You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Your services might require certain passwords, connection strings, and other secrets, such as for databases or other secure Azure services. By setting the values of these secrets in configuration files, you can make them available in your code as environment variables. These must be handled with care to avoid compromising the security of the secrets.
12
12
13
-
Azure Dev Spaces provides two recommended, streamlined options for storing secrets in Helm charts generated by the Azure Dev Spaces client tooling: in the values.dev.yaml file, and inline directly in azds.yaml. It's not recommended to store secrets in values.yaml. Outside of the two approaches for Helm charts generated by the client tooling defined in this article, if you create your own Helm chart, you can use the Helm chart directly to manage and store secrets.
13
+
Azure Dev Spaces provides two recommended, streamlined options for storing secrets in Helm charts generated by the Azure Dev Spaces client tooling: in the `values.dev.yaml` file, and inline directly in `azds.yaml`. It's not recommended to store secrets in `values.yaml`. Outside of the two approaches for Helm charts generated by the client tooling defined in this article, if you create your own Helm chart, you can use the Helm chart directly to manage and store secrets.
14
14
15
15
## Method 1: values.dev.yaml
16
16
1. Open VS Code with your project that is enabled for Azure Dev Spaces.
@@ -56,7 +56,7 @@ Azure Dev Spaces provides two recommended, streamlined options for storing secre
56
56
7. Make sure that you add _values.dev.yaml_ to the _.gitignore_ file to avoid committing secrets in source control.
57
57
58
58
59
-
## Method 2: Inline directly in azds.yaml
59
+
## Method 2: azds.yaml
60
60
1. In _azds.yaml_, set secrets under the yaml section configurations/develop/install. Although you can enter secret values directly there, it's not recommended because _azds.yaml_ is checked into source control. Instead, add placeholders using the "$PLACEHOLDER" syntax.
61
61
62
62
```yaml
@@ -99,6 +99,44 @@ Azure Dev Spaces provides two recommended, streamlined options for storing secre
99
99
kubectl get secret --namespace default -o yaml
100
100
```
101
101
102
+
## Passing secrets as build arguments
103
+
104
+
The previous sections showed how to pass secrets to use at container run time. You can also pass a secret at container build time, such as a password for a private NuGet, using `azds.yaml`.
105
+
106
+
In `azds.yaml`, set the build time secrets in *configurations.develop.build.args* using the `<variable name>: ${secret.<secret name>.<secret key>}` syntax. For example:
In the above example, *mynugetsecret* is an existing secret and *pattoken* is an existing key.
120
+
121
+
>[!NOTE]
122
+
> Secret names and keys may contain the `.` character. Use `\` to escape `.` when passing secrets as build arguments. For example, to pass a secret named *foo.bar* with the key of *token*: `MYTOKEN: ${secret.foo\.bar.token}`. In addition, secrets can be evaluated with prefix and postfix text. For example, `MYURL: eus-${secret.foo\.bar.token}-version1`. Also, secrets available in parent and grandparent spaces can be passed as build arguments.
123
+
124
+
In your Dockerfile, use the *ARG* directive to consume the secret, then use that same variable later in the Dockerfile. For example:
Copy file name to clipboardExpand all lines: articles/storage/blobs/storage-blob-user-delegation-sas-create-dotnet.md
+48-34Lines changed: 48 additions & 34 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,12 +1,12 @@
1
1
---
2
2
title: Create a user delegation SAS for a container or blob with .NET (preview) - Azure Storage
3
-
description: Learn how to create a user delegation SAS using Azure Active Directory credentials in Azure Storage using the .NET client library.
3
+
description: Learn how to create a user delegation SAS (preview) using Azure Active Directory credentials in Azure Storage using the .NET client library.
This article shows how to use Azure Active Directory (Azure AD) credentials to create a user delegation SAS for a container or blob with the Azure Storage client library for .NET.
19
+
This article shows how to use Azure Active Directory (Azure AD) credentials to create a user delegation SAS (preview) for a container or blob with the Azure Storage client library for .NET.
## Authenticate with the Azure Identity library (preview)
23
+
## Authenticate with the Azure Identity library
24
24
25
-
The Azure Identity client library for .NET (preview) authenticates a security principal. When your code is running in Azure, the security principal is a managed identity for Azure resources.
25
+
The Azure Identity client library for .NET authenticates a security principal. When your code is running in Azure, the security principal is a managed identity for Azure resources.
