Get-AzStorageBlobContent download from uri without sas and access key

[chloeyin]

Description

In azure cli, it is possible to download a blob content by providing blob uri without sas key or access token
az storage blob download --blob-url https://<storageaccount>.blob.core.windows.net/<container>/<blob>--auth-mode login

Is it possible to do the same in az powershell module?

I'm trying this

Connect-AzAccount
$Context = New-AzStorageContext -StorageAccountName <storageaccount> -UseConnectedAccount
Get-AzStorageBlobContent -Uri https://<storageaccount>.blob.core.windows.net/<container>/<blob> -Destination <dst> -Context $Context

But it gave me this

Get-AzStorageBlobContent -Uri https://<storageaccount>.blob.core.windows.net/<container>/<blob> -Destination <dst> -Context $Context
DEBUG: 4:29:29 PM - Init Operation Context for 'GetAzureStorageBlobContentCommand' with client request id  <>. If you want to get more details, please add "-Debug" to your command.
DEBUG: 4:29:29 PM - [ConfigManager] Got nothing from [EnableErrorRecordsPersistence], Module = [], Cmdlet = []. Returning default value [False].
Get-AzStorageBlobContent: Service request failed.
Status: 401 (Server failed to authenticate the request. Please refer to the information in the www-authenticate header.)
ErrorCode: NoAuthenticationInformation

Headers:
Transfer-Encoding: chunked
Server: Windows-Azure-Blob/1.0,Microsoft-HTTPAPI/2.0
x-ms-request-id: <>
x-ms-client-request-id: <>
x-ms-version: 2023-08-03
x-ms-error-code: NoAuthenticationInformation
WWW-Authenticate: Bearer authorization_uri=https://login.microsoftonline.com/<>/oauth2/authorize resource_id=https://storage.azure.com
Date: Mon, 14 Oct 2024 08:29:28 GMT
DEBUG: 4:29:29 PM - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 4:29:29 PM - GetAzureStorageBlobContentCommand end processing, Start 6 remote calls. Finish 6 remote calls. Elapsed time 11325099.66 ms. Client operation id: Azure-Storage-PowerShell-ae82538b-d3c6-456d-b4e8-c3b04c75878f.
DEBUG: 4:29:29 PM - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 4:29:29 PM - GetAzureStorageBlobContentCommand end processing.

Script or Debug output

No response

Environment data

$PSVersionTable

Name                           Value
----                           -----
PSVersion                      7.4.5
PSEdition                      Core
GitCommitId                    7.4.5
OS                             Microsoft Windows 10.0.26100
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

Get-Module Az*

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     3.0.4                 Az.Accounts                         {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault…}
Script     7.3.0                 Az.Storage                          {Add-AzRmStorageContainerLegalHold, Add-AzStorageAccountManagementPolicyAction, Add-AzStorage…

Error output

No response

[blueww]

@chloeyin

Would you please check if the following cmdlet works for you?

$Context = New-AzStorageContext -StorageAccountName <storageaccount> -UseConnectedAccount
Get-AzStorageBlobContent -Container <container> -Blob <blob> -Destination <dst> -Context $Context

You might can also check if your logon Microsoft Entra account have been granted enough permission, see more details in https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory#azure-built-in-roles-for-blobs

If you have get enough permission, but the error still repro, Please at least share x-ms-request-id, time (UTC) here (You can find all of them in debug log), then we can continue to look into it. (make sure the request ID is in recent 3 days.)

[chloeyin]

@blueww Yes, I can download by using blob name and container name, just failed to download by using blob URI.

Get-AzStorageBlobContent -Uri https://<>.blob.core.windows.net/mycontainer/myblob -Destination <>-Context $Context
DEBUG: 10:05:23 AM - Init Operation Context for 'GetAzureStorageBlobContentCommand' with client request id  Azure-Storage-PowerShell-ae82538b-d3c6-456d-b4e8-c3b04c75878f. If you want to get more details, please add "-Debug" to your command.
DEBUG: 10:05:24 AM - [ConfigManager] Got nothing from [EnableErrorRecordsPersistence], Module = [], Cmdlet = []. Returning default value [False].
Get-AzStorageBlobContent: Service request failed.
Status: 401 (Server failed to authenticate the request. Please refer to the information in the www-authenticate header.)
ErrorCode: NoAuthenticationInformation

Headers:
Transfer-Encoding: chunked
Server: Windows-Azure-Blob/1.0,Microsoft-HTTPAPI/2.0
x-ms-request-id: 0a5f507d-101e-0030-61a6-1e6db6000000
x-ms-client-request-id: 2a6033e7-2c2d-4f6d-a064-f6b11940e2c8
x-ms-version: 2023-08-03
x-ms-error-code: NoAuthenticationInformation
WWW-Authenticate: Bearer authorization_uri=https://login.microsoftonline.com/<>/oauth2/authorize resource_id=https://storage.azure.com
Date: Tue, 15 Oct 2024 02:05:23 GMT
DEBUG: 10:05:24 AM - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 10:05:24 AM - GetAzureStorageBlobContentCommand end processing, Start 10 remote calls. Finish 10 remote calls. Elapsed time 74679978.42 ms. Client operation id: Azure-Storage-PowerShell-ae82538b-d3c6-456d-b4e8-c3b04c75878f.
DEBUG: 10:05:24 AM - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 10:05:24 AM - GetAzureStorageBlobContentCommand end processing.

This is the request id and utc time, thanks!

x-ms-request-id: 0a5f507d-101e-0030-61a6-1e6db6000000
x-ms-client-request-id: 2a6033e7-2c2d-4f6d-a064-f6b11940e2c8
Date: Tue, 15 Oct 2024 02:05:23 GMT

[blueww]

@chloeyin

Thanks to confirm download by using blob name and container name works!
Please use this way to download normal blob, the download with Uri is mostly designed for managed disk downloading.
However, we will look into how to fix the failure in download with Uri.

[chloeyin]

Thank you for the response!