使用用户管理身份的 AzureBlobStorage AuthorizationPermissionMismatch 错误，来自 AKS 的 Python SDK

Question

我是运行 AKS 中的一个 Python 应用程序（作为工作，但没关系），使用 Azure Python SDK 访问 blob 存储。我正在使用用户管理身份进行身份验证，使用 ManagedIdentityCredential 和 client_id kwarg（请参阅 https://docs.microsoft.com/en-us/python/api/azure-identity/azure.identity.managedidentitycredential?view=azure-python）。它能够成功查询 IMDS 端点并获取令牌，但我仍然遇到错误。有人知道我可能缺少什么设置吗？

关于用户管理身份的总体文档很少，尤其是与 AKS 和 blob 存储相关的文档，以及这个错误。

成功获取 IMDS 令牌：

2021-01-26 05:26:05,944 - azure.core.pipeline.policies.http_logging_policy - INFO - Request URL: 'http://REDACTED/metadata/identity/oauth2/token?api-version=REDACTED&resource=REDACTED&client_id=REDACTED'
2021-01-26 05:26:05,945 - azure.core.pipeline.policies.http_logging_policy - INFO - Request method: 'GET'
2021-01-26 05:26:05,945 - azure.core.pipeline.policies.http_logging_policy - INFO - Request headers:
2021-01-26 05:26:05,945 - azure.core.pipeline.policies.http_logging_policy - INFO -     'Metadata': 'REDACTED'
2021-01-26 05:26:05,945 - azure.core.pipeline.policies.http_logging_policy - INFO -     'User-Agent': 'azsdk-python-identity/1.5.0 Python/3.7.7 (Linux-4.15.0-1103-azure-x86_64-with-debian-9.12)'
2021-01-26 05:26:05,945 - azure.core.pipeline.policies.http_logging_policy - INFO - No body was attached to the request
2021-01-26 05:26:05,956 - azure.core.pipeline.policies.http_logging_policy - INFO - Response status: 200
2021-01-26 05:26:05,956 - azure.core.pipeline.policies.http_logging_policy - INFO - Response headers:
2021-01-26 05:26:05,956 - azure.core.pipeline.policies.http_logging_policy - INFO -     'Content-Type': 'application/json; charset=utf-8'
2021-01-26 05:26:05,956 - azure.core.pipeline.policies.http_logging_policy - INFO -     'Server': 'IMDS/150.870.65.486'
2021-01-26 05:26:05,956 - azure.core.pipeline.policies.http_logging_policy - INFO -     'Date': 'Tue, 26 Jan 2021 05:26:05 GMT'
2021-01-26 05:26:05,956 - azure.core.pipeline.policies.http_logging_policy - INFO -     'Content-Length': '1760'
2021-01-26 05:26:05,957 - azure.identity._internal.decorators - INFO - ManagedIdentityCredential.get_token succeeded
2021-01-26 05:26:05,957 - azure.identity._credentials.chained - INFO - ChainedTokenCredential acquired a token from ManagedIdentityCredential

随后 API 调用 blob.core.windows.net/.... 错误：

  File "/usr/local/lib/python3.7/site-packages/azure/storage/blob/_blob_client.py", line 685, in upload_blob
    return upload_block_blob(**options)
  File "/usr/local/lib/python3.7/site-packages/azure/storage/blob/_upload_helpers.py", line 157, in upload_block_blob
    process_storage_error(error)
  File "/usr/local/lib/python3.7/site-packages/azure/storage/blob/_shared/response_handlers.py", line 150, in process_storage_error
    error.raise_with_traceback()
  File "/usr/local/lib/python3.7/site-packages/azure/core/exceptions.py", line 218, in raise_with_traceback
    raise super(AzureError, self).with_traceback(self.exc_traceback)
  File "/usr/local/lib/python3.7/site-packages/azure/storage/blob/_upload_helpers.py", line 105, in upload_block_blob
    **kwargs)
  File "/usr/local/lib/python3.7/site-packages/azure/storage/blob/_generated/operations/_block_blob_operations.py", line 233, in upload
    raise HttpResponseError(response=response, model=error)
azure.core.exceptions.HttpResponseError: This request is not authorized to perform this operation using this permission.
RequestId:defcc13f-101e-006c-6aa3-f321cb000000
Time:2021-01-26T05:26:06.0112926Z
ErrorCode:AuthorizationPermissionMismatch
Error:None

有问题的 blob 存储资源具有分配给用户管理身份的角色，作为“此资源”的“贡献者”。

代码：

    managed_identity = ManagedIdentityCredential(client_id=mi_client_id)
    azure_cli = AzureCliCredential()
    credential_chain = ChainedTokenCredential(managed_identity, azure_cli)
    return BlobServiceClient(url_prefix, credential=credential_chain)

版本：天蓝色身份 1.5，Python 3.7.7

我不确定我们的 AKS 集群是否已授予用户管理身份角色，我不确定这是否重要，或者还需要设置什么。

谢谢

Answer 1

我认为您可能需要授予存储 Blob 数据贡献者权限

Answer 2

原来答案是必须分配“Storage Blob Data Contributor”和“Storage Queue Data Contributor”角色才能解决问题。

使用用户管理身份的 AzureBlobStorage AuthorizationPermissionMismatch 错误，来自 AKS 的 Python SDK

AzureBlobStorage AuthorizationPermissionMismatch error using User Managed Identities, Python SDK from AKS

azure-active-directory

azure-cli

azure-blob-storage

azure-managed-identity

azure-aks