After experimenting in my own setup, here are the findings:
If you need to generate a SAS token at the container level using Typescript,
you can refer to this MS-DOCUMENT
Prior to running any code samples on Node, make sure to install the typescript compiler:
npm install -g typescript
In order to work with azure-blob-storage and azure-identity packages:
npm install @azure/storage-blob
npm install @azure/identity
Sample Code (demo.ts):
import {BlobServiceClient,
ContainerSASPermissions,
generateBlobSASQueryParameters,
SASProtocol,ContainerClient} from "@azure/storage-blob";
import { DefaultAzureCredential } from "@azure/identity";
async function createContainerSas(){
// Obtain necessary environment variables
const accountName = "venkat123";
const containerName = "test";
const TEN_MINUTES = 10 * 60 * 1000;
const NOW = new Date();
const TEN_MINUTES_BEFORE_NOW = new Date(NOW.valueOf() - TEN_MINUTES);
const TEN_MINUTES_AFTER_NOW = new Date(NOW.valueOf() + TEN_MINUTES);
// Utilize managed identity for enhanced security - DefaultAzureCredential
const blobServiceClient = new BlobServiceClient(
`https://${accountName}.blob.core.windows.net`,
new DefaultAzureCredential()
);
// Ensure time-limited delegation key is used
// For user delegation key, container must already exist
const userDelegationKey = await blobServiceClient.getUserDelegationKey(
TEN_MINUTES_BEFORE_NOW,
TEN_MINUTES_AFTER_NOW
);
// Make use of time-limited SAS options
const sasOptions = {
containerName,
permissions: ContainerSASPermissions.parse("c"),
protocol: SASProtocol.HttpsAndHttp,
startsOn: TEN_MINUTES_BEFORE_NOW,
expiresOn: TEN_MINUTES_AFTER_NOW
};
const sasToken = generateBlobSASQueryParameters(
sasOptions,
userDelegationKey,
accountName
).toString();
console.log(`SAS token for blob container is: ${sasToken}`);
return `${ContainerClient.url}?${sasToken}`;
}
createContainerSas()
Console Output:
To verify the SAS-token at container level, I ran the following command in the browser.
Command:
https://<account name>.blob.core.windows.net/test1?restype=container&comp=list&<SAS token>
Browser View: