Azure create blob container using REST api and managed identity - 403 error

Question

I am trying to create blob container under storage account using REST api

I am using managed identity (for app service, node application) to interact with storage account. This managed identity has necessary permission on resource group and storage account - storage account contributor and storage blob data contributor

Here are the steps I'm following:

• Get access token for the managed identity on 'https://storage-account-name.blob.core.windows.net' resource (ref: https://learn.microsoft.com/en-us/azure/app-service/overview-managed-identity?tabs=dotnet#obtain-tokens-for-azure-resources)

• Construct the request and call REST api for create container (ref: https://learn.microsoft.com/en-us/rest/api/storageservices/create-container)

mandatory headers I'm sending in the 2nd step are:

• Authorization: Bearer access-token
• x-ms-date: 2021-06-17T09:01:48.667Z
• x-ms-version: 2020-04-08

I'm getting: statusCode: 403, statusMessage: 'Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.'

Is there anything I'm missing while sending authorization header. Couldn't find any example of calling create container api using managed identity.

Another option would be to use blob storage sdk (https://learn.microsoft.com/en-us/azure/storage/blobs/storage-quickstart-blobs-nodejs) but couldn't find any samples of creating container using managed identity.

Any pointers to make this work are greatly appreciated.

Thanks,

Answer 1

First, you couldn't call Rest API with managed identity. Authorization header needs the authorization scheme, account name, and signature.

Manage blobs with JavaScript v12 SDK in Node.js:

You could use @azure/identity for managed identity.

const { ManagedIdentityCredential } = require("@azure/identity");
const { BlobServiceClient } = require("@azure/storage-blob");

const credential = new ManagedIdentityCredential("<USER_ASSIGNED_MANAGED_IDENTITY_CLIENT_ID>");

const blobServiceClient = new BlobServiceClient(
    `https://${account}.blob.core.windows.net`,
    credential
);