Create a Service SAS URI for an Azure Blob Storage Container

azure-storage-blob-container-sas-uri.js

/* Script to create a serive SAS URI for an Azure Blob Storage Container */

const { generateBlobSASQueryParameters, SASProtocol, StorageSharedKeyCredential } = require('@azure/storage-blob'); // v12.x

function generageBlobSasSignatureValues(blobContainerName, storedPolicyName, overrides) {
  const startsOn = new Date();
  const expiresOn = new Date(startsOn.getTime() + 86400_000); // 1 day - customizable
  const permissions = storedPolicyName ? undefined : 'racwl'; // All but delete, Max permissions are 'racwdl'
  // Stored Access Policy (for the container) defines the permissions and optionally startsOn & expiresOn
  // Using an Access Policy allows us to invalidate SAS by deleting the policy
  // Re-create the Policy with the same name but a higher startsOn to invalidate old SAS (to be tested/confirmed)

  const blobSasSignatureValues = {
    version: '2020-04-08', // Can skip to use SDK default
    protocol: SASProtocol.Https, // Default is HttpsAndHttp
    startsOn,
    expiresOn,
    permissions,
    ipRange: undefined, // IP based filtering - can be ADF's Integration Runtime's Egress IPs
    containerName: blobContainerName,
    identifier: storedPolicyName,
    correlationId: undefined, // For correlating logs with Azure
    // Skipped fields for blob file level SAS
  };

  return Object.assign(blobSasSignatureValues, overrides);
}

function generateSasUri(storageAccountName, storageAccessKey, blobContainerName, storedPolicyName, overrides) {
  const blobSasSignatureValues = generageBlobSasSignatureValues(blobContainerName, storedPolicyName, overrides);
  const storageSharedKeyCredential = new StorageSharedKeyCredential(storageAccountName, storageAccessKey);
  const query = generateBlobSASQueryParameters(blobSasSignatureValues, storageSharedKeyCredential);
  return `https://${storageAccountName}.blob.core.windows.net/${blobContainerName}?${query.toString()}`;
}

function printSasUri(container) {
  const account = 'myStorageAccountName';
  const key = '***myStorageAccountAccessKey***';
  const policy = 'myStorageBlobContainerAccessPolicyName';
  const sasUri = generateSasUri(account, key, container, policy);
  console.log(sasUri);
}

printSasUri('myStorageBlobContainerName');

Created this gist since all public documentation that I found for the past 2 days is horrible (or in .NET). I couldn't find a proper answer so here's the code snippet.

References:

• https://www.npmjs.com/package/@azure/storage-blob
• https://docs.microsoft.com/en-us/azure/storage/blobs/sas-service-create?tabs=javascript
• https://docs.microsoft.com/en-us/rest/api/storageservices/create-service-sas
• https://stackoverflow.com/questions/58827196/how-to-generate-account-sas-token-for-azure-storage