Skip to content

sas-service-create-java.md

Latest commit

 

History

History
123 lines (75 loc) · 6.91 KB

sas-service-create-java.md

File metadata and controls

123 lines (75 loc) · 6.91 KB
title Create a service SAS for a container or blob with Java
titleSuffix Azure Storage
description Learn how to create a service shared access signature (SAS) for a container or blob using the Azure Blob Storage client library for Java.
author stevenmatthew
ms.service azure-blob-storage
ms.topic how-to
ms.date 09/06/2024
ms.author shaas
ms.reviewer nachakra
ms.devlang java
ms.custom devx-track-java, devguide-java, engagement-fy23, devx-track-java, devx-track-extended-java

Create a service SAS for a container or blob with Java

[!INCLUDE storage-dev-guide-selector-service-sas]

[!INCLUDE storage-auth-sas-intro-include]

This article shows how to use the storage account key to create a service SAS for a container or blob with the Blob Storage client library for Java.

About the service SAS

A service SAS is signed with the account access key. You can use the StorageSharedKeyCredential class to create the credential that is used to sign the service SAS.

You can also use a stored access policy to define the permissions and duration of the SAS. If the name of an existing stored access policy is provided, that policy is associated with the SAS. To learn more about stored access policies, see Define a stored access policy. If no stored access policy is provided, the code examples in this article show how to define permissions and duration for the SAS.

Create a service SAS

You can create a service SAS for a container or blob, based on the needs of your app.

Container

You can create a service SAS to delegate limited access to a container resource using the following method:

SAS signature values, such as expiry time and signed permissions, are passed to the method as part of a BlobServiceSasSignatureValues instance. Permissions are specified as a BlobContainerSasPermission instance.

The following code example shows how to create a service SAS with read permissions for a container resource:

:::code language="java" source="~/azure-storage-snippets/blobs/howto/Java/blob-devguide/blob-devguide-blobs/src/main/java/com/blobs/devguide/blobs/BlobSAS.java" id="Snippet_CreateServiceSASContainer":::

Blob

You can create a service SAS to delegate limited access to a blob resource using the following method:

SAS signature values, such as expiry time and signed permissions, are passed to the method as part of a BlobServiceSasSignatureValues instance. Permissions are specified as a BlobSasPermission instance.

The following code example shows how to create a service SAS with read permissions for a blob resource:

:::code language="java" source="~/azure-storage-snippets/blobs/howto/Java/blob-devguide/blob-devguide-blobs/src/main/java/com/blobs/devguide/blobs/BlobSAS.java" id="Snippet_CreateServiceSASBlob":::

Use a service SAS to authorize a client object

You can use a service SAS to authorize a client object to perform operations on a container or blob based on the permissions granted by the SAS.

Container

The following code examples show how to use the service SAS to authorize a BlobContainerClient object. This client object can be used to perform operations on the container resource based on the permissions granted by the SAS.

First, create a BlobServiceClient object signed with the account access key:

String accountName = "<account-name>";
String accountKey = "<account-key>";
StorageSharedKeyCredential credential = new StorageSharedKeyCredential(accountName, accountKey);
        
BlobServiceClient blobServiceClient = new BlobServiceClientBuilder()
        .endpoint(String.format("https://%s.blob.core.windows.net/", accountName))
        .credential(credential)
        .buildClient();

Then, generate the service SAS as shown in the earlier example and use the SAS to authorize a BlobContainerClient object:

:::code language="java" source="~/azure-storage-snippets/blobs/howto/Java/blob-devguide/blob-devguide-blobs/src/main/java/com/blobs/devguide/blobs/BlobSAS.java" id="Snippet_UseServiceSASContainer":::

Blob

The following code example shows how to use the service SAS created in the earlier example to authorize a BlobClient object. This client object can be used to perform operations on the blob resource based on the permissions granted by the SAS.

First, create a BlobServiceClient object signed with the account access key:

String accountName = "<account-name>";
String accountKey = "<account-key>";
StorageSharedKeyCredential credential = new StorageSharedKeyCredential(accountName, accountKey);
        
BlobServiceClient blobServiceClient = new BlobServiceClientBuilder()
        .endpoint(String.format("https://%s.blob.core.windows.net/", accountName))
        .credential(credential)
        .buildClient();

Then, generate the service SAS as shown in the earlier example and use the SAS to authorize a BlobClient object:

:::code language="java" source="~/azure-storage-snippets/blobs/howto/Java/blob-devguide/blob-devguide-blobs/src/main/java/com/blobs/devguide/blobs/BlobSAS.java" id="Snippet_UseServiceSASBlob":::

Resources

To learn more about using the Azure Blob Storage client library for Java, see the following resources.

Code samples

[!INCLUDE storage-dev-guide-resources-java]

See also