使用DefaultAzureCredential操作Azure存储队列：创建成功但发消息失败

以下代码中，queue.createIfNotExists()能成功创建队列，但调用sendMessage()时触发403权限不匹配错误：

import com.azure.identity.DefaultAzureCredential;
import com.azure.storage.queue.QueueClient;
import com.azure.storage.queue.QueueClientBuilder;
import com.azure.storage.queue.models.*;

import com.azure.identity.DefaultAzureCredentialBuilder;

// Boilerplate main code    

public static String createQueue()
{
    try
    {
        // Create a unique name for the queue
        String queueName = "some-crazy-queue";
        System.out.println("Creating queue: " + queueName);
        DefaultAzureCredential cred = new DefaultAzureCredentialBuilder().build();
        // Instantiate a QueueClient which will be
        // used to create and manipulate the queue
        QueueClient queue = new QueueClientBuilder()
                .credential(new DefaultAzureCredentialBuilder().build())
                .endpoint("https://stmyawesomestoragequeuetest.queue.core.windows.net/")
                .queueName(queueName)
                .buildClient();

        queue.createIfNotExists();
        queue.sendMessage("John Doe");
        return queue.getQueueName();
    }
    catch (QueueStorageException e)
    {
        System.out.println("Error code: " + e.getErrorCode() + "Message: " + e.getMessage());
        return null;
    }
}

环境说明：使用DefaultAzureCredentialBuilder（Azure Identity），已通过Azure CLI本地登录。

报错信息：

Error code: AuthorizationPermissionMismatchMessage: If you are using a StorageSharedKeyCredential, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate method call.
If you are using a SAS token, and the server returned an error message that says 'Signature did not match', you can compare the string to sign with the one generated by the SDK. To log the string to sign, pass in the context key value pair 'Azure-Storage-Log-String-To-Sign': true to the appropriate generateSas method call.
Please remember to disable 'Azure-Storage-Log-String-To-Sign' before going to production as this string can potentially contain PII.
Status code 403, "

return (<Code>AuthorizationPermissionMismatch</Code>)

This request is not authorized to perform this operation using this permission.
RequestId:1768bd8b-5003-0011-75e5-7933bb000000
Time:2023-04-28T15:20:49.6063051Z"
null

疑问：为何队列创建成功，但发送消息操作失败？

核心原因是创建队列和发送消息所需的Azure RBAC权限不相同：

• createIfNotExists()仅需要队列的写入权限（比如Microsoft.Storage/storageAccounts/queues/write），你的账户刚好拥有该权限，所以队列能成功创建。
• sendMessage()需要专门的队列消息添加权限（Microsoft.Storage/storageAccounts/queues/messages/add/action），你的账户缺少这个权限，因此触发403错误。

解决步骤 #

1. 登录Azure门户，找到目标存储账户。
2. 进入访问控制(IAM)页面，点击添加角色分配。
3. 在角色列表中选择存储队列数据发送者（仅包含消息发送权限）或存储队列数据参与者（包含队列管理、消息收发等全权限，适合开发场景）。
4. 选中你的Azure CLI登录账户作为权限分配对象，完成添加。
5. 等待权限生效（通常需要1-5分钟），重新运行代码即可。

代码小优化 #

你代码里重复创建了DefaultAzureCredential实例，虽然不影响权限验证，但可以复用同一个实例减少冗余：

DefaultAzureCredential cred = new DefaultAzureCredentialBuilder().build();
QueueClient queue = new QueueClientBuilder()
        .credential(cred) // 复用已创建的cred实例
        .endpoint("https://stmyawesomestoragequeuetest.queue.core.windows.net/")
        .queueName(queueName)
        .buildClient();

内容的提问来源于stack exchange，提问作者sl3dg3