azure.storage.getAccountSAS (v4)

Azure v4.42.0 (4.x), Mar 9 26

We recommend using Azure Native.

Viewing docs for Azure v4.42.0 (Older version)
published on Monday, Mar 9, 2026 by Pulumi

Go to latest version

Schema (JSON)

pulumi/pulumi-azure

We recommend using Azure Native.

Viewing docs for Azure v4.42.0 (Older version)
published on Monday, Mar 9, 2026 by Pulumi

Go to latest version

Schema (JSON)

pulumi/pulumi-azure

Example Usage

using Pulumi;
using Azure = Pulumi.Azure;

class MyStack : Stack
{
    public MyStack()
    {
        var exampleResourceGroup = new Azure.Core.ResourceGroup("exampleResourceGroup", new Azure.Core.ResourceGroupArgs
        {
            Location = "West Europe",
        });
        var exampleAccount = new Azure.Storage.Account("exampleAccount", new Azure.Storage.AccountArgs
        {
            ResourceGroupName = exampleResourceGroup.Name,
            Location = "westus",
            AccountTier = "Standard",
            AccountReplicationType = "GRS",
            Tags = 
            {
                { "environment", "staging" },
            },
        });
        var exampleAccountSAS = Azure.Storage.GetAccountSAS.Invoke(new Azure.Storage.GetAccountSASInvokeArgs
        {
            ConnectionString = exampleAccount.PrimaryConnectionString,
            HttpsOnly = true,
            SignedVersion = "2017-07-29",
            ResourceTypes = new Azure.Storage.Inputs.GetAccountSASResourceTypesInputArgs
            {
                Service = true,
                Container = false,
                Object = false,
            },
            Services = new Azure.Storage.Inputs.GetAccountSASServicesInputArgs
            {
                Blob = true,
                Queue = false,
                Table = false,
                File = false,
            },
            Start = "2018-03-21T00:00:00Z",
            Expiry = "2020-03-21T00:00:00Z",
            Permissions = new Azure.Storage.Inputs.GetAccountSASPermissionsInputArgs
            {
                Read = true,
                Write = true,
                Delete = false,
                List = false,
                Add = true,
                Create = true,
                Update = false,
                Process = false,
            },
        });
        this.SasUrlQueryString = exampleAccountSAS.Apply(exampleAccountSAS => exampleAccountSAS.Sas);
    }

    [Output("sasUrlQueryString")]
    public Output<string> SasUrlQueryString { get; set; }
}

package main

import (
	"github.com/pulumi/pulumi-azure/sdk/v4/go/azure/core"
	"github.com/pulumi/pulumi-azure/sdk/v4/go/azure/storage"
	"github.com/pulumi/pulumi/sdk/v3/go/pulumi"
)

func main() {
	pulumi.Run(func(ctx *pulumi.Context) error {
		exampleResourceGroup, err := core.NewResourceGroup(ctx, "exampleResourceGroup", &core.ResourceGroupArgs{
			Location: pulumi.String("West Europe"),
		})
		if err != nil {
			return err
		}
		exampleAccount, err := storage.NewAccount(ctx, "exampleAccount", &storage.AccountArgs{
			ResourceGroupName:      exampleResourceGroup.Name,
			Location:               pulumi.String("westus"),
			AccountTier:            pulumi.String("Standard"),
			AccountReplicationType: pulumi.String("GRS"),
			Tags: pulumi.StringMap{
				"environment": pulumi.String("staging"),
			},
		})
		if err != nil {
			return err
		}
		exampleAccountSAS := storage.GetAccountSASOutput(ctx, storage.GetAccountSASOutputArgs{
			ConnectionString: exampleAccount.PrimaryConnectionString,
			HttpsOnly:        pulumi.Bool(true),
			SignedVersion:    pulumi.String("2017-07-29"),
			ResourceTypes: &storage.GetAccountSASResourceTypesArgs{
				Service:   pulumi.Bool(true),
				Container: pulumi.Bool(false),
				Object:    pulumi.Bool(false),
			},
			Services: &storage.GetAccountSASServicesArgs{
				Blob:  pulumi.Bool(true),
				Queue: pulumi.Bool(false),
				Table: pulumi.Bool(false),
				File:  pulumi.Bool(false),
			},
			Start:  pulumi.String("2018-03-21T00:00:00Z"),
			Expiry: pulumi.String("2020-03-21T00:00:00Z"),
			Permissions: &storage.GetAccountSASPermissionsArgs{
				Read:    pulumi.Bool(true),
				Write:   pulumi.Bool(true),
				Delete:  pulumi.Bool(false),
				List:    pulumi.Bool(false),
				Add:     pulumi.Bool(true),
				Create:  pulumi.Bool(true),
				Update:  pulumi.Bool(false),
				Process: pulumi.Bool(false),
			},
		}, nil)
		ctx.Export("sasUrlQueryString", exampleAccountSAS.ApplyT(func(exampleAccountSAS storage.GetAccountSASResult) (string, error) {
			return exampleAccountSAS.Sas, nil
		}).(pulumi.StringOutput))
		return nil
	})
}

