How to give a python script limited access to azure blob container -

i want python script able append new blobs container in azure. using shared access signatures (sas) seems way go.

but can't figure out how use them. don't want give script full access azure account giving storage account key using sas , limiting abilities of script create , removing delete, , list seems ok. how use token in script?

here test code:

#!/usr/bin/env python3  import requests azure.storage.blob import blockblobservice, containerpermissions, contentsettings  # testing, account key removed later  account_name = 'myaccountname' account_key = 'myaccountkey' container_name = 'mycontainer' existing_file = 'existing_file.jpg' new_file = 'test.jpg'  service = blockblobservice(     account_name=account_name,     account_key=account_key ) # there 2 ways create permission # 1. assign boolean values `read`/`add`/`create`/`write`/`delete` operation # permission = blobpermissions(read=true, add=true, create=true, write=true, delete=true) # 2. assign string `_str`(a string representing permissions) `racwd` means assign true operation permission = containerpermissions(write=true) sas = service.generate_container_shared_access_signature(     container_name=container_name,     permission=permission,     protocol='https' ) print(sas)  # here begins real script  service = blockblobservice(     account_name=account_name,     sas_token=sas )  assert service.exists(container_name=container_name, blob_name=existing_file)  service.create_blob_from_path(         container_name=container_name,         blob_name=new_file,         file_path='./%s' % new_file,         content_settings=contentsettings(content_type=mimetypes.guess_type('./%s' % new_file)[0]),         validate_content=true )  r = requests.head('https://%s.blob.core.windows.net/%s/%s' % (account_name, container_name, new_file), timeout=2) assert r.status_code == 200 

this fails service.exists() call with: azure.common.azurehttperror: server failed authenticate request. make sure value of authorization header formed correctly including signature.

as @davidmakogon said, sounds referring blog. indeed, helps question.

according description, seems had known how use these methods generate_account_shared_access_signature accountpermission, generate_container_shared_access_signature containerpermission, generate_blob_shared_access_signature blobpermission generate sas different levels (account, container, blob), code below blob level.

from azure.storage.blob import blockblobservice, blobpermissions  account_name = '<your storage account name>' account_key = '<your storage account key>' container_name = 'mycontainer'  service = blockblobservice(account_name=account_name, account_key=account_key) # there 2 ways create permission # 1. assign boolean values `read`/`add`/`create`/`write`/`delete` operation # permission = blobpermissions(read=true, add=true, create=true, write=true, delete=true) # 2. assign string `_str`(a string representing permissions) `racwd` means assign true operation permission = blobpermissions(_str="racwd") sas = service.generate_blob_shared_access_signature(container_name, 'test.jpg', permission) print sas 

for using sas access azure blob storage in python script, below.

1. using sas calling blob storgae rest api, can refer document service sas examples append sas blob url query parameters related operation, below.

get https://myaccount.blob.core.windows.net/pictures/profile.jpg?sv=2012-02-12&st=2009-02-09&se=2009-02-10&sr=c&sp=r&si=ywjjzgvmzw%3d%3d&sig=dd80ihbh5jfnpymo5hg1idijievhcjpcmicmnn%2frnbi%3d    http/1.1   host: myaccount.blob.core.windows.net   x-ms-date: <date> 

2. using sas in python script azure storage sdk, construct method of classes blockblobservice & baseblobservice have parameter sas_token explained below can pass sas value.

sas_token (str) – shared access signature token use authenticate requests instead of account key. if account key , sas token both specified, account key used sign. if neither specified, anonymous access used.

so example, code blockblobservice using sas below.

service = blockblobservice(sas_token=sas)