Merge pull request #286297 from pauljewellmsft/python-sas

[Dev guide] Combine SAS articles for containers and blobs - Python

Author: v-dirichards

articles/storage/.openpublishing.redirection.storage.json

@@ -510,6 +510,16 @@
             "redirect_url": "/azure/storage/blobs/storage-blob-user-delegation-sas-create-java",
             "redirect_document_id": false
         },
+        {
+            "source_path_from_root": "/articles/storage/blobs/sas-service-create-python-container.md",
+            "redirect_url": "/azure/storage/blobs/sas-service-create-python",
+            "redirect_document_id": false
+        },
+        {
+            "source_path_from_root": "/articles/storage/blobs/storage-blob-container-user-delegation-sas-create-python.md",
+            "redirect_url": "/azure/storage/blobs/storage-blob-user-delegation-sas-create-python",
+            "redirect_document_id": false
+        },
         {
             "source_path_from_root": "/articles/storage/common/authorize-active-directory-cli.md",
             "redirect_url": "/azure/storage/common/authorize-data-operations-cli",

articles/storage/blobs/TOC.yml

@@ -891,6 +891,14 @@ items:
               href: /azure/developer/python/sdk/authentication-azure-hosted-apps?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
             - name: Auth from on-premises apps
               href: /azure/developer/python/sdk/authentication-on-premises-apps?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
+          - name: Shared access signature (SAS)
+            items:
+            - name: Authorize using a user delegation SAS
+              href: storage-blob-user-delegation-sas-create-python.md
+            - name: Authorize using a service SAS
+              href: sas-service-create-python.md
+            - name: Authorize using an account SAS
+              href: ../common/storage-account-sas-create-python.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
         - name: Container actions
           items:
           - name: Create a container
@@ -903,14 +911,6 @@ items:
             href: storage-blob-container-lease-python.md
           - name: Manage properties and metadata
             href: storage-blob-container-properties-metadata-python.md
-          - name: Generate a shared access signature (SAS)
-            items:
-            - name: Create a user delegation SAS for a container
-              href: storage-blob-container-user-delegation-sas-create-python.md
-            - name: Create a service SAS for a container
-              href: sas-service-create-python-container.md
-            - name: Create an account SAS
-              href: ../common/storage-account-sas-create-python.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
         - name: Blob actions
           items:
           - name: Upload blobs
@@ -937,14 +937,6 @@ items:
             href: storage-blob-properties-metadata-python.md
           - name: Set or change a blob's access tier
             href: storage-blob-use-access-tier-python.md
-          - name: Generate a shared access signature (SAS)
-            items:
-            - name: Create a user delegation SAS for a blob
-              href: storage-blob-user-delegation-sas-create-python.md
-            - name: Create a service SAS for a blob
-              href: sas-service-create-python.md
-            - name: Create an account SAS
-              href: ../common/storage-account-sas-create-python.md?toc=/azure/storage/blobs/toc.json&bc=/azure/storage/blobs/breadcrumb/toc.json
         - name: Client library configuration options
           items:
           - name: Performance tuning for uploads and downloads

articles/storage/blobs/sas-service-create-python-container.md

@@ -1,33 +1,49 @@
 ---
-title: Create a service SAS for a blob with Python
+title: Create a service SAS for a container or blob with Python
 titleSuffix: Azure Storage
-description: Learn how to create a service shared access signature (SAS) for a blob using the Azure Blob Storage client library for Python.
+description: Learn how to create a service shared access signature (SAS) for a container or blob using the Azure Blob Storage client library for Python.
 author: pauljewellmsft
 
 ms.service: azure-blob-storage
 ms.topic: how-to
-ms.date: 08/05/2024
+ms.date: 09/06/2024
 ms.author: pauljewell
 ms.reviewer: nachakra
 ms.devlang: python
 ms.custom: devx-track-python, devguide-python, engagement-fy23
 ---
 
-# Create a service SAS for a blob with Python
+# Create a service SAS for a container or blob with Python
 
 [!INCLUDE [storage-dev-guide-selector-service-sas](../../../includes/storage-dev-guides/storage-dev-guide-selector-service-sas.md)]
 
 [!INCLUDE [storage-auth-sas-intro-include](../../../includes/storage-auth-sas-intro-include.md)]
 
-This article shows how to use the storage account key to create a service SAS for a blob with the Blob Storage client library for Python.
+This article shows how to use the storage account key to create a service SAS for a container or blob with the Blob Storage client library for Python.
 
 ## About the service SAS
 
 A service SAS is signed with the storage account access key. A service SAS delegates access to a resource in a single Azure Storage service, such as Blob Storage.
 
 You can also use a stored access policy to define the permissions and duration of the SAS. If the name of an existing stored access policy is provided, that policy is associated with the SAS. To learn more about stored access policies, see [Define a stored access policy](/rest/api/storageservices/define-stored-access-policy). If no stored access policy is provided, the code examples in this article show how to define permissions and duration for the SAS.
 
-## Create a service SAS for a blob
+## Create a service SAS
+
+You can create a service SAS for a container or blob, based on the needs of your app.
+
+### [Container](#tab/container)
+
+You can create a service SAS to delegate limited access to a container resource using the following method:
+
+- [generate_container_sas](/python/api/azure-storage-blob/azure.storage.blob#azure-storage-blob-generate-blob-sas)
+
+The storage account access key used to sign the SAS is passed to the method as the `account_key` argument. Allowed permissions are passed to the method as the `permission` argument, and are defined in the [ContainerSasPermissions](/python/api/azure-storage-blob/azure.storage.blob.containersaspermissions) class.
+
+The following code example shows how to create a service SAS with read permissions for a container resource:
+
+:::code language="python" source="~/azure-storage-snippets/blobs/howto/python/blob-devguide-py/blob_devguide_create_sas.py" id="Snippet_create_service_sas_container":::
+
+### [Blob](#tab/blob)
 
 You can create a service SAS to delegate limited access to a blob resource using the following method:
 
@@ -39,12 +55,26 @@ The following code example shows how to create a service SAS with read permissio
 
 :::code language="python" source="~/azure-storage-snippets/blobs/howto/python/blob-devguide-py/blob_devguide_create_sas.py" id="Snippet_create_service_sas_blob":::
 
+---
+
 ## Use a service SAS to authorize a client object
 
+You can use a service SAS to authorize a client object to perform operations on a container or blob based on the permissions granted by the SAS.
+
+### [Container](#tab/container)
+
+The following code example shows how to use the service SAS created in the earlier example to authorize a [ContainerClient](/python/api/azure-storage-blob/azure.storage.blob.containerclient) object. This client object can be used to perform operations on the container resource based on the permissions granted by the SAS.
+
+:::code language="python" source="~/azure-storage-snippets/blobs/howto/python/blob-devguide-py/blob_devguide_create_sas.py" id="Snippet_use_service_sas_container":::
+
+### [Blob](#tab/blob)
+
 The following code example shows how to use the service SAS created in the earlier example to authorize a [BlobClient](/python/api/azure-storage-blob/azure.storage.blob.blobclient) object. This client object can be used to perform operations on the blob resource based on the permissions granted by the SAS.
 
 :::code language="python" source="~/azure-storage-snippets/blobs/howto/python/blob-devguide-py/blob_devguide_create_sas.py" id="Snippet_use_service_sas_blob":::
 
+---
+
 ## Resources
 
 To learn more about using the Azure Blob Storage client library for Python, see the following resources.