Pulumi unexpectedly urlencodes parts of Shared Access Signature (SAS)

Question

We have the golang code below to get a Shared Access Signature from Azure. It works but the sas that is printed has some fields, the "date fields", incorrectly urlencoded.

...

conStr := ConvertPulumiStringToString(account.PrimaryConnectionString)
httpsOnly := true
now := time.Now()

sas, err := storage.GetAccountBlobContainerSAS(ctx, &storage.GetAccountBlobContainerSASArgs{
        ConnectionString:   <-conStr,
        ContainerName:      "container",
        Expiry:             now.AddDate(10, 0, 0).Format(time.RFC3339),
        HttpsOnly:          &httpsOnly,
        Permissions: storage.GetAccountBlobContainerSASPermissions{
            Add:    false,
            Create: false,
            Delete: false,
            List:   true,
            Read:   true,
            Write:  false,
        },
        Start: now.Format(time.RFC3339),
    })
    println(sas.Sas)

We get this st=2021-03-16T10%3A58%3A24%2B01%3A00

We expected this format st=2021-03-16T10:16:30Z

I have tried looking at the pulumi documentation but it's very limited.

Any help is appreciated.

Answer 1

The problem was that when using RFC3339 the timezone needs to be UTC to work with Azure and pulumi.

conStr := ConvertPulumiStringToString(account.PrimaryConnectionString)
httpsOnly := true
now := time.Now().UTC()

sas, err := storage.GetAccountBlobContainerSAS(ctx, &storage.GetAccountBlobContainerSASArgs{
        ConnectionString:   <-conStr,
        ContainerName:      "container",
        Expiry:             now.AddDate(10, 0, 0).Format(time.RFC3339),
        HttpsOnly:          &httpsOnly,
        Permissions: storage.GetAccountBlobContainerSASPermissions{
            Add:    false,
            Create: false,
            Delete: false,
            List:   true,
            Read:   true,
            Write:  false,
        },
        Start: now.Format(time.RFC3339),
    })
    println(sas.Sas)