Sas token to delete blob using java

Question

I am generating the sas token using below java code ,using generated sas token i can able create/update/download/delete the blob operations but for delete blob based on filename with specific versions getting below error.



OperationNotAllowedOnAutomaticSnapshot
The specified operation is not allowed on version.
RequestId:59c5b1ae-d01e-0018-36d2-XXXX
Time:2022-09-06T09:28:07.7293570Z

Java code:

import java.net.URISyntaxException;
import java.security.InvalidKeyException;
import java.time.LocalDateTime;
import java.time.ZoneOffset;
import java.util.Date;
import java.util.EnumSet;

import com.microsoft.azure.storage.CloudStorageAccount;
import com.microsoft.azure.storage.SharedAccessAccountPolicy;
import com.microsoft.azure.storage.SharedAccessProtocols;
import com.microsoft.azure.storage.StorageException;
import com.microsoft.azure.storage.blob.CloudBlobClient;
import com.microsoft.azure.storage.blob.CloudBlobContainer;
import com.microsoft.azure.storage.blob.SharedAccessBlobPermissions;
import com.microsoft.azure.storage.blob.SharedAccessBlobPolicy;


public class GenerateSAStoken {
public static String GetToken(String connString,String containerName,Integer ttl) throws InvalidKeyException, URISyntaxException, StorageException {
    
    CloudStorageAccount account = CloudStorageAccount.parse(connString);

    // Create a blob service client
    CloudBlobClient blobClient = account.createCloudBlobClient();

    CloudBlobContainer container = blobClient.getContainerReference(containerName);

    Date expirationTime = Date.from(LocalDateTime.now().plusMinutes(ttl).atZone(ZoneOffset.UTC).toInstant());
    SharedAccessProtocols accessProtocols= SharedAccessProtocols.HTTPS_ONLY;
    SharedAccessBlobPolicy sharedAccessPolicy = new SharedAccessBlobPolicy();
    sharedAccessPolicy.setPermissions(EnumSet.of(SharedAccessBlobPermissions.READ,SharedAccessBlobPermissions.CREATE,
            SharedAccessBlobPermissions.WRITE, SharedAccessBlobPermissions.ADD,SharedAccessBlobPermissions.LIST,SharedAccessBlobPermissions.DELETE));
    sharedAccessPolicy.setSharedAccessStartTime(new Date());
    sharedAccessPolicy.setSharedAccessExpiryTime(expirationTime);

    String sasToken = container.generateSharedAccessSignature(sharedAccessPolicy, null, null, accessProtocols);
    
    return sasToken;
}
}

After sas token generation i am passing token to azure blob rest api's for all curd operations

Gaurav Mantri · Answer

The reason your code is failing is because your SAS token does not have the permission to delete a blob version. It only has the permission to delete the base blob.

To fix, please include Delete Blob Version permission in your SAS token.

I also noticed that you are using an older version of Blob Storage SDK which does not have this permission. You will first need to upgrade your code to make use of the latest version of the Blob Storage SDK and then create a SAS token with delete blob version permission.

Please see this link for the permissions for a blob service resource in a SAS token: https://docs.microsoft.com/en-us/rest/api/storageservices/create-service-sas#permissions-for-a-directory-container-or-blob

Sas token to delete blob using java

1 Answers