a Cognitive Services resource using the Azure portal](../../cognitive-services-apis-create-account.md?tabs=multiservice%2cwindows).
42
+
* A [**single-service Translator**](https://portal.azure.com/#create/Microsoft.CognitiveServicesTextTranslation) (not a multi-service Cognitive Services) resource assigned to a **non-global** region. For detailed steps, _see_[Create a Cognitive Services resource using the Azure portal](../../../cognitive-services-apis-create-account.md?tabs=multiservice%2cwindows).
44
43
45
-
* A brief understanding of [**Azure role-based access control (Azure RBAC)**](../../../role-based-access-control/role-assignments-portal.md) using the Azure portal.
44
+
* A brief understanding of [**Azure role-based access control (`Azure RBAC`)**](../../../../role-based-access-control/role-assignments-portal.md) using the Azure portal.
46
45
47
46
* An [**Azure blob storage account**](https://portal.azure.com/#create/Microsoft.StorageAccount-ARM) in the same region as your Translator resource. You'll create containers to store and organize your blob data within your storage account.
48
47
49
48
***If your storage account is behind a firewall, you must enable the following configuration**: </br>
50
49
51
50
* On your storage account page, select **Security + networking** → **Networking** from the left menu.
* In the main window, select **Allow access from Selected networks**.
55
-
:::image type="content" source="../media/managed-identities/firewalls-and-virtual-networks.png" alt-text="Screenshot: Selected networks radio button selected.":::
54
+
:::image type="content" source="../../media/managed-identities/firewalls-and-virtual-networks.png" alt-text="Screenshot: Selected networks radio button selected.":::
56
55
57
-
* On the selected networks page, navigate to the **Exceptions** category and make certain that the [**Allow Azure services on the trusted services list to access this storage account**](../../../storage/common/storage-network-security.md?tabs=azure-portal#manage-exceptions) checkbox is enabled.
56
+
* On the selected networks page, navigate to the **Exceptions** category and make certain that the [**Allow Azure services on the trusted services list to access this storage account**](../../../../storage/common/storage-network-security.md?tabs=azure-portal#manage-exceptions) checkbox is enabled.
@@ -72,35 +71,35 @@ In the following steps, we'll enable a system-assigned managed identity and gran
72
71
73
72
>[!IMPORTANT]
74
73
>
75
-
> To enable a system-assigned managed identity, you need **Microsoft.Authorization/roleAssignments/write** permissions, such as [**Owner**](../../../role-based-access-control/built-in-roles.md#owner) or [**User Access Administrator**](../../../role-based-access-control/built-in-roles.md#user-access-administrator). You can specify a scope at four levels: management group, subscription, resource group, or resource.
74
+
> To enable a system-assigned managed identity, you need **Microsoft.Authorization/roleAssignments/write** permissions, such as [**Owner**](../../../../role-based-access-control/built-in-roles.md#owner) or [**User Access Administrator**](../../../../role-based-access-control/built-in-roles.md#user-access-administrator). You can specify a scope at four levels: management group, subscription, resource group, or resource.
76
75
77
76
1. Sign in to the [Azure portal](https://portal.azure.com) using an account associated with your Azure subscription.
78
77
79
78
1. Navigate to your **Translator** resource page in the Azure portal.
80
79
81
80
1. In the left rail, select **Identity** from the **Resource Management** list:
82
81
83
-
:::image type="content" source="../media/managed-identities/resource-management-identity-tab.png" alt-text="Screenshot: resource management identity tab in the Azure portal.":::
82
+
:::image type="content" source="../../media/managed-identities/resource-management-identity-tab.png" alt-text="Screenshot: resource management identity tab in the Azure portal.":::
84
83
85
84
1. In the main window, toggle the **System assigned Status** tab to **On**.
86
85
87
86
## Grant access to your storage account
88
87
89
-
You need to grant Translator access to your storage account before it can create, read, or delete blobs. Once you've enabled Translator with a system-assigned managed identity, you can use Azure role-based access control (Azure RBAC), to give Translator access to your Azure storage containers.
88
+
You need to grant Translator access to your storage account before it can create, read, or delete blobs. Once you've enabled Translator with a system-assigned managed identity, you can use Azure role-based access control (`Azure RBAC`), to give Translator access to your Azure storage containers.
90
89
91
90
The **Storage Blob Data Contributor** role gives Translator (represented by the system-assigned managed identity) read, write, and delete access to the blob container and data.
92
91
93
92
1. Under **Permissions** select **Azure role assignments**:
1. An Azure role assignments page will open. Choose your subscription from the drop-down menu then select **+ Add role assignment**.
