Skip to content

Commit d997647

Browse files
denreadenrea
authored
Merge pull request #288446 from pauljewellmsft/govt-docs
Update code samples for DAC auth
2 parents d2c4dca + 46d6402 commit d997647

File tree

1 file changed

+236
-80
lines changed

1 file changed

+236
-80
lines changed

‎articles/azure-government/documentation-government-get-started-connect-to-storage.md

Lines changed: 236 additions & 80 deletions
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ ms.service: azure-government
55
ms.topic: article
66
author: yujhongmicrosoft
77
ms.author: eliotgra
8-
ms.date: 10/01/2021
8+
ms.date: 10/16/2024
99
---
1010

1111
# Develop with Storage API on Azure Government
@@ -42,101 +42,257 @@ For more information about Azure Storage Explorer, see [Get started with Storage
4242

4343
### Getting Started with Storage API
4444

45-
One important difference to remember when connecting with the Storage API is that the URL for storage in Azure Government is different than the URL for storage in commercial Azure. Specifically, the domain ends with "core.usgovcloudapi.net", rather than "core.windows.net".
45+
One important difference to remember when connecting with the Storage API is that the URL for storage in Azure Government is different than the URL for storage in commercial Azure. Specifically, the domain ends with `core.usgovcloudapi.net`, rather than `core.windows.net`. These endpoint differences must be taken into account when you connect to storage in Azure Government with a client library.
4646

47-
These endpoint differences must be taken into account when you connect to storage in Azure Government with C#.
48-
1. Go to the [Azure Government portal](https://portal.azure.us) and select your storage account and then click the "Access Keys" tab:
47+
Application requests to Azure Storage must be authorized. Using the `DefaultAzureCredential` class provided by the Azure Identity client library is the recommended approach for implementing passwordless connections to Azure services in your code.
4948

50-
![storage4](./media/documentation-government-get-started-connect-with-storage-img4.png)
51-
2. Copy/paste the storage account connection string.
49+
You can also authorize requests to Azure Storage by using the account access key. However, this approach should be used with caution. Developers must be diligent to never expose the access key in an unsecure location. Anyone who has the access key is able to authorize requests against the storage account, and effectively has access to all the data. `DefaultAzureCredential` offers improved management and security benefits over the account key to allow passwordless authentication. Both options are demonstrated in the following examples.
5250

53-
#### C#
51+
#### C#/.NET
5452

55-
1. Open Visual Studio and create a new project. Add a reference to the [Azure Tables client library for .NET](https://github.com/Azure/azure-sdk-for-net/tree/main/sdk/tables/Azure.Data.Tables). This package contains classes for connecting to your Storage Table account.
53+
Open Visual Studio and create a new project. Add a reference to the [Azure Tables client library for .NET](https://github.com/Azure/azure-sdk-for-net/tree/main/sdk/tables/Azure.Data.Tables). This package contains classes for connecting to your Storage Table account.
5654

57-
2. Add these two lines of C# code to connect:
55+
#### [Passwordless (recommended)](#tab/passwordless)
5856

59-
```cs
60-
var credentials = new TableSharedKeyCredential(storageAccountName, Environment.GetEnvironmentVariable("STORAGE_ACCOUNT_KEY"));
61-
var storageTableUri = Environment.GetEnvironmentVariable("STORAGE_TABLE_URI");
62-
var tableServiceClient = new TableServiceClient(new Uri(storageTableUri), credentials);
63-
```
57+
An easy and secure way to authorize access and connect to Azure Storage is to obtain an OAuth token by creating a [DefaultAzureCredential](/dotnet/api/azure.identity.defaultazurecredential) instance. You can then use that credential to create a `TableServiceClient` object, as shown in the following code example:
6458

