Azure copy blob using SAS Token (with IP restriction) 403 Forbidden

Question

I am attempting to copy a blob from one uri to another (both within the same storage account), both have a SAS Token for the credentials. This works fine with a SAS Token that doesn't have an IP restriction but fails when then source blob SAS token is IP restricted.

Note: It is not failing because I have got the IP wrong, other blob functions work i.e. list, delete, upload etc.

Example code:

Uri sourceBlobUri = new Uri("https://mystorage.blob.core.windows.net/a-container/a.json");
Uri targetBlobUri = new Uri("https://mystorage.blob.core.windows.net/a-container-archive/a.json");

var prodTokenSource = @"A_SAS_TOKEN_WITH_A_IP_RESTRICTION";
var prodTokenArchive = @"A_SAS_TOKEN_WITH_A_IP_RESTRICTION";

StorageCredentials sourceCredentials = new StorageCredentials(prodTokenSource);
StorageCredentials targetCredentials = new StorageCredentials(prodTokenArchive);

CloudBlockBlob sourceBlob = new CloudBlockBlob(sourceBlobUri, sourceCredentials);
CloudBlockBlob targetBlob = new CloudBlockBlob(targetBlobUri, targetCredentials);

await targetBlob.StartCopyAsync(sourceBlob); //Fails 403 error

One guess is that the copy request is originating from within Azure so the IP address is blocked? Should I configure the source SAS Token to accept an IP range from within Azure? Is there another way to copy blobs that allows use of SAS Tokens?

Gaurav Mantri Gaurav Mantri · Accepted Answer · 2016-10-05T13:38:59

One guess is that the copy request is originating from within Azure so the IP address is blocked? Should I configure the source SAS Token to accept an IP range from within Azure?

You're absolutely right. Copy operation is a server-side operation and the IP address specified in SAS token is the client IP address. Because the IP address included in SAS is not an Azure IP address, the copy operation is failing. You could configure SAS Token to accept an IP range from within Azure but I am guessing for copying some internal IP address is being used so I am not sure if that would work.

Is there another way to copy blobs that allows use of SAS Tokens?

I would recommend not using IP ACLing in SAS for copy operation i.e. not specify IP address restriction in SAS for copy operation.

Azure copy blob using SAS Token (with IP restriction) 403 Forbidden

1 Answers