Azure Blob 在上传时返回 403

Question

我有一个 azure 函数，它生成一个 sas 密钥，我稍后会使用该密钥将文件上传到我的 blob。这是我生成 sas 密钥的方式：

CloudBlobContainer container = blobClient.GetContainerReference("sasimagecontainer");
container.CreateIfNotExists();

static string GetContainerSasUri(CloudBlobContainer container)
{
    //Set the expiry time and permissions for the container.
    //In this case no start time is specified, so the shared access signature becomes valid immediately.
    SharedAccessBlobPolicy sasConstraints = new SharedAccessBlobPolicy();
    sasConstraints.SharedAccessStartTime = DateTimeOffset.UtcNow.AddMinutes(-5);
    sasConstraints.SharedAccessExpiryTime = DateTimeOffset.UtcNow.AddMinutes(25);
    sasConstraints.Permissions = SharedAccessBlobPermissions.Write | SharedAccessBlobPermissions.Add | SharedAccessBlobPermissions.Create;

    //Generate the shared access signature on the container, setting the constraints directly on the signature.
    string sasContainerToken = container.GetSharedAccessSignature(sasConstraints);

    //Return the URI string for the container, including the SAS token.
    return container.Uri + sasContainerToken + "&comp=list&restype=container";
}

然后我就可以打电话了

GetContainerSasUri(容器));

获取 sas 密钥。但是当我使用下面的代码来调用它时：

CloudBlockBlob blob = new CloudBlockBlob(thesaskey);
using (var fileStream = File.OpenRead(file))
{
    await blob.UploadFromStreamAsync(fileStream);
}

我不断收到 403 错误。这就是我在 VS 2017 中调试所获得的全部信息，我不确定如何获取有关此问题的更多信息。

我已经在 SO 上查看了关于类似问题的大多数类似线程并应用了可能的修复，例如末尾的“&comp=list&restype=container”参数。

// 我尝试将 SharedAccessBlobPermissions.List 添加到权限中，但没有成功。

// 我确实添加了所有权限（当然，无权限除外）以检查这是否会改变某些东西 - 它不会。目标仍然是只有上传权限。

Answer 1

我能够重现错误，这就是我修复它的方法：

您需要将 SAS 传递给 CloudBlobContainer 而不是 CloudBlockBlob。然后使用容器检索 blob 引用（您可能希望使用文件的 filename 属性）：

var container = new CloudBlobContainer(thesaskey);
var blob = container.GetBlockBlobReference("<yourFileName>");
await blob.UploadFromFileAsync(@"YOURPATH")

注意有一个方便的方法UploadFromFileAsync可以使用

---

这是我用来测试它的控制台应用程序：

class Program
{
    static void Main(string[] args)
    {

        var connectionString = String.Format("DefaultEndpointsProtocol=https;AccountName={0};AccountKey={1}",
            "<AccountName>",
            "<AccountKey>");
        var storageAccount = CloudStorageAccount.Parse(connectionString);
        var blobClient = storageAccount.CreateCloudBlobClient();


        var container = blobClient.GetContainerReference("sasimagecontainer");
        container.CreateIfNotExistsAsync().GetAwaiter().GetResult();

        var sasUri = GetContainerSasUri(container);


        var container2 = new CloudBlobContainer(new Uri(sasUri));
        var blob2 = container2.GetBlockBlobReference("blobCreatedViaSAS.txt");
        blob2.UploadFromFileAsync(@"D:\test.txt").GetAwaiter().GetResult();

    }

    private static string GetContainerSasUri(CloudBlobContainer container)
    {

        //Set the expiry time and permissions for the container.
        //In this case no start time is specified, so the shared access signature becomes valid immediately.
        SharedAccessBlobPolicy sasConstraints = new SharedAccessBlobPolicy();
        sasConstraints.SharedAccessExpiryTime = DateTimeOffset.UtcNow.AddHours(24);
        sasConstraints.Permissions = SharedAccessBlobPermissions.List | SharedAccessBlobPermissions.Write |
                                     SharedAccessBlobPermissions.Create |
                                     SharedAccessBlobPermissions.Add | SharedAccessBlobPermissions.Read;

        //Generate the shared access signature on the container, setting the constraints directly on the signature.
        var sasContainerToken = container.GetSharedAccessSignature(sasConstraints);

        //Return the URI string for the container, including the SAS token.
        return container.Uri + sasContainerToken;
    }
}