Example coming soon!

import * as pulumi from "@pulumi/pulumi";
import * as azure from "@pulumi/azure";

const exampleResourceGroup = new azure.core.ResourceGroup("exampleResourceGroup", {location: "West Europe"});
const exampleAccount = new azure.storage.Account("exampleAccount", {
    resourceGroupName: exampleResourceGroup.name,
    location: "westus",
    accountTier: "Standard",
    accountReplicationType: "GRS",
    tags: {
        environment: "staging",
    },
});
const exampleAccountSAS = azure.storage.getAccountSASOutput({
    connectionString: exampleAccount.primaryConnectionString,
    httpsOnly: true,
    signedVersion: "2017-07-29",
    resourceTypes: {
        service: true,
        container: false,
        object: false,
    },
    services: {
        blob: true,
        queue: false,
        table: false,
        file: false,
    },
    start: "2018-03-21T00:00:00Z",
    expiry: "2020-03-21T00:00:00Z",
    permissions: {
        read: true,
        write: true,
        "delete": false,
        list: false,
        add: true,
        create: true,
        update: false,
        process: false,
    },
});
export const sasUrlQueryString = exampleAccountSAS.apply(exampleAccountSAS => exampleAccountSAS.sas);

import pulumi
import pulumi_azure as azure

example_resource_group = azure.core.ResourceGroup("exampleResourceGroup", location="West Europe")
example_account = azure.storage.Account("exampleAccount",
    resource_group_name=example_resource_group.name,
    location="westus",
    account_tier="Standard",
    account_replication_type="GRS",
    tags={
        "environment": "staging",
    })
example_account_sas = azure.storage.get_account_sas_output(connection_string=example_account.primary_connection_string,
    https_only=True,
    signed_version="2017-07-29",
    resource_types=azure.storage.GetAccountSASResourceTypesArgs(
        service=True,
        container=False,
        object=False,
    ),
    services=azure.storage.GetAccountSASServicesArgs(
        blob=True,
        queue=False,
        table=False,
        file=False,
    ),
    start="2018-03-21T00:00:00Z",
    expiry="2020-03-21T00:00:00Z",
    permissions=azure.storage.GetAccountSASPermissionsArgs(
        read=True,
        write=True,
        delete=False,
        list=False,
        add=True,
        create=True,
        update=False,
        process=False,
    ))
pulumi.export("sasUrlQueryString", example_account_sas.sas)

Example coming soon!

Using getAccountSAS

Two invocation forms are available. The direct form accepts plain arguments and either blocks until the result value is available, or returns a Promise-wrapped result. The output form accepts Input-wrapped arguments and returns an Output-wrapped result.

function getAccountSAS(args: GetAccountSASArgs, opts?: InvokeOptions): Promise<GetAccountSASResult>
function getAccountSASOutput(args: GetAccountSASOutputArgs, opts?: InvokeOptions): Output<GetAccountSASResult>

def get_account_sas(connection_string: Optional[str] = None,
                    expiry: Optional[str] = None,
                    https_only: Optional[bool] = None,
                    ip_addresses: Optional[str] = None,
                    permissions: Optional[GetAccountSASPermissions] = None,
                    resource_types: Optional[GetAccountSASResourceTypes] = None,
                    services: Optional[GetAccountSASServices] = None,
                    signed_version: Optional[str] = None,
                    start: Optional[str] = None,
                    opts: Optional[InvokeOptions] = None) -> GetAccountSASResult
def get_account_sas_output(connection_string: Optional[pulumi.Input[str]] = None,
                    expiry: Optional[pulumi.Input[str]] = None,
                    https_only: Optional[pulumi.Input[bool]] = None,
                    ip_addresses: Optional[pulumi.Input[str]] = None,
                    permissions: Optional[pulumi.Input[GetAccountSASPermissionsArgs]] = None,
                    resource_types: Optional[pulumi.Input[GetAccountSASResourceTypesArgs]] = None,
                    services: Optional[pulumi.Input[GetAccountSASServicesArgs]] = None,
                    signed_version: Optional[pulumi.Input[str]] = None,
                    start: Optional[pulumi.Input[str]] = None,
                    opts: Optional[InvokeOptions] = None) -> Output[GetAccountSASResult]

func GetAccountSAS(ctx *Context, args *GetAccountSASArgs, opts ...InvokeOption) (*GetAccountSASResult, error)
func GetAccountSASOutput(ctx *Context, args *GetAccountSASOutputArgs, opts ...InvokeOption) GetAccountSASResultOutput