65-
3. At this point, we can interact with Storage as we normally would. For example, if we want to retrieve a specific entity from our Table Storage, we could do it like this:
59+
```csharp
60+
var credentialOptions = new DefaultAzureCredentialOptions()
61+
{
62+
AuthorityHost = AzureAuthorityHosts.AzureGovernment,
63+
};
6664

67-
```cs
68-
var tableClient = tableServiceClient.GetTableClient("Contacts");
69-
ContactEntity contact = tableClient.GetEntity<ContactEntity>("gov-partition1", "0fb52a6c-3784-4dc5-aa6d-ecda4426dbda");
70-
Console.WriteLine($"Contact: {contact.FirstName} {contact.LastName}");
71-
```
65+
var credential = new DefaultAzureCredential(credentialOptions);
66+
var storageTableUri = Environment.GetEnvironmentVariable("STORAGE_TABLE_URI");
67+
var tableServiceClient = new TableServiceClient(
68+
new Uri(storageTableUri)
69+
credential);
70+
```
71+
72+
To learn more about authorizing access to data in Azure Storage, see [Authenticate to Azure and authorize access to data](../../articles/storage/blobs/storage-quickstart-blobs-dotnet.md#authenticate-to-azure-and-authorize-access-to-blob-data).
73+
74+
#### [Connection string](#tab/connectionstring)
75+
76+
Add these lines of C# code to connect using a connection string:
77+
78+
```csharp
79+
var connectionString = Environment.GetEnvironmentVariable("AZURE_STORAGE_CONNECTION_STRING");
80+
var tableServiceClient = new TableServiceClient(connectionString);
81+
```
82+
83+
You can also connect using an account key, as shown in the following code example:
84+
85+
```csharp
86+
var credentials = new TableSharedKeyCredential(
87+
storageAccountName,
88+
Environment.GetEnvironmentVariable("STORAGE_ACCOUNT_KEY"));
89+
var storageTableUri = Environment.GetEnvironmentVariable("STORAGE_TABLE_URI");
90+
var tableServiceClient = new TableServiceClient(new Uri(storageTableUri), credentials);
91+
```
92+
93+
> [!IMPORTANT]
94+
> The account access key should be used with caution. If your account access key is lost or accidentally placed in an insecure location, your service may become vulnerable. Anyone who has the access key is able to authorize requests against the storage account, and effectively has access to all the data. `DefaultAzureCredential` provides enhanced security features and benefits and is the recommended approach for managing authorization to Azure services.
95+
96+
---
97+
98+
At this point, we can interact with Storage as we normally would. The following example shows how to retrieve a specific entity from Table Storage:
99+
100+
```csharp
101+
var tableClient = tableServiceClient.GetTableClient("Contacts");
102+
ContactEntity contact = tableClient.GetEntity<ContactEntity>("gov-partition-test", "0abc123e-1111-1a2b-3c4d-fghi5678j9k0");
103+
Console.WriteLine($"Contact: {contact.FirstName} {contact.LastName}");
104+
```
72105

