I am using the task Azure file copy
to upload the build artefacts to the blob container. But I am always getting an error as preceding.
0.0 %, 0 Done, 0 Failed, 1 Pending, 0 Skipped, 1 Total,
INFO: Authentication failed, it is either not correct, or expired, or does not have the correct permission -> github.com/Azure/azure-storage-blob-go/azblob.newStorageError, /home/vsts/go/pkg/mod/github.com/!azure/azure-storage-blob-go@v0.10.1-0.20201022074806-8d8fc11be726/azblob/zc_storage_error.go:42
===== RESPONSE ERROR (ServiceCode=AuthorizationPermissionMismatch) =====
Description=This request is not authorized to perform this operation using this permission.
RequestId:ae545517-501e-00ce-0798-ea489e000000
Time:2021-12-06T11:54:25.0571292Z, Details:
Code: AuthorizationPermissionMismatch
PUT mybloburl?blockid=YjA4YjIzN2UtODJhMC1mMjQzLTUwOGYtNmYxNDcwOGJjZmY0&comp=block&timeout=901
Authorization: REDACTED
Content-Length: [8388608]
User-Agent: [TFS_useragent AzCopy/10.8.0 Azure-Storage/0.10 (go1.13; Windows_NT)]
X-Ms-Client-Request-Id: [65465-83ea-4410-450e-dd5b722b6cb3]
X-Ms-Version: [2019-12-12]
--------------------------------------------------------------------------------
RESPONSE Status: 403 This request is not authorized to perform this operation using this permission.
Below is my YAML
file content for this task.
steps:
- task: AzureFileCopy@4
displayName: 'AzureBlob File Copy'
inputs:
SourcePath: '$(Build.ArtifactStagingDirectory)/myfile.zip'
azureSubscription: 'my-azure-connection'
Destination: AzureBlob
storage: mystorage
ContainerName: mycontainer
After looking at this issue, I figured out what could be the reason. As you might have already known that a new service principal will be created whenever you create a service connection in the Azure DevOps, I have explained this in detail here. To make the AzureFileCopy@4
task work, we will have to add a role assignment under the Role Assignment in the resource group. You can see this when you click on the Access control (IAM). You can also click on the Manage service connection roles
in the service connection you had created for this purpose, which will redirect you to the IAM screen.
Storage Blob Data Contributor
or Storage Blob Data Owner
Manage Service Principal
link. My service principal looked like "AzureDevOps.userna.[guid]".)You can follow the same fix when you get the error "Upload to container: '' in storage account: '' with blob prefix: ''"