26
26
27
27
When your code is running in the development environment, authentication may be handled automatically, or it may require a browser login, depending on which tools you're using. Microsoft Visual Studio supports single sign-on (SSO), so that the active Azure AD user account is automatically used for authentication. For more information about SSO, see [Single sign-on to applications](../../active-directory/manage-apps/what-is-single-sign-on.md).
28
28
@@ -36,30 +36,30 @@ For more information about the Azure Identity client library, see [Azure Identit
36
36
37
37
When an Azure AD security principal attempts to access blob data, that security principal must have permissions to the resource. Whether the security principal is a managed identity in Azure or an Azure AD user account running code in the development environment, the security principal must be assigned an RBAC role that grants access to blob data in Azure Storage. For information about assigning permissions via RBAC, see the section titled **Assign RBAC roles for access rights** in [Authorize access to Azure blobs and queues using Azure Active Directory](../common/storage-auth-aad.md#assign-rbac-roles-for-access-rights).
38
38
39
-
## Install the preview packages
39
+
## Install the packages
40
40
41
-
The examples in this article use the latest preview version of the [Azure Storage client library for Blob storage](https://www.nuget.org/packages/Azure.Storage.Blobs). To install the preview package, run the following command from the NuGet package manager console:
41
+
The examples in this article use the latest version of the [Azure Storage client library for Blob storage](https://www.nuget.org/packages/Azure.Storage.Blobs). To install the package, run the following command from the NuGet package manager console:
The examples in this article also use the latest preview version of the [Azure Identity client library for .NET](https://www.nuget.org/packages/Azure.Identity/) to authenticate with Azure AD credentials. To install the preview package, run the following command from the NuGet package manager console:
47
+
The examples in this article also use the latest version of the [Azure Identity client library for .NET](https://www.nuget.org/packages/Azure.Identity/) to authenticate with Azure AD credentials. To install the package, run the following command from the NuGet package manager console:
48
48
49
49
```powershell
50
-
Install-Package Azure.Identity -IncludePrerelease
50
+
Install-Package Azure.Identity
51
51
```
52
52
53
53
## Add using directives
54
54
55
-
Add the following `using` directives to your code to use the preview versions of the Azure Identity and Azure Storage client libraries.
55
+
Add the following `using` directives to your code to use the Azure Identity and Azure Storage client libraries.
56
56
57
57
```csharp
58
58
usingSystem;
59
59
usingSystem.IO;
60
60
usingSystem.Threading.Tasks;
61
+
usingAzure;
61
62
usingAzure.Identity;
62
-
usingAzure.Storage;
63
63
usingAzure.Storage.Sas;
64
64
usingAzure.Storage.Blobs;
65
65
usingAzure.Storage.Blobs.Models;
@@ -72,8 +72,10 @@ To get a token credential that your code can use to authorize requests to Azure
72
72
The following code snippet shows how to get the authenticated token credential and use it to create a service client for Blob storage:
73
73
74
74
```csharp
75
+
// Construct the blob endpoint from the account name.
Console.WriteLine("Key signed start: {0}", key.SignedStart);
100
-
Console.WriteLine("Key signed expiry: {0}", key.SignedExpiry);
101
-
Console.WriteLine("Key signed object ID: {0}", key.SignedOid);
102
-
Console.WriteLine("Key signed tenant ID: {0}", key.SignedTid);
104
+
Console.WriteLine("Key signed start: {0}", key.SignedStartsOn);
105
+
Console.WriteLine("Key signed expiry: {0}", key.SignedExpiresOn);
106
+
Console.WriteLine("Key signed object ID: {0}", key.SignedObjectId);
107
+
Console.WriteLine("Key signed tenant ID: {0}", key.SignedTenantId);
103
108
Console.WriteLine("Key signed service: {0}", key.SignedService);
104
109
Console.WriteLine("Key signed version: {0}", key.SignedVersion);
105
110
```
@@ -109,18 +114,23 @@ Console.WriteLine("Key signed version: {0}", key.SignedVersion);
109
114
The following code snippet shows create a new [BlobSasBuilder](/dotnet/api/azure.storage.sas.blobsasbuilder) and provide the parameters for the user delegation SAS. The snippet then calls the [ToSasQueryParameters](/dotnet/api/azure.storage.sas.blobsasbuilder.tosasqueryparameters) to get the SAS token string. Finally, the code builds the complete URI, including the resource address and SAS token.
0 commit comments