> Note: This function is named GetAccountSAS in the Go SDK.

public static class GetAccountSAS 
{
    public static Task<GetAccountSASResult> InvokeAsync(GetAccountSASArgs args, InvokeOptions? opts = null)
    public static Output<GetAccountSASResult> Invoke(GetAccountSASInvokeArgs args, InvokeOptions? opts = null)
}

public static CompletableFuture<GetAccountSASResult> getAccountSAS(GetAccountSASArgs args, InvokeOptions options)
public static Output<GetAccountSASResult> getAccountSAS(GetAccountSASArgs args, InvokeOptions options)

fn::invoke:
  function: azure:storage/getAccountSAS:getAccountSAS
  arguments:
    # arguments dictionary

The following arguments are supported:

ConnectionString string: The connection string for the storage account to which this SAS applies. Typically directly from the primary_connection_string attribute of a azure.storage.Account resource.
Expiry string: The expiration time and date of this SAS. Must be a valid ISO-8601 format time/date string.
Permissions GetAccountSASPermissions: A permissions block as defined below.
ResourceTypes GetAccountSASResourceTypes: A resource_types block as defined below.
Services GetAccountSASServices: A services block as defined below.
Start string: The starting time and date of validity of this SAS. Must be a valid ISO-8601 format time/date string.
HttpsOnly bool: Only permit https access. If false, both http and https are permitted. Defaults to true.
IpAddresses string: IP address, or a range of IP addresses, from which to accept requests. When specifying a range, note that the range is inclusive.
SignedVersion string: Specifies the signed storage service version to use to authorize requests made with this account SAS. Defaults to 2017-07-29.

ConnectionString string: The connection string for the storage account to which this SAS applies. Typically directly from the primary_connection_string attribute of a azure.storage.Account resource.
Expiry string: The expiration time and date of this SAS. Must be a valid ISO-8601 format time/date string.
Permissions GetAccountSASPermissions: A permissions block as defined below.
ResourceTypes GetAccountSASResourceTypes: A resource_types block as defined below.
Services GetAccountSASServices: A services block as defined below.
Start string: The starting time and date of validity of this SAS. Must be a valid ISO-8601 format time/date string.
HttpsOnly bool: Only permit https access. If false, both http and https are permitted. Defaults to true.
IpAddresses string: IP address, or a range of IP addresses, from which to accept requests. When specifying a range, note that the range is inclusive.
SignedVersion string: Specifies the signed storage service version to use to authorize requests made with this account SAS. Defaults to 2017-07-29.

connectionString String: The connection string for the storage account to which this SAS applies. Typically directly from the primary_connection_string attribute of a azure.storage.Account resource.
expiry String: The expiration time and date of this SAS. Must be a valid ISO-8601 format time/date string.
permissions GetAccountSASPermissions: A permissions block as defined below.
resourceTypes GetAccountSASResourceTypes: A resource_types block as defined below.
services GetAccountSASServices: A services block as defined below.
start String: The starting time and date of validity of this SAS. Must be a valid ISO-8601 format time/date string.
httpsOnly Boolean: Only permit https access. If false, both http and https are permitted. Defaults to true.
ipAddresses String: IP address, or a range of IP addresses, from which to accept requests. When specifying a range, note that the range is inclusive.
signedVersion String: Specifies the signed storage service version to use to authorize requests made with this account SAS. Defaults to 2017-07-29.

connectionString string: The connection string for the storage account to which this SAS applies. Typically directly from the primary_connection_string attribute of a azure.storage.Account resource.
expiry string: The expiration time and date of this SAS. Must be a valid ISO-8601 format time/date string.
permissions GetAccountSASPermissions: A permissions block as defined below.
resourceTypes GetAccountSASResourceTypes: A resource_types block as defined below.
services GetAccountSASServices: A services block as defined below.
start string: The starting time and date of validity of this SAS. Must be a valid ISO-8601 format time/date string.
httpsOnly boolean: Only permit https access. If false, both http and https are permitted. Defaults to true.
ipAddresses string: IP address, or a range of IP addresses, from which to accept requests. When specifying a range, note that the range is inclusive.
signedVersion string: Specifies the signed storage service version to use to authorize requests made with this account SAS. Defaults to 2017-07-29.

