无法使用 python 代码从存储容器上传/下载文件

Question

Here is the python code that we used,

The files will be accessed and then uploaded to the storage container.

def az_upload_blob(tenantID, container_name, file_name, data):
    try:
        logger.debug("Info::Acessing uBlob.")
        AZURE_STORAGE_CONNECTION_STRING = az_kv_getsecret(Con.KV_RINGR_URI, Con.KV_SEC_CONN_STRING)
        blob_service_client = BlobServiceClient.from_connection_string(AZURE_STORAGE_CONNECTION_STRING)
        blob_client = blob_service_client.get_blob_client(container=container_name, blob=file_name)
        blob_client.upload_blob(data)
        logger.debug("Info:: Blob uploaded")
    except Exception as ex:
        logger.error(f"uBlob:: {ex}")
        raise Exception(f"AZ-uBlob-Exception: {ex}")

Error Message:

Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.
RequestId:23025256-801e-0047-3150-3b8ba5000000
Time:2021-04-27T10:34:18.1487489Z
ErrorCode:AuthenticationFailed
Error:None
AuthenticationErrorDetail:The MAC signature found in the HTTP request 'xyyz' is not the same as any computed signature. Server used following string to sign: 'PUT
636
application/octet-stream
*
x-ms-blob-type:BlockBlob
x-ms-client-request-id:1ebf24c8-a744-11eb-be9d-000d3a99de90
x-ms-date:Tue, 27 Apr 2021 10:34:18 GMT
x-ms-encryption-algorithm:AES256
x-ms-version:2020-06-12

Please help on the missing items. Thank you!

Answer 1

Update:

I use below code and it works fine:

If I run python script, I first run 'az login' and then run:

from azure.keyvault.secrets import SecretClient
from azure.identity import AzureCliCredential
from azure.storage.blob import BlobServiceClient

def az_upload_blob(KVUri,secretName, container_name, file_name, data):
    try:
        AZURE_STORAGE_CONNECTION_STRING = az_kv_getsecret(KVUri, secretName)
        blob_service_client = BlobServiceClient.from_connection_string(AZURE_STORAGE_CONNECTION_STRING)
        blob_client = blob_service_client.get_blob_client(container=container_name, blob=file_name)
        blob_client.upload_blob(data)
    except Exception as ex:
        print("Some Exception.")

def az_kv_getsecret(KVUri,secretName):
    credential = AzureCliCredential()
    client = SecretClient(vault_url=KVUri, credential=credential)
    retrieved_secret = client.get_secret(secretName)
    print(retrieved_secret.value)
    return retrieved_secret.value


KVUri = "https://bowmantest.vault.azure.net/"
secretName = "STR"
container_name = "test"
file_name = "0505test.txt"
data = "This is 0505test.txt"
az_upload_blob(KVUri=KVUri,secretName=secretName,container_name=container_name,file_name=file_name,data=data)
print("This is OK.")

If I use them in azure function, I just change the credential to 'ManagedIdentityCredential' and add the access policy of the function app to azure key vault(On my side, I give the full access.).

from azure.keyvault.secrets import SecretClient
from azure.identity import ManagedIdentityCredential
from azure.storage.blob import BlobServiceClient

def az_upload_blob(KVUri,secretName, container_name, file_name, data):
    try:
        AZURE_STORAGE_CONNECTION_STRING = az_kv_getsecret(KVUri, secretName)
        blob_service_client = BlobServiceClient.from_connection_string(AZURE_STORAGE_CONNECTION_STRING)
        blob_client = blob_service_client.get_blob_client(container=container_name, blob=file_name)
        blob_client.upload_blob(data)
    except Exception as ex:
        print("Some Exception.")

def az_kv_getsecret(KVUri,secretName):
    credential = ManagedIdentityCredential()
    client = SecretClient(vault_url=KVUri, credential=credential)
    retrieved_secret = client.get_secret(secretName)
    print(retrieved_secret.value)
    return retrieved_secret.value


KVUri = "https://bowmantest.vault.azure.net/"
secretName = "STR"
container_name = "test"
file_name = "0505test.txt"
data = "This is 0505test.txt"
az_upload_blob(KVUri=KVUri,secretName=secretName,container_name=container_name,file_name=file_name,data=data)
print("This is OK.")

Original Answer:

Can you show the az_kv_getsecre? In fact, we always just copy the connection string from azure blob storage.

The format should like below:

DefaultEndpointsProtocol=https;AccountName=youraccountname;AccountKey=xxxxxx;EndpointSuffix=core.windows.net