| title | Create a service SAS for a container or blob with .NET |
|---|---|
| titleSuffix | Azure Storage |
| description | Learn how to create a service shared access signature (SAS) for a container or blob using the Azure Blob Storage client library for .NET. |
| author | stevenmatthew |
| ms.service | azure-blob-storage |
| ms.topic | how-to |
| ms.date | 09/06/2024 |
| ms.author | shaas |
| ms.reviewer | nachakra |
| ms.devlang | csharp |
| ms.custom | devx-track-csharp, devguide-csharp, engagement-fy23, devx-track-dotnet |
[!INCLUDE storage-dev-guide-selector-service-sas]
[!INCLUDE storage-auth-sas-intro-include]
This article shows how to use the storage account key to create a service SAS for a container or blob with the Azure Blob Storage client library for .NET.
A service SAS is signed with the account access key. You can use the StorageSharedKeyCredential class to create the credential that is used to sign the service SAS.
You can also use a stored access policy to define the permissions and duration of the SAS. If the name of an existing stored access policy is provided, that policy is associated with the SAS. To learn more about stored access policies, see Define a stored access policy. If no stored access policy is provided, the code examples in this article show how to define permissions and duration for the SAS.
You can create a service SAS for a container or blob, based on the needs of your app.
The following code example shows how to create a service SAS for a container resource. First, the code verifies that the BlobContainerClient object is authorized with a shared key credential by checking the CanGenerateSasUri property. Then, it generates the service SAS via the BlobSasBuilder class, and calls GenerateSasUri to create a service SAS URI based on the client and builder objects.
:::code language="csharp" source="~/azure-storage-snippets/blobs/howto/dotnet/BlobDevGuideBlobs/CreateSas.cs" id="Snippet_CreateServiceSASContainer":::
The following code example shows how to create a service SAS for a blob resource. First, the code verifies that the BlobClient object is authorized with a shared key credential by checking the CanGenerateSasUri property. Then, it generates the service SAS via the BlobSasBuilder class, and calls GenerateSasUri to create a service SAS URI based on the client and builder objects.
:::code language="csharp" source="~/azure-storage-snippets/blobs/howto/dotnet/BlobDevGuideBlobs/CreateSas.cs" id="Snippet_CreateServiceSASBlob":::
You can use a service SAS to authorize a client object to perform operations on a container or blob based on the permissions granted by the SAS.
The following code examples show how to use the service SAS to authorize a BlobContainerClient object. This client object can be used to perform operations on the container resource based on the permissions granted by the SAS.
First, create a BlobServiceClient object signed with the account access key:
:::code language="csharp" source="~/azure-storage-snippets/blobs/howto/dotnet/BlobDevGuideBlobs/CreateSas.cs" id="Snippet_CreateServiceClientSharedKey":::
Then, generate the service SAS as shown in the earlier example and use the SAS to authorize a BlobContainerClient object:
:::code language="csharp" source="~/azure-storage-snippets/blobs/howto/dotnet/BlobDevGuideBlobs/CreateSas.cs" id="Snippet_UseServiceSASContainer":::
The following code example shows how to use the service SAS to authorize a BlobClient object. This client object can be used to perform operations on the blob resource based on the permissions granted by the SAS.
First, create a BlobServiceClient object signed with the account access key:
:::code language="csharp" source="~/azure-storage-snippets/blobs/howto/dotnet/BlobDevGuideBlobs/CreateSas.cs" id="Snippet_CreateServiceClientSharedKey":::
Then, generate the service SAS as shown in the earlier example and use the SAS to authorize a BlobClient object:
:::code language="csharp" source="~/azure-storage-snippets/blobs/howto/dotnet/BlobDevGuideBlobs/CreateSas.cs" id="Snippet_UseServiceSASBlob":::
[!INCLUDE storage-dev-guide-stored-access-policy]
To learn more about creating a service SAS using the Azure Blob Storage client library for .NET, see the following resources.
[!INCLUDE storage-dev-guide-resources-dotnet]