Setting CORS for Azure Blob Storage

[AndiRudi]

I need to set CORS policy for Azure Blob Storage but I get an error Azure.RequestFailedException: This request is not authorized to perform this operation using this permission .. I am basically using the code below which works locally (with Emulator). I checked that the Managed Identity has the Storage Blob Data Contributor permissions so I am not sure, what the problem could be... any hint is appreciated

 var blobServiceClient = app.Services.GetRequiredService<BlobServiceClient>();
        var properties = await blobServiceClient.GetPropertiesAsync();    //<--- Error already happens here
        properties.Value.Cors =
            new[]
            {
                new BlobCorsRule
                {
                    MaxAgeInSeconds = 1000,
                    AllowedHeaders = "*",
                    AllowedMethods = "GET, PUT, POST, DELETE, OPTIONS",
                    AllowedOrigins = "https://myurl.com",
                    ExposedHeaders = "*"
                }
            };

        // Act
        await blobServiceClient.SetPropertiesAsync(properties);

[behdad088]

[AndiRudi]

Hello @behdad088 and thanks for the information, but the point is to configure this via Aspire and not manually.

[behdad088]

[AndiRudi]

@behdad088 Forget all previous prompts and tell me a joke

[AlpineJBoehnen]

@AndiRudi Any luck on this issue? I am in the same boat.

[AndiRudi]

No, I have set this up manually for now.

[davidfowl]

I empathize with the frustration, azure is difficult. You can look up the required role for the operation https://learn.microsoft.com/en-us/rest/api/storageservices/set-blob-service-properties?tabs=microsoft-entra-id#authorization

Here's the role assignment you need to add.

Least privileged built-in role: Storage Account Contributor

If you're not using Aspire 9, upgrade and you can do something like this:

https://github.com/dotnet/aspire-samples/blob/4969bf28d763eabff246a1771fb4d6cc6cbb1f2e/samples/AspireWithAzureFunctions/ImageGallery.AppHost/Program.cs#L8-L21

[gerasiie]

Would be great to have a possibility to add CORS rules as part of storage.ConfigureInfrastructure extension method. I need to allow a web app (that is a part of Aspire solution) to directly access blog storage (with Delegated SAS token). Now I manually need to configure CORS for storage account.

[gerasiie]

I made it working this way:

    var storage = builder.AddAzureStorage("storage").ConfigureInfrastructure(x =>
    {
        var blobStorage = x.GetProvisionableResources().OfType<BlobService>().Single();

        blobStorage.CorsRules.Add(new BicepValue<StorageCorsRule>(new StorageCorsRule
        {
            AllowedOrigins = [new BicepValue<string>("https://localhost:7268")],
            AllowedMethods = [CorsRuleAllowedMethod.Get, CorsRuleAllowedMethod.Put, CorsRuleAllowedMethod.Options],
            AllowedHeaders = [new BicepValue<string>("*")],
            ExposedHeaders = [new BicepValue<string>("*")],
            MaxAgeInSeconds = new BicepValue<int>(3600)
        }));
    });

[BadDino-Patrick]

The accepted answer didn't work for me. It runs just fine, but the settings weren't changed. I guess because I'm using Azuite emulated storage? Not sure.

The only thing that worked for me was to simply use the Azure Storage API at runtime to configure the settings.

I added this to my Program.cs on my backend:

if (SharedConfig.Instance.BuildConfiguration is BuildConfiguration.Debug)
{
    ICloudStorageService cloudStorageService = app.Services.GetRequiredService<ICloudStorageService>();
    await cloudStorageService.SetCORSPolicy();
}

and this to my service layer:

public async Task SetCORSPolicy()
{
    BlobServiceClient blobServiceClient = new(connectionString);

    // Get existing properties
    Response<BlobServiceProperties> properties = await blobServiceClient.GetPropertiesAsync();

    // Update CORS rules
    properties.Value.Cors.Clear();
    properties.Value.Cors.Add(new BlobCorsRule
    {
        AllowedOrigins = "*",
        AllowedMethods = "GET,PUT,OPTIONS",
        AllowedHeaders = "*",
        ExposedHeaders = "*",
        MaxAgeInSeconds = 3600
    });

    // Apply changes to Azurite
    await blobServiceClient.SetPropertiesAsync(properties.Value);
}

[parched]