connection_string str: The connection string for the storage account to which this SAS applies. Typically directly from the primary_connection_string attribute of a azure.storage.Account resource.
expiry str: The expiration time and date of this SAS. Must be a valid ISO-8601 format time/date string.
permissions GetAccountSASPermissions: A permissions block as defined below.
resource_types GetAccountSASResourceTypes: A resource_types block as defined below.
services GetAccountSASServices: A services block as defined below.
start str: The starting time and date of validity of this SAS. Must be a valid ISO-8601 format time/date string.
https_only bool: Only permit https access. If false, both http and https are permitted. Defaults to true.
ip_addresses str: IP address, or a range of IP addresses, from which to accept requests. When specifying a range, note that the range is inclusive.
signed_version str: Specifies the signed storage service version to use to authorize requests made with this account SAS. Defaults to 2017-07-29.

connectionString String: The connection string for the storage account to which this SAS applies. Typically directly from the primary_connection_string attribute of a azure.storage.Account resource.
expiry String: The expiration time and date of this SAS. Must be a valid ISO-8601 format time/date string.
permissions Property Map: A permissions block as defined below.
resourceTypes Property Map: A resource_types block as defined below.
services Property Map: A services block as defined below.
start String: The starting time and date of validity of this SAS. Must be a valid ISO-8601 format time/date string.
httpsOnly Boolean: Only permit https access. If false, both http and https are permitted. Defaults to true.
ipAddresses String: IP address, or a range of IP addresses, from which to accept requests. When specifying a range, note that the range is inclusive.
signedVersion String: Specifies the signed storage service version to use to authorize requests made with this account SAS. Defaults to 2017-07-29.

getAccountSAS Result

The following output properties are available:

ConnectionString string
Expiry string
Id string: The provider-assigned unique ID for this managed resource.
Permissions GetAccountSASPermissions
ResourceTypes GetAccountSASResourceTypes
Sas string: The computed Account Shared Access Signature (SAS).
Services GetAccountSASServices
Start string
HttpsOnly bool
IpAddresses string
SignedVersion string

ConnectionString string
Expiry string
Id string: The provider-assigned unique ID for this managed resource.
Permissions GetAccountSASPermissions
ResourceTypes GetAccountSASResourceTypes
Sas string: The computed Account Shared Access Signature (SAS).
Services GetAccountSASServices
Start string
HttpsOnly bool
IpAddresses string
SignedVersion string

connectionString String
expiry String
id String: The provider-assigned unique ID for this managed resource.
permissions GetAccountSASPermissions
resourceTypes GetAccountSASResourceTypes
sas String: The computed Account Shared Access Signature (SAS).
services GetAccountSASServices
start String
httpsOnly Boolean
ipAddresses String
signedVersion String

connectionString string
expiry string
id string: The provider-assigned unique ID for this managed resource.
permissions GetAccountSASPermissions
resourceTypes GetAccountSASResourceTypes
sas string: The computed Account Shared Access Signature (SAS).
services GetAccountSASServices
start string
httpsOnly boolean
ipAddresses string
signedVersion string

connection_string str
expiry str
id str: The provider-assigned unique ID for this managed resource.
permissions GetAccountSASPermissions
resource_types GetAccountSASResourceTypes
sas str: The computed Account Shared Access Signature (SAS).
services GetAccountSASServices
start str
https_only bool
ip_addresses str
signed_version str

connectionString String
expiry String
id String: The provider-assigned unique ID for this managed resource.
permissions Property Map
resourceTypes Property Map
sas String: The computed Account Shared Access Signature (SAS).
services Property Map
start String
httpsOnly Boolean
ipAddresses String
signedVersion String

Supporting Types

GetAccountSASPermissions

Add bool: Should Add permissions be enabled for this SAS?
Create bool: Should Create permissions be enabled for this SAS?
Delete bool: Should Delete permissions be enabled for this SAS?
List bool: Should List permissions be enabled for this SAS?
Process bool: Should Process permissions be enabled for this SAS?
Read bool: Should Read permissions be enabled for this SAS?
Update bool: Should Update permissions be enabled for this SAS?
Write bool: Should Write permissions be enabled for this SAS?

