使用Azure Storage SDK v12+SAS令牌访问队列遇授权错误

使用C#代码通过Azure Storage SDK v12和SAS令牌读取、添加、处理Azure存储队列时，无论如何修改，始终报错："This request is not authorized to perform this operation"。

上下文信息 #

• 存储账户已存在，拥有该账户Owner权限
• 存储账户未配置防火墙防护
• 同一存储账户的Blob/容器使用相同方法可正常工作
• 可在Azure门户中对队列执行任意操作
• 生产环境中使用MSI（同SDK v12）或无SAS令牌（使用密钥/连接字符串）的类似代码无问题

代码示例 #

string queueName = "queue1";
string accountName = "<account_name>";
string storageKey = "<account_key>";
string endpointSuffix = "core.windows.net";
string connectionString = $"DefaultEndpointsProtocol=https;AccountName={accountName};AccountKey={storageKey};EndpointSuffix={endpointSuffix}";

var options = new Azure.Storage.Queues.QueueClientOptions
{
    MessageEncoding = Azure.Storage.Queues.QueueMessageEncoding.Base64
};

Azure.Storage.Queues.QueueServiceClient serviceClient = new Azure.Storage.Queues.QueueServiceClient(
  serviceUri: new Uri($"https://{accountName}.queue.{endpointSuffix}"),
  credential: new Azure.Storage.StorageSharedKeyCredential(accountName, storageKey),
  options: options);

Azure.Storage.Queues.QueueClient client = serviceClient.GetQueueClient(queueName);

// client.CreateIfNotExistsAsync().Wait(); // **** 取消注释后无SAS时可正常执行，存储账户无变化

var queueSasBuilder = new QueueSasBuilder
{
    ExpiresOn = DateTimeOffset.UtcNow.Add(TimeSpan.FromHours(3)),
    QueueName = queueName
};

//  定义权限类型
//var queueAccountPermissions = QueueAccountSasPermissions.Add | QueueAccountSasPermissions.Read | QueueAccountSasPermissions.Update | QueueAccountSasPermissions.Process;  //**** 同样报错
//queueSasBuilder.SetPermissions(queueAccountPermissions);

var queuePermissions = QueueSasPermissions.Add | QueueSasPermissions.Read | QueueSasPermissions.Update | QueueSasPermissions.Process;
queueSasBuilder.SetPermissions(queuePermissions);

Uri sasUri = client.GenerateSasUri(queueSasBuilder);  // 客户端可正常生成SasUri

Uri partialUri = new Uri($"{sasUri.Scheme}://{sasUri.Host}{sasUri.AbsolutePath}");
Console.WriteLine($"Successfully created SasToken storage queue for uri: '{partialUri}', expiration time: '{queueSasBuilder.ExpiresOn}'");

client = new Azure.Storage.Queues.QueueClient(queueUri: sasUri);
client.CreateIfNotExistsAsync().Wait();  // *** 此行抛出授权异常

已尝试的方案 #

• 取消注释client.CreateIfNotExistsAsync().Wait();，不使用SAS令牌时可正常执行
• 改用QueueAccountSasPermissions设置权限，仍出现相同错误
• 为主体添加StorageQueueDataContributor角色分配，问题依旧

内容的提问来源于stack exchange，提问作者Guillermo