Azure 存储帐户使用托管标识和 C# 进行身份验证

Question

I am trying to authenticate an Azure Storage Account using a user assigned managed identity but, getting the following error:

unable to authenticate azure storage using user assigned managed identity...

Earlier, in the Azure portal, I've provided contributor access to the managed identity in the Storage account. All other parameters (AccountURL, container name and managed identity) are correct. I am getting the error in the await blobClient.UploadAsync

Please find the code below,

public class BlobStorageManager
{
    private BlobContainerClient blobContainerClient = null;

    public BlobStorageManager()
    {
        var accountURL = ConfigurationManager.AppSettings["AccountURL"].ToString();
        var containerName = ConfigurationManager.AppSettings["ContainerName"].ToString();
        var managedIdentity = ConfigurationManager.AppSettings["ManagedIdentity"].ToString();       

        var blobServiceClient = new BlobServiceClient(new Uri(accountURL), new ManagedIdentityCredential(managedIdentity));

        blobContainerClient = blobServiceClient.GetBlobContainerClient(containerName);
    }

    public async Task<string> UploadFileToBlobAsync(string fileName, Stream fileData, string contentType)
    {
        try
        {
            BlobClient blobClient = blobContainerClient.GetBlobClient(fileName);

            var blobHttpHeaders = new BlobHttpHeaders()
            {
                ContentType = contentType
            };

            var blobUploadOptions = new BlobUploadOptions()
            {
                HttpHeaders = blobHttpHeaders
            };

            await blobClient.UploadAsync(fileData, blobUploadOptions).ConfigureAwait(false);

            return blobClient.Uri.AbsoluteUri;
        }
        catch (Exception ex)
        {
            throw (ex);
        }
    }

I am using Azure.Identity 1.4.0 and Azure.Storage.Blobs 12.10.0

Am I missing any step? Please advise.

Answer 1

Contributor role does not grant data plane access. It only gives access to manage the Storage account resource itself.

You need to grant the Storage Blob Data Contributor role to the Managed Identity. This will give it data access.