Azure container and set public access to read only

manish260 · February 18, 2021, 5:25am

What is the problem you are having with rclone?

rclone do not seems to support to set public access level properties to the container. I know using mkdir command one can create container however what I cant able to do is to set public access from private(default) to blob or container. Note that from the azure storage portal I can change public access from private to blob or container at any time. Also It seems azure-sdk provides provision to set/reset public access to the container.
To me it seems a must-have feature and the ability should be added to the rclone tool as well.

What is your rclone version (output from `rclone version`)

v1.48.0

Which OS you are using and how many bits (eg Windows 7, 64 bit)

Fedora 29, 64 bit

Which cloud storage system are you using? (eg Google Drive)

Azure

The command you were trying to run (eg `rclone copy /tmp remote:tmp`)

I was expecting a command to set container access level using something similar to this command. However, if there is any other way we can able to set/reset container public access, please share.

rclone mkdir azure:mydemocontainer --public-access blob

Animosity022 · February 18, 2021, 11:52am

That's a very old version. Can you please try with the latest and report back?

ncw · February 18, 2021, 6:24pm

I think you are right - this isn't possible with rclone at the moment.

The equivalent command for s3 would be

  --s3-bucket-acl string                 Canned ACL used when creating buckets.

Would that make sense with azureblob? What would the ACLs be?

manish260 · February 19, 2021, 5:02am

Thanks!. Even the latest version does not seem to support it. Public access is hardcoded to default. I have raised a Git issue for it.

github.com

rclone/rclone/blob/7db68b72f12bfa71bd03f399c7e9302b2fc4fec7/backend/azureblob/azureblob.go#L1084


// makeContainer creates the container if it doesn't exist
func (f *Fs) makeContainer(ctx context.Context, container string) error {
	return f.cache.Create(container, func() error {
		// If this is a SAS URL limited to a container then assume it is already created
		if f.isLimited {
			return nil
		}
		// now try to create the container
		return f.pacer.Call(func() (bool, error) {
			_, err := f.cntURL(container).Create(ctx, azblob.Metadata{}, azblob.PublicAccessNone)
			if err != nil {
				if storageErr, ok := err.(azblob.StorageError); ok {
					switch storageErr.ServiceCode() {
					case azblob.ServiceCodeContainerAlreadyExists:
						return false, nil
					case azblob.ServiceCodeContainerBeingDeleted:
						// From https://docs.microsoft.com/en-us/rest/api/storageservices/delete-container
						// When a container is deleted, a container with the same name cannot be created
						// for at least 30 seconds; the container may not be available for more than 30
						// seconds if the service is still processing the request.

manish260 · February 19, 2021, 5:12am

Thanks Nick!.
Looks like ACLs values for S3 is totally different from Azure ACLs. Here in case of Azure it should be blob or container or None.

I think an additional flag something like --azureblob-public-access with value would suffice here. And this flag would be useful during sync/copy/mkdir command where if the container does not exist (or even exists), it should create with that additional public access level parameter.

azureblob-public-access <blob/container>

Command

rclone mkdir --azureblob-public-access blob azure:mydemocontainer

Does that make sense?

ncw · February 19, 2021, 10:26am

Thanks for making an issue - I'll reply there.

system · April 21, 2021, 6:26am

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.