New-AzStorageContainerSasToken won't work with New-AzStorageContext -UseConnectedAuth #10423
Comments
|
@JustinGrote But you use Az.Storage 1.8.0, which is stable release, and not support this feature. Install-Module Az.Storage `
–Repository PSGallery `
-RequiredVersion 1.8.2-preview `
–AllowPrerelease `
–AllowClobber `
–Force |
wyunchi-ms
added
Service Attention
|
Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @xgithubtriage |
1 similar comment
|
Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @xgithubtriage |
|
I just tested and this did work with preview. When I tried with preview it
was the 4.x module. This can be closed.
…On Tue, Oct 29, 2019 at 7:11 PM Wei Wei ***@***.***> wrote:
@JustinGrote <https://github.com/JustinGrote>
Please note, the feature is not GA, so only available in preview module of
Az.Storage.
In
https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-user-delegation-sas-create-powershell,
it says you need install Az.storage 1.3.1-preview in Step #5
<#5>, and need to import it
after step #6 <#6>
But you use Az.Storage 1.8.0, which is stable release, and not support
this feature.
You can install the latest preview module 1.8.2-preview to use it.
Install-Module Az.Storage `
–Repository PSGallery `
-RequiredVersion 1.8.2-preview `
–AllowPrerelease `
–AllowClobber `
–Force
—
You are receiving this because you were mentioned.
Reply to this email directly, view it on GitHub
<#10423?email_source=notifications&email_token=ADUNKURRP3MT6YWISO7DLQTQRDUL5A5CNFSM4JGSAE4KYY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOECSVR5I#issuecomment-547707125>,
or unsubscribe
<https://github.com/notifications/unsubscribe-auth/ADUNKUQLNHVQKBB4NXFNKM3QRDUL5ANCNFSM4JGSAE4A>
.
|
|
it appears that the issue is again back with Az.Storage Version 2.3 . I have just experienced the same as per the @JustinGrote
ModuleType Version Name ExportedCommands Script 2.3.0 Az.Storage {Add-AzRmStorageContainerLegalHold, Add-AzStorageAccountManagementPolic...
ModuleType Version Name ExportedCommands Script 1.9.1 Az.Accounts {Add-AzEnvironment, Clear-AzContext, Clear-AzDefault, Connect-AzAccount...
New-AzStorageContainerSASToken : This request is not authorized to perform this operation using this permission. HTTP Status Code:
|
|
The error is because your oauth account don't have permission to generateUserDelegationKey. Please check have you assigned correct roles to the Oauth login user (with Connect-AzAccount). like at least one of the following 4 roles on the specific storage account:
|
|
Well, I was using my Administrator Account. still I should be required to get a new Context ? |
|
The administrator account might only have the management plans roles, but not dataplane roles. (Like the management plane row "owner" don't have dataplane permission, but can assign the dataplane role to yourself) You can find the details of all roles in link. |
|
I think I confused you in earlier comment. Should it not work with Global Administrator as well ? |
|
@vnextcoder |
Description
This example doesn't work: https://docs.microsoft.com/en-us/azure/storage/blobs/storage-blob-user-delegation-sas-create-powershell.
-UseConnectedAccount does fetch an oauth token, but New-AzStorage*SasToken commands fail with Cannot create Shared Access Signature unless Account Key credentials are used.
Steps to reproduce
Tested with a subscription owner (full permissions)
Issue
Workarounds
1. Get storage account and derive context from that. Requires Contribute rights to the management of the storage account in order to run Get-AzStorageAccount (not ideal)
Environment data
Module versions
Also reproduced on powershell core and Azure Cloud Shell
Debug output
Error output
The text was updated successfully, but these errors were encountered: