Product:
Microsoft Azure Storage Account
Issue:
When doing the Microsoft learn section:
Try to list content in a blob, you get a message:
There are no credentials provided in your command and environment, we will query for account key for your storage account.
It is recommended to provide –connection-string, –account-key or –sas-token in your command as credentials.
You also can add `–auth-mode login` in your command to use Azure Active Directory (Azure AD) for authorization if your login account is assigned required RBAC roles.
For more information about RBAC roles in storage, visit https://docs.microsoft.com/azure/storage/common/storage-auth-aad-rbac-cli.
In addition, setting the corresponding environment variables can avoid inputting credentials in your command. Please use –help to get more information about environment variable usage.
Solution:
The blob photos have been created, if you check direct in your subscription storageaccount. But you can not verify it with the command:
az storage container list \ --account-name <name>
The <name> should be replaced with your uniq storage account name.
The result returned is cryptic, but if you find below lines, then there is a success. Keep in mind that you need to enter the CLI command in one line.
},
"immutableStorageWithVersioningEnabled": false,
"metadata": null,
"name": "photos",
"properties": {
As this message is a warning, and not a error. You can add –only-show-errors to suppress warnings. Like this;
az storage container list --only-show-errors --account-key <your key> --account-name <your account>
The --auth-mode key will be deprecated in the future, try to use other method.
As this warning message is new – it may break your scripts, as they do not expect the message to come.
You can get more information with adding –debug to the command, like;
az storage container list --debug --account-name <name>
More Information:
https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-data-operations-cli
When you don’t specify the authentication type, it will try yo get the access key of the storage account: This requires Microsoft.Storage/storageAccounts/listkeys/action permission. If you have contributor role or the storage account, you have the required permission.
--auth-mode login means it will use AAD auth to connect to the storage. You can use of the built-in roles to access the storage (see documentation):
- Storage Table Data Contributor
- Storage Table Data Reader
When using AAD Auth, you could also disable access key authentication.
There is an good article related to RBAC management and data plane model: Assign an Azure role for access to blob data.