azure - 在 Azure VM 中，如何在不使用存储帐户访问 key 的情况下为 azure blob 存储生成 SAS token ？

Question

场景很简单:我的Web应用程序由ReactJS SPA作为前端和在VM中运行的Web api作为后端组成；当用户需要上传文件时，后端会生成一个带有 SAS token 的 URL，用于将文件上传到 Azure 存储帐户和 Blob 容器中。后端用这个url回复前端SPA，用户可以直接从本地浏览器上传文件到azure blob存储，不需要再次跨越后端VM。

在后端，我使用此代码生成带有 SAS token 的 url:

function generate_signed_url(BLOB_NAME, AZURE_PRIMARY_KEY) {
    
    const ACCOUNT_NAME = process.env.AZURE_BLOB_STORAGE_ACCOUNT_NAME;
    const CONTAINER_NAME = process.env.AZURE_BLOB_STORAGE_CONTAINER_NAME;
    const ACCESS_KEY = process.env.AZURE_BLOB_STORAGE_ACCESS_KEY;

    const sharedKeyCredential = new StorageSharedKeyCredential(accountName=ACCOUNT_NAME, accountKey=ACCESS_KEY)
      
    //This URL will be valid for 1 hour
    const expDate = new Date(new Date().valueOf() + 3600 * 1000);

    // Generate service level SAS for a blob
    const blobSAS = generateBlobSASQueryParameters({
      containerName: CONTAINER_NAME, // Required
      blobName: BLOB_NAME, // Required
      permissions: BlobSASPermissions.parse("racwd"), // Required
      startsOn: new Date(), // Optional
      expiresOn: expDate, // Required. Date type
      cacheControl: "cache-control-override", // Optional
      contentDisposition: "content-disposition-override", // Optional
      contentEncoding: "content-encoding-override", // Optional
      contentLanguage: "content-language-override", // Optional
      contentType: "content-type-override", // Optional
      ipRange: { start: "0.0.0.0", end: "255.255.255.255" }, // Optional
      protocol: SASProtocol.HttpsAndHttp, // Optional
      version: "2016-05-31" // Optional
    },
    sharedKeyCredential 
    ).toString();

    SaSURL = `https://${ACCOUNT_NAME}.blob.core.windows.net/${AZURE_CONTAINER}/${AZURE_BLOB}?${containerSAS}`;
    
    console.log(`SAS URL for blob is: ${SaSURL}`);
    return SaSURL;
}

但是，这需要我将 VM 中的 Azure 存储帐户访问 key 保存为项目的环境变量。这被认为是不好的做法:

const ACCESS_KEY = process.env.AZURE_BLOB_STORAGE_ACCESS_KEY

有没有更专业的替代方案？

Answer 1

how can I generate a SAS token for azure blob storage without using the storage account access key?

您可以使用用户委托(delegate) key 生成无需帐户 key 的 SAS token 。

您需要两个包:

import {DefaultAzureCredential} from "@azure/identity";
import {BlobServiceClient,ContainerSASPermissions,
generateBlobSASQueryParameters,
SASProtocol}from "@azure/storage-blob";

您可以使用以下代码在后端实现此目的。

function generate_signed_url(BLOB_NAME, AZURE_PRIMARY_KEY) {
    
    const ACCOUNT_NAME = process.env.AZURE_BLOB_STORAGE_ACCOUNT_NAME;
    const CONTAINER_NAME = process.env.AZURE_BLOB_STORAGE_CONTAINER_NAME;
   
    const  blobname="spring-flowers.jpg";
    const  blobServiceClient = new  BlobServiceClient(`https://${accountName}.blob.core.windows.net`,new  DefaultAzureCredential());
    const  userDelegationKey = await  blobServiceClient.getUserDelegationKey(new  Date(), new  Date(new  Date().valueOf() + 10 * 60 * 1000));
    const  permissions = new  ContainerSASPermissions();
    permissions.list = true;
    permissions.write = true;
    permissions.create = true;
    permissions.delete = true;
    permissions.read = true;
    const  sasOptions = {
        blobname,
        containerName,
        permissions,
        protocol:  SASProtocol.Https,
        startsOn:  new  Date(),
        expiresOn:  new  Date(new  Date().valueOf() + 10 * 60 * 1000)
    };
    const  sasToken = generateBlobSASQueryParameters( 
        sasOptions,
        userDelegationKey,
        accountName
        ).toString();
        const  sasUrl = `https://${accountName}.blob.core.windows.net/${containerName}/${blobname}?${sasToken}`;
    const SaSURL = `https://${ACCOUNT_NAME}.blob.core.windows.net/${AZURE_CONTAINER}/${AZURE_BLOB}?${containerSAS}`;
    
    console.log(`SAS URL for blob is: ${SaSURL}`);
    return SaSURL;
}

输出:

它返回 SAS-URL，如下所示:

SAS URL for blob is = `https://venkat123.blob.core.windows.net/test/spring-flowers.jpg?sv=2022-11-02&spr=https&st=2023-07-12T06%3A44%3A08Z&se=2023-07-12T06%3A54%3A08Z&skoid=6e19aa9e-1e69-4a85-85f4-b00099a8da5c&sktid=72f988bf-86f1-41af-91ab-2d7cd011db47&skt=2023-07-12T06%3A44%3A02Z&ske=2023-07-12T06%3A54%3A02Z&sks=b&skv=2022-11-02&sr=c&sp=rcwdl&sig=xxxx

浏览器:

我在浏览器中检查了 URL，它成功运行。

Note: To generate user delegation SAS-token you needStorage blob data contributor role

引用:

Create a user delegation SAS - Azure Storage | Microsoft Learn