Crate reqsign_azure_storage

Expand description

Azure Storage signing implementation for reqsign.

This crate provides comprehensive signing support for Azure Storage services including Blob Storage, File Storage, Queue Storage, and Table Storage.

§Overview

Azure Storage supports multiple authentication methods, and this crate implements all major ones:

Shared Key: Using storage account access keys
SAS Token: Pre-generated Shared Access Signature tokens
Bearer Token: OAuth2/Azure AD authentication

§Quick Start

use anyhow::Result;
use reqsign_azure_storage::{DefaultCredentialProvider, RequestSigner};
use reqsign_core::{Context, Signer};
use reqsign_file_read_tokio::TokioFileRead;
use reqsign_http_send_reqwest::ReqwestHttpSend;
use reqwest::Client;

#[tokio::main]
async fn main() -> Result<()> {
    // Create context
    let ctx = Context::new()
        .with_file_read(TokioFileRead::default())
        .with_http_send(ReqwestHttpSend::default());

    // Create credential loader (will try multiple methods)
    let loader = DefaultCredentialProvider::new();

    // Create request builder
    let builder = RequestSigner::new();

    // Create the signer
    let signer = Signer::new(ctx, loader, builder);

    // Sign requests
    let mut req = http::Request::get("https://mystorageaccount.blob.core.windows.net/container/blob")
        .body(())
        .unwrap()
        .into_parts()
        .0;

    signer.sign(&mut req, None).await?;
    Ok(())
}

§Credential Sources

§Environment Variables

# For Shared Key authentication
export AZURE_STORAGE_ACCOUNT_NAME=mystorageaccount
export AZURE_STORAGE_ACCOUNT_KEY=base64key

# For SAS Token authentication
export AZURE_STORAGE_SAS_TOKEN=sv=2021-06-08&ss=b&srt=sco...

# For Azure AD authentication
export AZURE_CLIENT_ID=client-id
export AZURE_CLIENT_SECRET=client-secret
export AZURE_TENANT_ID=tenant-id

§Managed Identity

When running on Azure services (VMs, App Service, AKS), the crate automatically uses managed identity:

use reqsign_azure_storage::DefaultCredentialProvider;

// Create loader that will try managed identity
let loader = DefaultCredentialProvider::new();

Customize the default chain with slot-based builder APIs:

use reqsign_azure_storage::{
    ClientSecretCredentialProvider, DefaultCredentialProvider,
};

let loader = DefaultCredentialProvider::builder()
    .no_env()
    .client_secret(ClientSecretCredentialProvider::new().with_tenant_id("tenant-id"))
    .no_imds()
    .build();

§Storage Services

§Blob Storage

// List containers
let req = Request::get("https://account.blob.core.windows.net/?comp=list")
    .body(())
    .unwrap();

// Get blob
let req = Request::get("https://account.blob.core.windows.net/container/blob.txt")
    .body(())
    .unwrap();

§File Storage

// List shares
let req = Request::get("https://account.file.core.windows.net/?comp=list")
    .body(())
    .unwrap();

§Advanced Features

§Account SAS Generation

Generate SAS tokens for delegated access:

// Account SAS is not yet exposed in the public API
// This is planned for future releases

§Using Specific Credential Providers

use reqsign_azure_storage::{StaticCredentialProvider, EnvCredentialProvider};

// Use static credentials
let static_loader = StaticCredentialProvider::new_shared_key(
    "mystorageaccount",
    "base64key"
);

// Or use environment variables
let env_loader = EnvCredentialProvider::new();

§Examples

Check out the examples directory for more detailed usage:

Structs§

AzureCliCredentialProvider: AzureCliCredentialProvider provides credentials from Azure CLI
AzurePipelinesCredentialProvider: AzurePipelinesCredentialProvider provides credentials using Azure Pipelines workload identity
ClientCertificateCredentialProvider: ClientCertificateCredentialProvider provides credentials using a client certificate
ClientSecretCredentialProvider: Load credential from Azure Client Secret.
DefaultCredentialProvider: Default loader that tries multiple credential sources in order.
DefaultCredentialProviderBuilder: Builder for DefaultCredentialProvider.
EnvCredentialProvider
ImdsCredentialProvider: Load credential from Azure Instance Metadata Service (IMDS).
RequestSigner: RequestSigner that implement Azure Storage Shared Key Authorization.
SasIpRange: One IPv4 address or inclusive IPv4 range for an Azure SAS.
ServiceSasBlobPermissions: Permissions for a blob-scoped Blob Storage Service SAS.
ServiceSasConfig: Stable configuration for locally generating one Blob Storage Service SAS.
ServiceSasContainerPermissions: Permissions for a container-scoped Blob Storage Service SAS.
ServiceSasGrant: One complete, typed Blob Storage Service SAS grant.
ServiceSasGranter: Grants expiration-aware Azure Blob Storage Service SAS credentials.
ServiceSasVersion: Azure Storage service version used to authorize a Service SAS.
ServiceSharedAccessSignature: Service SAS generator using Shared Key.
StaticCredentialProvider
UserDelegationSasGrant: A typed Azure Storage resource and permission grant for user delegation SAS.
UserDelegationSasGranter: Grants expiration-aware Azure Storage user delegation SAS credentials.
UserDelegationSasPermissions: Permissions that can be granted by an Azure Storage user delegation SAS.
WorkloadIdentityCredentialProvider: Load credential from Azure Workload Identity.

Enums§

Credential: Credential enum for different Azure Storage authentication methods.
SasProtocol: Protocol restriction embedded in an Azure Storage SAS.
ServiceSasResource: Resource level for Azure Blob Storage Service SAS.