使用Java生成的SAS Token删除特定版本Blob时遇权限错误

错误信息 #

<?xml version="1.0" encoding="utf-8"?>
<Error>
<Code>OperationNotAllowedOnAutomaticSnapshot</Code>
<Message>The specified operation is not allowed on version.
RequestId:59c5b1ae-d01e-0018-36d2-XXXX
Time:2022-09-06T09:28:07.7293570Z</Message>
</Error>

生成SAS Token的Java代码 #

import java.net.URISyntaxException;
import java.security.InvalidKeyException;
import java.time.LocalDateTime;
import java.time.ZoneOffset;
import java.util.Date;
import java.util.EnumSet;

import com.microsoft.azure.storage.CloudStorageAccount;
import com.microsoft.azure.storage.SharedAccessProtocols;
import com.microsoft.azure.storage.StorageException;
import com.microsoft.azure.storage.blob.CloudBlobClient;
import com.microsoft.azure.storage.blob.CloudBlobContainer;
import com.microsoft.azure.storage.blob.SharedAccessBlobPermissions;
import com.microsoft.azure.storage.blob.SharedAccessBlobPolicy;


public class GenerateSAStoken {
public static String GetToken(String connString,String containerName,Integer ttl) throws InvalidKeyException, URISyntaxException, StorageException {
    
    CloudStorageAccount account = CloudStorageAccount.parse(connString);

    // Create a blob service client
    CloudBlobClient blobClient = account.createCloudBlobClient();

    CloudBlobContainer container = blobClient.getContainerReference(containerName);

    Date expirationTime = Date.from(LocalDateTime.now().plusMinutes(ttl).atZone(ZoneOffset.UTC).toInstant());
    SharedAccessProtocols accessProtocols= SharedAccessProtocols.HTTPS_ONLY;
    SharedAccessBlobPolicy sharedAccessPolicy = new SharedAccessBlobPolicy();
    sharedAccessPolicy.setPermissions(EnumSet.of(SharedAccessBlobPermissions.READ,SharedAccessBlobPermissions.CREATE,
            SharedAccessBlobPermissions.WRITE, SharedAccessBlobPermissions.ADD,SharedAccessBlobPermissions.LIST,SharedAccessBlobPermissions.DELETE));
    sharedAccessPolicy.setSharedAccessStartTime(new Date());
    sharedAccessPolicy.setSharedAccessExpiryTime(expirationTime);

    String sasToken = container.generateSharedAccessSignature(sharedAccessPolicy, null, null, accessProtocols);
    
    return sasToken;
}
}

问题原因与解决方法 #

原因 #

当前生成的SAS Token仅包含常规Blob操作权限，但删除Blob版本需要额外的**DELETE_VERSION**权限。旧版Azure Storage SDK中，SharedAccessBlobPermissions枚举默认未包含版本操作权限，导致无法执行版本删除操作。

解决步骤 #

1. 添加版本删除权限：确保Azure Storage SDK for Java版本≥8.6.0，在权限集合中加入SharedAccessBlobPermissions.DELETE_VERSION，修改后的权限代码如下：

   sharedAccessPolicy.setPermissions(EnumSet.of(
       SharedAccessBlobPermissions.READ,
       SharedAccessBlobPermissions.CREATE,
       SharedAccessBlobPermissions.WRITE,
       SharedAccessBlobPermissions.ADD,
       SharedAccessBlobPermissions.LIST,
       SharedAccessBlobPermissions.DELETE,
       SharedAccessBlobPermissions.DELETE_VERSION // 新增版本删除权限
   ));
   

2. 升级SDK版本：若当前SDK版本过低，需升级至支持Blob版本控制的版本，否则无法获取DELETE_VERSION枚举值。
3. 验证权限生效：生成新的SAS Token后，重新调用删除Blob版本的REST API，确认操作正常执行。

额外注意：如果存储账户启用了软删除或版本保留策略，需确保操作符合账户级规则，避免因策略限制导致操作失败。

内容的提问来源于stack exchange，提问作者hyd_33