73106
#### Java
74-
1. Download the [Azure Tables client library for Java](https://github.com/Azure/azure-sdk-for-java/tree/main/sdk/tables/azure-data-tables) and configure your project correctly.
75-
2. Create a "test" class where we'll access Azure Table Storage using the Azure Tables client library.
76-
77-
Copy and paste the code below, and **paste** your Storage Account connection string into the `AZURE_STORAGE_CONNECTION_STRING` environment variable.
78-
79-
```java
80-
import com.azure.data.tables.implementation.ModelHelper;
81-
import com.azure.data.tables.models.*;
82-
import java.util.HashMap;
83-
public class test {
84-
public static final String storageConnectionString = System.getEnv("AZURE_STORAGE_CONNECTION_STRING");
85-
public static void main(String[] args) {
86-
try
87-
{
88-
// Create the table service client.
89-
TableServiceClient tableServiceClient = new TableServiceClientBuilder()
90-
.connectionString(storageConnectionString)
91-
.buildClient();
92-
// Create the table if it doesn't exist.
93-
String tableName = "Contacts";
94-
TableClient tableClient = tableServiceClient.createTableIfNotExists(tableName);
95-
// Create a new customer entity.
96-
TableEntity customer1 = ModelHelper.createEntity(new HashMap<String, Object>() {{
97-
put("PartitionKey", "Brown");
98-
put("RowKey", "Walter");
99-
put("Email", "[email protected]");
100-
}});
101-
// Insert table entry into table
102-
tableClient.createEntity(customer1);
103-
}
104-
catch (Exception e)
105-
{
106-
// Output the stack trace.
107-
e.printStackTrace();
108-
}
109-
}
107+
108+
Download the [Azure Tables client library for Java](https://github.com/Azure/azure-sdk-for-java/tree/main/sdk/tables/azure-data-tables) and configure your project correctly.
109+
110+
#### [Passwordless (recommended)](#tab/passwordless)
111+
112+
An easy and secure way to authorize access and connect to Azure Storage is to obtain an OAuth token by creating a [DefaultAzureCredential](/java/api/overview/azure/identity-readme#defaultazurecredential) instance. You can then use that credential to create a `TableServiceClient` object, as shown in the following code example:
113+
114+
```java
115+
import com.azure.data.tables.implementation.ModelHelper;
116+
import com.azure.data.tables.models.*;
117+
import java.util.HashMap;
118+
public class test {
119+
public static final String storageConnectionString = System.getEnv("AZURE_STORAGE_CONNECTION_STRING");
120+
public static void main(String[] args) {
121+
try
122+
{
123+
DefaultAzureCredential credential = new DefaultAzureCredentialBuilder()
124+
.authorityHost("https://management.usgovcloudapi.net/.default")
125+
.build();
126+
127+
// Create the table service client.
128+
TableServiceClient tableServiceClient = new TableServiceClientBuilder()
129+
.endpoint("https://<storage-account-name>.table.core.usgovcloudapi.net/")
130+
.credential(credential)
131+
.buildClient();
132+
133+
// Create the table if it doesn't exist.
134+
String tableName = "Contacts";
135+
TableClient tableClient = tableServiceClient.createTableIfNotExists(tableName);
136+
// Create a new customer entity.
137+
TableEntity customer1 = ModelHelper.createEntity(new HashMap<String, Object>() {{
138+
put("PartitionKey", "Brown");
139+
put("RowKey", "Walter");
140+
put("Email", "[email protected]");
141+
}});
142+
// Insert table entry into table
143+
tableClient.createEntity(customer1);
144+
}
145+
catch (Exception e)
146+
{
147+
// Output the stack trace.
148+
e.printStackTrace();
149+
}
150+
}
151+
}
152+
```
153+
154+
To learn more about authorizing access to data in Azure Storage, see [Authenticate to Azure and authorize access to data](../../articles/storage/blobs/storage-quickstart-blobs-java.md#authenticate-to-azure-and-authorize-access-to-blob-data).
155+
156+
#### [Connection string](#tab/connectionstring)
157+
158+
Create a "test" class where we'll access Azure Table Storage using the Azure Tables client library.
159+
160+
Copy and paste the code below, and **paste** your Storage Account connection string into the `AZURE_STORAGE_CONNECTION_STRING` environment variable.
161+
162+
```java
163+
import com.azure.data.tables.implementation.ModelHelper;
164+
import com.azure.data.tables.models.*;
165+
import java.util.HashMap;
166+
public class test {
167+
public static final String storageConnectionString = System.getEnv("AZURE_STORAGE_CONNECTION_STRING");
168+
public static void main(String[] args) {
169+
try
170+
{
171+
// Create the table service client.
172+
TableServiceClient tableServiceClient = new TableServiceClientBuilder()
173+
.connectionString(storageConnectionString)
174+
.buildClient();
175+
// Create the table if it doesn't exist.
176+
String tableName = "Contacts";
177+
TableClient tableClient = tableServiceClient.createTableIfNotExists(tableName);
178+
// Create a new customer entity.
179+
TableEntity customer1 = ModelHelper.createEntity(new HashMap<String, Object>() {{
180+
put("PartitionKey", "Brown");
181+
put("RowKey", "Walter");
182+
put("Email", "[email protected]");
183+
}});
184+
// Insert table entry into table
185+
tableClient.createEntity(customer1);
186+
}
187+
catch (Exception e)
188+
{
189+
// Output the stack trace.
190+
e.printStackTrace();
110191
}
111-
```
192+
}
193+
}
194+
```
195+
196+
> [!IMPORTANT]
197+
> The account access key should be used with caution. If your account access key is lost or accidentally placed in an insecure location, your service may become vulnerable. Anyone who has the access key is able to authorize requests against the storage account, and effectively has access to all the data. `DefaultAzureCredential` provides enhanced security features and benefits and is the recommended approach for managing authorization to Azure services.
198+
199+
---
112200

