New-AzStorageAccountSASToken doesn't work with -UseConnectedAccount

[SSKLCP]

Description

I'm trying to generate a SAS token through PowerShell but keep running into this error:

New-AzStorageAccountSASToken: Value cannot be null. (Parameter 's')

This is happening when I run the commands:

Connect-AzAccount
$cont = New-AzStorageContext -StorageAccountName $SA_name -UseConnectedAccount
New-AzStorageAccountSASToken -Service blob -ResourceType object -Permission racwdlup -ExpiryTime (get-date).addhours(1) -Context $cont

But if I instead run:

$cont = New-AzStorageContext -StorageAccountName $SA_name -StorageAccountKey $Key1
New-AzStorageAccountSASToken -Service blob -ResourceType object -Permission racwdlup -ExpiryTime (get-date).addhours(1) -Context $cont

then it works without issue.

The account I'm connecting with has owner permissions to the storage account.

Issue script & Debug output

Connect-AzAccount
$cont = New-AzStorageContext -StorageAccountName $SA_name -UseConnectedAccount
New-AzStorageAccountSASToken -Service blob -ResourceType object -Permission racwdlup -ExpiryTime (get-date).addhours(1) -Context $cont

Environment data

Name                           Value
----                           -----
PSVersion                      7.2.0
PSEdition                      Core
GitCommitId                    7.2.0
OS                             Microsoft Windows 10.0.19042
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     2.7.1                 Az.Accounts                         {Add-AzEnvironment, Clear-AzContext, Clear-AzDefault, Connect-AzAccount…}
Script     4.1.1                 Az.Storage                          {Add-AzRmStorageContainerLegalHold, Add-AzStorageAccountManagementPolicyAction, Add-AzStorageAccountNetworkRule, Close-AzStorageFileHandle…}

Error output

Message        : Value cannot be null. (Parameter 's')
StackTrace     :    at System.Convert.FromBase64String(String s)
                    at Azure.Storage.StorageSharedKeyCredential.SetAccountKey(String accountKey)
                    at Azure.Storage.StorageSharedKeyCredential..ctor(String accountName, String accountKey)
                    at Microsoft.WindowsAzure.Commands.Storage.Common.Cmdlet.NewAzureStorageAccountSasTokenCommand.ExecuteCmdlet()
                    at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.<>c__3`1.<ExecuteSynchronouslyOrAsJob>b__3_0(T c)
                    at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet, Action`1 executor)
                    at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet)
                    at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
Exception      : System.ArgumentNullException
InvocationInfo : {New-AzStorageAccountSASToken}
Line           : New-AzStorageAccountSASToken -Service blob -ResourceType object -Permission racwdlup -ExpiryTime (get-date).addhours(1) -Context $cont -Verbose
Position       : At line:1 char:1
                 + New-AzStorageAccountSASToken -Service blob -ResourceType object -Perm …
                 + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId      : 14

[ghost]

Thank you for your feedback. This has been routed to the support team for assistance.

[ghost]

Thank you for your feedback. This has been routed to the support team for assistance.

[blueww]

@SSKLCP

With "-UseConnectedAccount", will create a storage context with AAD credential.
But Account sas does not support AAD credential. Only User delegation SAS support AAD credential, and it applies to Blob storage only.
See details in https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

So when create account sas, currently the storage context must be created with shared key credential.

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @xgithubtriage.

Issue Details

---

Description

I'm trying to generate a SAS token through PowerShell but keep running into this error:

New-AzStorageAccountSASToken: Value cannot be null. (Parameter 's')

This is happening when I run the commands:

Connect-AzAccount
$cont = New-AzStorageContext -StorageAccountName $SA_name -UseConnectedAccount
New-AzStorageAccountSASToken -Service blob -ResourceType object -Permission racwdlup -ExpiryTime (get-date).addhours(1) -Context $cont

But if I instead run:

$cont = New-AzStorageContext -StorageAccountName $SA_name -StorageAccountKey $Key1
New-AzStorageAccountSASToken -Service blob -ResourceType object -Permission racwdlup -ExpiryTime (get-date).addhours(1) -Context $cont

then it works without issue.

The account I'm connecting with has owner permissions to the storage account.

Issue script & Debug output

Connect-AzAccount
$cont = New-AzStorageContext -StorageAccountName $SA_name -UseConnectedAccount
New-AzStorageAccountSASToken -Service blob -ResourceType object -Permission racwdlup -ExpiryTime (get-date).addhours(1) -Context $cont

Environment data

Name                           Value
----                           -----
PSVersion                      7.2.0
PSEdition                      Core
GitCommitId                    7.2.0
OS                             Microsoft Windows 10.0.19042
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

ModuleType Version    PreRelease Name                                ExportedCommands
---------- -------    ---------- ----                                ----------------
Script     2.7.1                 Az.Accounts                         {Add-AzEnvironment, Clear-AzContext, Clear-AzDefault, Connect-AzAccount…}
Script     4.1.1                 Az.Storage                          {Add-AzRmStorageContainerLegalHold, Add-AzStorageAccountManagementPolicyAction, Add-AzStorageAccountNetworkRule, Close-AzStorageFileHandle…}

Error output

Message        : Value cannot be null. (Parameter 's')
StackTrace     :    at System.Convert.FromBase64String(String s)
                    at Azure.Storage.StorageSharedKeyCredential.SetAccountKey(String accountKey)
                    at Azure.Storage.StorageSharedKeyCredential..ctor(String accountName, String accountKey)
                    at Microsoft.WindowsAzure.Commands.Storage.Common.Cmdlet.NewAzureStorageAccountSasTokenCommand.ExecuteCmdlet()
                    at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.<>c__3`1.<ExecuteSynchronouslyOrAsJob>b__3_0(T c)
                    at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet, Action`1 executor)
                    at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet)
                    at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
Exception      : System.ArgumentNullException
InvocationInfo : {New-AzStorageAccountSASToken}
Line           : New-AzStorageAccountSASToken -Service blob -ResourceType object -Permission racwdlup -ExpiryTime (get-date).addhours(1) -Context $cont -Verbose
Position       : At line:1 char:1
                 + New-AzStorageAccountSASToken -Service blob -ResourceType object -Perm …
                 + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId      : 14

Author:	SSKLCP
Assignees:	blueww
Labels:	Storage, Service Attention, bug, question, customer-reported
Milestone:	-

[SSKLCP]

@SSKLCP

With "-UseConnectedAccount", will create a storage context with AAD credential. But Account sas does not support AAD credential. Only User delegation SAS support AAD credential, and it applies to Blob storage only. See details in https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview

So when create account sas, currently the storage context must be created with shared key credential.

Happy to accept that the REST API documentation supports this answer.
That said, the PowerShell documentation / error message could be updated to reflect this.

[navba-MSFT]

@SSKLCP Thanks for the feedback. We have created the above PR to enhance the documentation of the PS command to include the above information. the PR is in review phase now, If you have any further queries on this, please let us know.

[SSKLCP]

I'm happy :) Thank you very much