azcopy sync fails with not authorized error

Viewed 1372

I am trying to sync a local documentation folder to the destination container at Azure blob storage for a static site. Microsoft Azure Storage Explorer works great - transfers local files to $web. I am now trying to speed it up using the Powershell CLI. I am able to login, but the sync command throws a AuthorizationPermissionMismatch error. The command I am using based on the docs is:

azcopy sync "./Documents/sphinx/_build/html" "https://edvision.blob.core.windows.net/$web?[SAS]"

More details below:

PS C:\Users\magrawal> azcopy login
To sign in, use a web browser to open the page https://microsoft.com/devicelogin and enter the code XXXXXXXXX to authenticate.
INFO: Logging in under the "Common" tenant. This will log the account in under its home tenant.
INFO: If you plan to use AzCopy with a B2B account (where the account's home tenant is separate from the tenant of the target storage account), please sign in under the target tenant with --tenant-id
INFO: Login succeeded.

PS C:\Users\magrawal> azcopy sync "./Documents/sphinx/_build/html" "https://edvision.blob.core.windows.net/$web?[SAS]"
INFO: Authenticating to destination using Azure AD
INFO: Any empty folders will not be processed, because source and/or destination doesn't have full folder support

Job e36cdff1-cc77-7248-73b9-765152f1bf8b has started
Log file is located at: C:\Users\magrawal\.azcopy\e36cdff1-cc77-7248-73b9-765152f1bf8b.log

0 Files Scanned at Source, 0 Files Scanned at Destination
Cannot perform sync due to error: cannot list files due to reason -> github.com/Azure/azure-storage-blob-go/azblob.newStorageError, /home/vsts/go/pkg/mod/github.com/!azure/azure-storage-blob-go@v0.10.1-0.20210407023846-16cf969ec1c3/azblob/zc_storage_error.go:42
===== RESPONSE ERROR (ServiceCode=AuthorizationPermissionMismatch) =====
Description=This request is not authorized to perform this operation using this permission.
RequestId:ebb87f15-e01e-0052-7957-654794000000
Time:2021-06-19T22:10:30.9307497Z, Details:
Code: AuthorizationPermissionMismatch
GET https://edvision.blob.core.windows.net/%5BSAS%5D?comp=list&delimiter=%2F&include=metadata&restype=container&timeout=901
Authorization: REDACTED
User-Agent: [AzCopy/10.11.0 Azure-Storage/0.13 (go1.15; Windows_NT)]
X-Ms-Client-Request-Id: [0678b644-7cd9-4b24-52fe-3c6fd150e72f]
X-Ms-Version: [2019-12-12]
--------------------------------------------------------------------------------
RESPONSE Status: 403 This request is not authorized to perform this operation using this permission.
Content-Length: [279]
Content-Type: [application/xml]
Date: [Sat, 19 Jun 2021 22:10:30 GMT]
Server: [Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0]
X-Ms-Client-Request-Id: [0678b644-7cd9-4b24-52fe-3c6fd150e72f]
X-Ms-Error-Code: [AuthorizationPermissionMismatch]
X-Ms-Request-Id: [ebb87f15-e01e-0052-7957-654794000000]
X-Ms-Version: [2019-12-12]
1 Answers

An AuthorizationPermissionMismatch is when the token authorizes, but some operation is not allowed by the token.

You may need the Storage Blob Data Contributor role on the storage account.

You can also refer to this link, for more detailed information how RBAC works

Related