Add bool: Should Add permissions be enabled for this SAS?
Create bool: Should Create permissions be enabled for this SAS?
Delete bool: Should Delete permissions be enabled for this SAS?
List bool: Should List permissions be enabled for this SAS?
Process bool: Should Process permissions be enabled for this SAS?
Read bool: Should Read permissions be enabled for this SAS?
Update bool: Should Update permissions be enabled for this SAS?
Write bool: Should Write permissions be enabled for this SAS?

add Boolean: Should Add permissions be enabled for this SAS?
create Boolean: Should Create permissions be enabled for this SAS?
delete Boolean: Should Delete permissions be enabled for this SAS?
list Boolean: Should List permissions be enabled for this SAS?
process Boolean: Should Process permissions be enabled for this SAS?
read Boolean: Should Read permissions be enabled for this SAS?
update Boolean: Should Update permissions be enabled for this SAS?
write Boolean: Should Write permissions be enabled for this SAS?

add boolean: Should Add permissions be enabled for this SAS?
create boolean: Should Create permissions be enabled for this SAS?
delete boolean: Should Delete permissions be enabled for this SAS?
list boolean: Should List permissions be enabled for this SAS?
process boolean: Should Process permissions be enabled for this SAS?
read boolean: Should Read permissions be enabled for this SAS?
update boolean: Should Update permissions be enabled for this SAS?
write boolean: Should Write permissions be enabled for this SAS?

add bool: Should Add permissions be enabled for this SAS?
create bool: Should Create permissions be enabled for this SAS?
delete bool: Should Delete permissions be enabled for this SAS?
list bool: Should List permissions be enabled for this SAS?
process bool: Should Process permissions be enabled for this SAS?
read bool: Should Read permissions be enabled for this SAS?
update bool: Should Update permissions be enabled for this SAS?
write bool: Should Write permissions be enabled for this SAS?

add Boolean: Should Add permissions be enabled for this SAS?
create Boolean: Should Create permissions be enabled for this SAS?
delete Boolean: Should Delete permissions be enabled for this SAS?
list Boolean: Should List permissions be enabled for this SAS?
process Boolean: Should Process permissions be enabled for this SAS?
read Boolean: Should Read permissions be enabled for this SAS?
update Boolean: Should Update permissions be enabled for this SAS?
write Boolean: Should Write permissions be enabled for this SAS?

GetAccountSASResourceTypes

Container bool: Should permission be granted to the container?
Object bool: Should permission be granted only to a specific object?
Service bool: Should permission be granted to the entire service?

Container bool: Should permission be granted to the container?
Object bool: Should permission be granted only to a specific object?
Service bool: Should permission be granted to the entire service?

container Boolean: Should permission be granted to the container?
object Boolean: Should permission be granted only to a specific object?
service Boolean: Should permission be granted to the entire service?

container boolean: Should permission be granted to the container?
object boolean: Should permission be granted only to a specific object?
service boolean: Should permission be granted to the entire service?

container bool: Should permission be granted to the container?
object bool: Should permission be granted only to a specific object?
service bool: Should permission be granted to the entire service?

container Boolean: Should permission be granted to the container?
object Boolean: Should permission be granted only to a specific object?
service Boolean: Should permission be granted to the entire service?

GetAccountSASServices

Blob bool: Should permission be granted to blob services within this storage account?
File bool: Should permission be granted to file services within this storage account?
Queue bool: Should permission be granted to queue services within this storage account?
Table bool: Should permission be granted to table services within this storage account?

Blob bool: Should permission be granted to blob services within this storage account?
File bool: Should permission be granted to file services within this storage account?
Queue bool: Should permission be granted to queue services within this storage account?
Table bool: Should permission be granted to table services within this storage account?

blob Boolean: Should permission be granted to blob services within this storage account?
file Boolean: Should permission be granted to file services within this storage account?
queue Boolean: Should permission be granted to queue services within this storage account?
table Boolean: Should permission be granted to table services within this storage account?

blob boolean: Should permission be granted to blob services within this storage account?
file boolean: Should permission be granted to file services within this storage account?
queue boolean: Should permission be granted to queue services within this storage account?
table boolean: Should permission be granted to table services within this storage account?

blob bool: Should permission be granted to blob services within this storage account?
file bool: Should permission be granted to file services within this storage account?
queue bool: Should permission be granted to queue services within this storage account?
table bool: Should permission be granted to table services within this storage account?

blob Boolean: Should permission be granted to blob services within this storage account?
file Boolean: Should permission be granted to file services within this storage account?
queue Boolean: Should permission be granted to queue services within this storage account?
table Boolean: Should permission be granted to table services within this storage account?