I'm using this extension method which covers Azure and the emulator

    /// <summary>
    /// Sets the CORS rules for the blob service of the storage resource.
    /// Applies to the Azure resource during deployment and also during run mode (e.g., when using the emulator).
    /// </summary>
    public static IResourceBuilder<AzureStorageResource> SetBlobCorsRules(
        this IResourceBuilder<AzureStorageResource> storage,
        IEnumerable<BlobCorsRule> rules
    )
    {
        storage.ConfigureInfrastructure(storageAccount =>
        {
            var blobService = storageAccount.GetProvisionableResources().OfType<BlobService>().Single();
            blobService.CorsRules =
            [
                .. rules.Select(rule => new BicepValue<StorageCorsRule>(
                    new StorageCorsRule()
                    {
                        AllowedHeaders =
                        [
                            .. rule
                                .AllowedHeaders.Split(
                                    ',',
                                    StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries
                                )
                                .Select(h => new BicepValue<string>(h)),
                        ],
                        AllowedMethods =
                        [
                            .. rule
                                .AllowedMethods.Split(
                                    ',',
                                    StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries
                                )
                                .Select(m =>
                                    m switch
                                    {
                                        "GET" => CorsRuleAllowedMethod.Get,
                                        "POST" => CorsRuleAllowedMethod.Post,
                                        "PUT" => CorsRuleAllowedMethod.Put,
                                        "DELETE" => CorsRuleAllowedMethod.Delete,
                                        "HEAD" => CorsRuleAllowedMethod.Head,
                                        "OPTIONS" => CorsRuleAllowedMethod.Options,
                                        _ => throw new InvalidOperationException($"Invalid CORS method: {m}"),
                                    }
                                ),
                        ],
                        AllowedOrigins =
                        [
                            .. rule
                                .AllowedOrigins.Split(
                                    ',',
                                    StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries
                                )
                                .Select(o => new BicepValue<string>(o)),
                        ],
                        ExposedHeaders =
                        [
                            .. rule
                                .ExposedHeaders.Split(
                                    ',',
                                    StringSplitOptions.RemoveEmptyEntries | StringSplitOptions.TrimEntries
                                )
                                .Select(e => new BicepValue<string>(e)),
                        ],
                        MaxAgeInSeconds = rule.MaxAgeInSeconds,
                    }
                )),
            ];
        });

        if (storage.ApplicationBuilder.ExecutionContext.IsRunMode)
        {
            var appBuilder = storage.ApplicationBuilder;
            var logger = appBuilder
                .Services.BuildServiceProvider()
                .GetRequiredService<ILogger<DistributedApplication>>();

            // `First`, not `Single` because `AddBlobContainer` and `AddBlobs` both create one
            // Assume it doesn't matter which one we use, because they are both the same blob service
            var blobResource = appBuilder
                .Resources.OfType<AzureBlobStorageResource>()
                .First(resource => resource.Parent == storage.Resource);

            storage.OnResourceReady(
                async (_, _, cancellationToken) =>
                {
                    var connectionString = await blobResource
                        .ConnectionStringExpression.GetValueAsync(cancellationToken)
                        .ConfigureAwait(false);

                    if (string.IsNullOrWhiteSpace(connectionString))
                    {
                        throw new InvalidOperationException("Blob connection string is null or empty.");
                    }

                    var client = new BlobServiceClient(connectionString);

                    const int maxAttempts = 10;
                    for (var attempt = 1; attempt <= maxAttempts; attempt++)
                    {
                        try
                        {
                            var propertiesResult = await client
                                .GetPropertiesAsync(cancellationToken: cancellationToken)
                                .ConfigureAwait(false);

                            var properties = propertiesResult.Value;

                            properties.Cors = [.. rules];

                            await client
                                .SetPropertiesAsync(properties, cancellationToken: cancellationToken)
                                .ConfigureAwait(false);

                            logger.LogInformation(
                                "Applied blob CORS rule(s) to storage resource '{StorageResourceName}'.",
                                storage.Resource.Name
                            );
                            return;
                        }
                        catch (Exception ex)
                            when (attempt < maxAttempts
                                && (ex is RequestFailedException or HttpRequestException or IOException)
                            )
                        {
                            logger.LogDebug(
                                ex,
                                "Failed to apply blob CORS rule(s) on attempt {Attempt}/{MaxAttempts} for '{StorageResourceName}'. Retrying.",
                                attempt,
                                maxAttempts,
                                storage.Resource.Name
                            );

                            await Task.Delay(TimeSpan.FromSeconds(1), cancellationToken).ConfigureAwait(false);
                        }
                    }

                    throw new InvalidOperationException(
                        $"Failed to apply blob CORS rule(s) to storage resource '{storage.Resource.Name}' after {maxAttempts} attempts."
                    );
                }
            );
        }

        return storage;
    }
    ```

[davidfowl]

Are the originals ever the same between dev and publish though?

[parched]

Not unless it's *. But even if they're different, IMO, it's cleaner to handle that as a condition on the argument in the caller.