Azure Storage: AuthorizationPermissionMismatch when a SAS with Create permission is used

Question

I'm uploading large blobs in blocks of 1MB to Azure Storage. This works when I create a SAS with a Write permission, but it throws the below error with a Create permission.

ErrorCode: AuthorizationPermissionMismatch

This request is not authorized to perform this operation using this permission

Is this expected behavior? I'd like to pass SAS tokens to users and allow them to create a blob but not overwrite it once it's been created. How can I accomplish this?

Answer 1

Update:

When you upload block blobs, you need Write permission.

And this is the doc:

https://docs.microsoft.com/en-us/rest/api/storageservices/create-account-sas#blob-service

Original Answer:

Please make sure you have give the create permission:

Below is my code(C#), it works fine(I can create even the blob is not exist.):

using Azure.Storage.Blobs;
using Azure.Storage.Blobs.Models;
using System;
using System.IO;
using System.Text;
using System.Threading.Tasks;

namespace ConsoleApp28
{
    class Program
    {
        static void Main(string[] args)
        {
            string containerName = "test";
            string token = "?sv=2019-12-12&ss=bfqt&srt=sco&sp=rwdlacupx&se=2021-01-04T09:41:18Z&st=2021-01-04T01:41:18Z&spr=https&sig=UVhS9bPGqWhjKnlrQIMkWHD6Bdfdpym8vgZoQ6W9qDE%3D";
            string sas_uri = "https://0730bowmanwindow.blob.core.windows.net/test?sv=2019-12-12&ss=bfqt&srt=sco&sp=rwdlacupx&se=2021-01-04T09:41:18Z&st=2021-01-04T01:41:18Z&spr=https&sig=UVhS9bPGqWhjKnlrQIMkWHD6Bdfdpym8vgZoQ6W9qDE%3D";

            BlobServiceClient blobServiceClient = new BlobServiceClient(new Uri(sas_uri));
            
            BlobContainerClient containerClient = blobServiceClient.GetBlobContainerClient(containerName);

            BlobClient blobClient = containerClient.GetBlobClient("20210104.txt");
            byte[] byteArray = Encoding.UTF8.GetBytes("This is a test.20210104");

            MemoryStream stream = new MemoryStream(byteArray);
            blobClient.Upload(stream, true);
        }
    }
}