98
97
99
-
:::image type="content" source="../media/managed-identities/azure-role-assignments-page-portal.png" alt-text="Screenshot: Azure role assignments page in the Azure portal.":::
98
+
:::image type="content" source="../../media/managed-identities/azure-role-assignments-page-portal.png" alt-text="Screenshot: Azure role assignments page in the Azure portal.":::
100
99
101
100
>[!NOTE]
102
101
>
103
-
> If you are unable to assign a role in the Azure portal because the Add > Add role assignment option is disabled or get the permissions error, "you do not have permissions to add role assignment at this scope", check that you are currently signed in as a user with an assigned a role that has Microsoft.Authorization/roleAssignments/write permissions such as [**Owner**](../../../role-based-access-control/built-in-roles.md#owner) or [**User Access Administrator**](../../../role-based-access-control/built-in-roles.md#user-access-administrator) at the storage scope for the storage resource.
102
+
> If you are unable to assign a role in the Azure portal because the Add > Add role assignment option is disabled or get the permissions error, "you do not have permissions to add role assignment at this scope", check that you are currently signed in as a user with an assigned a role that has Microsoft.Authorization/roleAssignments/write permissions such as [**Owner**](../../../../role-based-access-control/built-in-roles.md#owner) or [**User Access Administrator**](../../../../role-based-access-control/built-in-roles.md#user-access-administrator) at the storage scope for the storage resource.
104
103
105
104
1. Next, you're going to assign a **Storage Blob Data Contributor** role to your Translator service resource. In the **Add role assignment** pop-up window, complete the fields as follows and select **Save**:
106
105
@@ -111,21 +110,21 @@ The **Storage Blob Data Contributor** role gives Translator (represented by the
111
110
|**Resource**|**_The name of your storage resource_**.|
112
111
|**Role**|**_Storage Blob Data Contributor_**.|
113
112
114
-
:::image type="content" source="../media/managed-identities/add-role-assignment-window.png" alt-text="Screenshot: add role assignments page in the Azure portal.":::
113
+
:::image type="content" source="../../media/managed-identities/add-role-assignment-window.png" alt-text="Screenshot: add role assignments page in the Azure portal.":::
115
114
116
115
1. After you've received the _Added Role assignment_ confirmation message, refresh the page to see the added role assignment.
117
116
118
-
:::image type="content" source="../media/managed-identities/add-role-assignment-confirmation.png" alt-text="Screenshot: Added role assignment confirmation pop-up message.":::
117
+
:::image type="content" source="../../media/managed-identities/add-role-assignment-confirmation.png" alt-text="Screenshot: Added role assignment confirmation pop-up message.":::
119
118
120
119
1. If you don't see the change right away, wait and try refreshing the page once more. When you assign or remove role assignments, it can take up to 30 minutes for changes to take effect.
121
120
122
-
:::image type="content" source="../media/managed-identities/assigned-roles-window.png" alt-text="Screenshot: Azure role assignments window.":::
121
+
:::image type="content" source="../../media/managed-identities/assigned-roles-window.png" alt-text="Screenshot: Azure role assignments window.":::
123
122
124
123
## HTTP requests
125
124
126
125
* A batch Document Translation request is submitted to your Translator service endpoint via a POST request.
127
126
128
-
* With managed identity and Azure RBAC, you'll no longer need to include SAS URLs.
127
+
* With managed identity and `Azure RBAC`, you'll no longer need to include SAS URLs.
129
128
130
129
* If successful, the POST method returns a `202 Accepted` response code and the batch request is created by the service.
131
130
@@ -177,7 +176,7 @@ The following headers are included with each Document Translation API request:
177
176
### Translate a specific document in a container
178
177
179
178
***Required**: "storageType": "File"
180
-
*The sample request below shows a single document getting translated into two target languages
179
+
*This sample request returns a single document translated into two target languages:
181
180
182
181
```json
183
182
{
@@ -231,16 +230,16 @@ The following headers are included with each Document Translation API request:
231
230
}
232
231
```
233
232
234
-
Great! You've learned how to enable and use a system-assigned managed identity. With managed identity for Azure Resources and Azure RBAC, you granted Translator specific access rights to your storage resource without including SAS tokens with your HTTP requests.
233
+
Great! You've learned how to enable and use a system-assigned managed identity. With managed identity for Azure Resources and `Azure RBAC`, you granted Translator specific access rights to your storage resource without including SAS tokens with your HTTP requests.
235
234
236
235
## Next steps
237
236
238
237
**Quickstart**
239
238
240
239
> [!div class="nextstepaction"]
241
-
> [Get started with Document Translation](get-started-with-document-translation.md)
240
+
> [Get started with Document Translation](../quickstarts/get-started-with-rest-api.md)
242
241
243
242
**Tutorial**
244
243
245
244
> [!div class="nextstepaction"]
246
-
> [Access Azure Storage from a web app using managed identities](../../../app-service/scenario-secure-app-access-storage.md?bc=%2fazure%2fcognitive-services%2ftranslator%2fbreadcrumb%2ftoc.json&toc=%2fazure%2fcognitive-services%2ftranslator%2ftoc.json)
245
+
> [Access Azure Storage from a web app using managed identities](../../../../app-service/scenario-secure-app-access-storage.md?bc=%2fazure%2fcognitive-services%2ftranslator%2fbreadcrumb%2ftoc.json&toc=%2fazure%2fcognitive-services%2ftranslator%2ftoc.json)
0 commit comments