113201
#### Node.js
114-
1. Download the [Azure Storage Blob client library for Node.js](https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/storage/storage-blob) and configure your application correctly.
115-
2. The following code below connects to Azure Blob Storage and creates a Container using the Azure Storage API.
116-
**Paste** your Azure Storage account connection string into the `AZURE_STORAGE_CONNECTION_STRING` environment variable.
117-
118-
```javascript
119-
var { BlobServiceClient } = require("@azure/storage-blob");
120-
var storageConnectionString = process.env["AZURE_STORAGE_CONNECTION_STRING"];
121-
var blobServiceClient = BlobServiceClient.fromConnectionString(storageConnectionString);
122-
var containerClient = blobServiceClient.getContainerClient('testing');
123-
containerClient.createIfNotExists();
124-
```
202+
203+
Download the [Azure Storage Blob client library for Node.js](https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/storage/storage-blob) and configure your application correctly.
204+
205+
#### [Passwordless (recommended)](#tab/passwordless)
206+
207+
An easy and secure way to authorize access and connect to Azure Storage is to obtain an OAuth token by creating a [DefaultAzureCredential](/javascript/api/overview/azure/identity-readme#defaultazurecredential) instance. You can then use that credential to create a `BlobServiceClient` object, as shown in the following code example:
208+
209+
```javascript
210+
const { BlobServiceClient } = require('@azure/storage-blob');
211+
const {
212+
DefaultAzureCredential,
213+
DefaultAzureCredentialOptions,
214+
AzureAuthorityHosts
215+
} = require('@azure/identity');
216+
217+
const credentialOptions = new DefaultAzureCredentialOptions(
218+
{
219+
authorityHost: AzureAuthorityHosts.AzureGovernment
220+
}
221+
);
222+
223+
const blobServiceClient = new BlobServiceClient(
224+
`https://<storage-account-name>.blob.core.usgovcloudapi.net`,
225+
new DefaultAzureCredential(credentialOptions)
226+
);
227+
228+
var containerClient = blobServiceClient.getContainerClient('testing');
229+
containerClient.createIfNotExists();
230+
```
231+
232+
To learn more about authorizing access to data in Azure Storage, see [Authenticate to Azure and authorize access to data](../../articles/storage/blobs/storage-quickstart-blobs-nodejs.md#authenticate-to-azure-and-authorize-access-to-blob-data).
233+
234+
#### [Connection string](#tab/connectionstring)
235+
236+
The following code below connects to Azure Blob Storage and creates a Container using the Azure Storage API.
237+
**Paste** your Azure Storage account connection string into the `AZURE_STORAGE_CONNECTION_STRING` environment variable.
238+
239+
```javascript
240+
var { BlobServiceClient } = require("@azure/storage-blob");
241+
var storageConnectionString = process.env["AZURE_STORAGE_CONNECTION_STRING"];
242+
var blobServiceClient = BlobServiceClient.fromConnectionString(storageConnectionString);
243+
var containerClient = blobServiceClient.getContainerClient('testing');
244+
containerClient.createIfNotExists();
245+
```
246+
247+
> [!IMPORTANT]
248+
> The account access key should be used with caution. If your account access key is lost or accidentally placed in an insecure location, your service may become vulnerable. Anyone who has the access key is able to authorize requests against the storage account, and effectively has access to all the data. `DefaultAzureCredential` provides enhanced security features and benefits and is the recommended approach for managing authorization to Azure services.
249+
250+
---
125251

