Examkin

Question

Difficulty: HardMove and Copy Blobs between Azure Storage Containers and Accounts

You are developing a script to migrate application logs between two Azure Storage accounts. You need to copy all blobs from a source container named `logs-prod` in a storage account named `srcstorage` to a destination container named `logs-archive` in a storage account named `deststorage`.

You decide to use the Azure CLI for this task and generate a Shared Access Signature (SAS) token for the source container. You execute the following command:

bash
az storage blob copy start-batch \
--destination-container logs-archive \
--account-name deststorage \
--account-key <dest-account-key> \
--source-container logs-prod \
--source-account-name srcstorage \
--source-sas "?sv=2025-01-05&sr=c&sp=r&se=2026-08-01T00:00:00Z&sig=..."

The command fails with an authorization error (`AuthorizationPermissionMismatch`) and no blobs are copied.

Which modification to the source SAS token configuration will resolve the error?

  1. A
    Add the Write (w) permission to the source SAS token so the copy process can write to the source metadata.
  2. B
    Modify the custom metadata on the source blobs to ensure all header keys are strictly in lowercase to prevent header authorization mismatches.
  3. Add the List (l) permission to the source SAS token at the container level.Answer
  4. D
    Acquire an active blob lease on the destination blobs and append the lease ID parameter to the source SAS token.

Answer

Add the List (l) permission to the source SAS token at the container level.
To copy multiple blobs in a batch operation using `az storage blob copy start-batch`, the Azure CLI must first list the source container's contents to identify the source blobs and then read their data. The SAS token provided in the source URI must grant both Read (r) and List (l) permissions at the container level. Since the current SAS token only has `sp=r` (Read), the command fails with an authorization error because it cannot list the blobs.

Step-by-Step Solution

1
Analyze the command and the error message.
The CLI command `az storage blob copy start-batch` is attempting a batch copy from the source container. The error is `AuthorizationPermissionMismatch`.
This error indicates that the SAS token provided for the source container lacks one or more permissions required to complete the operation.
2
Identify the operations performed by `start-batch`.
The command must first list the contents of the source container to identify which blobs to copy, and then read the content of each blob.
Listing requires the List (l) permission, while copying the data out requires the Read (r) permission.
3
Check the current SAS token permissions.
The SAS token query string contains `sp=r` (Read only) but is missing `l` (List).
Because List is missing, the Azure CLI cannot enumerate the source blobs, causing the batch command to fail before copying starts.

Key Concept

Required permissions for batch copying blobs using SAS tokens
Estimated Time:2m 0s
Rate this question

Topics

Move and Copy Blobs between Azure Storage Containers and Accounts

More questions from this topic