You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: articles/storage/blobs/sas-service-create-python.md
+36-6Lines changed: 36 additions & 6 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,33 +1,49 @@
1
1
---
2
-
title: Create a service SAS for a blob with Python
2
+
title: Create a service SAS for a container or blob with Python
3
3
titleSuffix: Azure Storage
4
-
description: Learn how to create a service shared access signature (SAS) for a blob using the Azure Blob Storage client library for Python.
4
+
description: Learn how to create a service shared access signature (SAS) for a container or blob using the Azure Blob Storage client library for Python.
This article shows how to use the storage account key to create a service SAS for a blob with the Blob Storage client library for Python.
22
+
This article shows how to use the storage account key to create a service SAS for a container or blob with the Blob Storage client library for Python.
23
23
24
24
## About the service SAS
25
25
26
26
A service SAS is signed with the storage account access key. A service SAS delegates access to a resource in a single Azure Storage service, such as Blob Storage.
27
27
28
28
You can also use a stored access policy to define the permissions and duration of the SAS. If the name of an existing stored access policy is provided, that policy is associated with the SAS. To learn more about stored access policies, see [Define a stored access policy](/rest/api/storageservices/define-stored-access-policy). If no stored access policy is provided, the code examples in this article show how to define permissions and duration for the SAS.
29
29
30
-
## Create a service SAS for a blob
30
+
## Create a service SAS
31
+
32
+
You can create a service SAS for a container or blob, based on the needs of your app.
33
+
34
+
### [Container](#tab/container)
35
+
36
+
You can create a service SAS to delegate limited access to a container resource using the following method:
The storage account access key used to sign the SAS is passed to the method as the `account_key` argument. Allowed permissions are passed to the method as the `permission` argument, and are defined in the [ContainerSasPermissions](/python/api/azure-storage-blob/azure.storage.blob.containersaspermissions) class.
41
+
42
+
The following code example shows how to create a service SAS with read permissions for a container resource:
You can use a service SAS to authorize a client object to perform operations on a container or blob based on the permissions granted by the SAS.
63
+
64
+
### [Container](#tab/container)
65
+
66
+
The following code example shows how to use the service SAS created in the earlier example to authorize a [ContainerClient](/python/api/azure-storage-blob/azure.storage.blob.containerclient) object. This client object can be used to perform operations on the container resource based on the permissions granted by the SAS.
The following code example shows how to use the service SAS created in the earlier example to authorize a [BlobClient](/python/api/azure-storage-blob/azure.storage.blob.blobclient) object. This client object can be used to perform operations on the blob resource based on the permissions granted by the SAS.
Copy file name to clipboardExpand all lines: articles/storage/blobs/storage-blob-user-delegation-sas-create-python.md
+37-7Lines changed: 37 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,35 +1,51 @@
1
1
---
2
-
title: Create a user delegation SAS for a blob with Python
2
+
title: Create a user delegation SAS for a container or blob with Python
3
3
titleSuffix: Azure Storage
4
-
description: Learn how to create a user delegation SAS for a blob with Microsoft Entra credentials by using the Python client library for Blob Storage.
4
+
description: Learn how to create a user delegation SAS for a container or blob with Microsoft Entra credentials by using the Python client library for Blob Storage.
5
5
services: storage
6
6
author: pauljewellmsft
7
7
ms.author: pauljewell
8
8
ms.service: azure-blob-storage
9
9
ms.topic: how-to
10
-
ms.date: 08/05/2024
10
+
ms.date: 09/06/2024
11
11
ms.reviewer: dineshm
12
12
ms.devlang: python
13
13
ms.custom: devx-track-python, devguide-python
14
14
---
15
15
16
-
# Create a user delegation SAS for a blob with Python
16
+
# Create a user delegation SAS for a container or blob with Python
This article shows how to use Microsoft Entra credentials to create a user delegation SAS for a blob using the [Azure Storage client library for Python](/python/api/overview/azure/storage).
22
+
This article shows how to use Microsoft Entra credentials to create a user delegation SAS for a container or blob using the [Azure Storage client library for Python](/python/api/overview/azure/storage).
When a Microsoft Entra security principal attempts to access blob data, that security principal must have permissions to the resource. Whether the security principal is a managed identity in Azure or a Microsoft Entra user account running code in the development environment, the security principal must be assigned an Azure role that grants access to blob data. For information about assigning permissions via Azure RBAC, see [Assign an Azure role for access to blob data](assign-azure-role-data-access.md).
28
+
When a Microsoft Entra security principal attempts to access data, that security principal must have permissions to the resource. Whether the security principal is a managed identity in Azure or a Microsoft Entra user account running code in the development environment, the security principal must be assigned an Azure role that grants access to data. For information about assigning permissions via Azure RBAC, see [Assign an Azure role for access to blob data](assign-azure-role-data-access.md).
You can create a user delegation SAS for a container or blob, based on the needs of your app.
35
+
36
+
### [Container](#tab/container)
37
+
38
+
Once you've obtained the user delegation key, you can create a user delegation SAS. You can create a user delegation SAS to delegate limited access to a container resource using the following method:
The user delegation key to sign the SAS is passed to the method as the `user_delegation_key` argument. Allowed permissions are passed to the method as the `permission` argument, and are defined in the [ContainerSasPermissions](/python/api/azure-storage-blob/azure.storage.blob.containersaspermissions) class.
43
+
44
+
The following code example shows how to create a user delegation SAS for a container:
Once you've obtained the user delegation key, you can create a user delegation SAS. You can create a user delegation SAS to delegate limited access to a blob resource using the following method:
35
51
@@ -41,12 +57,26 @@ The following code example shows how to create a user delegation SAS for a blob:
## Use a user delegation SAS to authorize a client object
45
63
64
+
You can use a user delegation SAS to authorize a client object to perform operations on a container or blob based on the permissions granted by the SAS.
65
+
66
+
### [Container](#tab/container)
67
+
68
+
The following code example shows how to use the user delegation SAS created in the earlier example to authorize a [ContainerClient](/python/api/azure-storage-blob/azure.storage.blob.containerclient) object. This client object can be used to perform operations on the container resource based on the permissions granted by the SAS.
The following code example shows how to use the user delegation SAS created in the earlier example to authorize a [BlobClient](/python/api/azure-storage-blob/azure.storage.blob.blobclient) object. This client object can be used to perform operations on the blob resource based on the permissions granted by the SAS.
0 commit comments