126252
#### Python
127-
1. Download the [Azure Storage Blob client library for Python](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/storage/azure-storage-blob).
128-
2. When using the Storage library for Python to connect to Azure Government, paste your Azure storage connection string in the `AZURE_STORAGE_CONNECTION_STRING` environment variable.
253+
254+
Download the [Azure Storage Blob client library for Python](https://github.com/Azure/azure-sdk-for-python/tree/main/sdk/storage/azure-storage-blob).
255+
256+
#### [Passwordless (recommended)](#tab/passwordless)
257+
258+
An easy and secure way to authorize access and connect to Azure Storage is to obtain an OAuth token by creating a [DefaultAzureCredential](/python/api/overview/azure/identity-readme#defaultazurecredential) instance. You can then use that credential to create a `BlobServiceClient` object, as shown in the following code example:
259+
260+
```python
261+
from azure.identity import DefaultAzureCredential, AzureAuthorityHosts
262+
from azure.storage.blob import BlobServiceClient
263+
264+
credential = DefaultAzureCredential(authority=AzureAuthorityHosts.AZURE_GOVERNMENT)
265+
266+
blob_service_client = BlobServiceClient("https://<storage-account-name>.blob.core.usgovcloudapi.net", credential=credential)
267+
268+
container_name ="<container-name>"
269+
container = blob_service_client.get_container_client(container=container_name)
270+
generator = container.list_blobs()
271+
for blob in generator:
272+
print("\t Blob name: " + blob.name)
273+
```
274+
275+
To learn more about authorizing access to data in Azure Storage, see [Authenticate to Azure and authorize access to data](../../articles/storage/blobs/storage-quickstart-blobs-python.md#authenticate-to-azure-and-authorize-access-to-blob-data).
276+
277+
#### [Connection string](#tab/connectionstring)
278+
279+
When using the Storage library for Python to connect to Azure Government, paste your Azure storage connection string in the `AZURE_STORAGE_CONNECTION_STRING` environment variable.
129280

130-
```python
131-
# Create the BlobServiceClient that is used to call the Blob service for the storage account
132-
connection_string = os.getenv("AZURE_STORAGE_CONNECTION_STRING")
133-
blob_service_client = BlobServiceClient.from_connection_string(conn_str=connection_string)
134-
container_name ='ml-gov-demo'
135-
container = blob_service_client.get_container_client(container=container_name)
136-
generator = container.list_blobs()
137-
for blob in generator:
138-
print("\t Blob name: " + blob.name)
139-
```
281+
```python
282+
# Create the BlobServiceClient that is used to call the Blob service for the storage account
283+
connection_string = os.getenv("AZURE_STORAGE_CONNECTION_STRING")
284+
blob_service_client = BlobServiceClient.from_connection_string(conn_str=connection_string)
285+
container_name ="<container-name>"
286+
container = blob_service_client.get_container_client(container=container_name)
287+
generator = container.list_blobs()
288+
for blob in generator:
289+
print("\t Blob name: " + blob.name)
290+
```
291+
292+
> [!IMPORTANT]
293+
> The account access key should be used with caution. If your account access key is lost or accidentally placed in an insecure location, your service may become vulnerable. Anyone who has the access key is able to authorize requests against the storage account, and effectively has access to all the data. `DefaultAzureCredential` provides enhanced security features and benefits and is the recommended approach for managing authorization to Azure services.
294+
295+
---
140296

141297
## Next steps
142298

0 commit comments

Comments
 (0)