AzCopy copy fails – RESPONSE Status : 403 This request is not authorized to perform this operation using this permission

by · Published · Updated



Hello Friends,

Hope you all are doing good !!! 🙂 .

In our previous article we have discussed about, how to configure and use AzCopy too . Today in this article we will discuss how to address one issue we experienced during our work with AzCopy tool.

Previous Azure series :

  1. Learn Basics Of Azure Networking In 60 Hours
  2. Learn Basic Of Azure Active Directory And Azure Identity And Access Management
  3. Azure DevOps – Learn at one place

If you have missed our previous articles on Azure Storage and Database Series, please check it in following links.

Issue Details :

Azcopy is a great command-line tool for automating Azure storage, it is a simple yet powerful command line interface that allows you to copy files to and from Azure storage and between Azure storage accounts. In my last lab exercise, I was working with AzCopy tool. As we had to upload and download files from local drive to my Azure blob and vice verse. In that exercise we have successfully downloaded AzCopy tool for my windows workstation also successfully login to my subscription. Then I had to upload a file to my Azure blob container by using the following command.

azcopy copy “C:\Users\moharman\Desktop\Rasmita.pdf” “https://kj21storageacount.blob.core.windows.net/kj-container/AzCopy Authorization.png”

Figure 1 – Microsoft Azure Storage and Database – Blob Service – AzCopy- Uploading

After few second I received a big error message, like RESPONSE Status : 403 This request is not authorized to perform this operation using this permission . Following is the details of the error message.

C:\MANAS DATA\AZURE\Azure_AZ-104\Azure Storage And Database Services\AZCopy\azcopy_windows_amd64_10.10.0>azcopy copy “C:\Users\moharman\Desktop\Rasmita.pdf” “https://kj21storageacount.blob.core.windows.net/kj-container/AzCopy Authorization.png”
INFO: Scanning…
INFO: Authenticating to destination using Azure AD
INFO: Any empty folders will not be processed, because source and/or destination doesn’t have full folder support

Job 69e09361-c4d3-b749-76da-a3759042812f has started
Log file is located at: C:\Users\moharman.azcopy\69e09361-c4d3-b749-76da-a3759042812f.log

INFO: Authentication failed, it is either not correct, or expired, or does not have the correct permission -> github.com/Azure/azure-storage-blob-go/azblob.newStorageError, /home/vsts/go/pkg/mod/github.com/!azure/azure-storage-blob-go@v0.10.1-0.20210407023846-16cf969ec1c3/azblob/zc_storage_error.go:42
===== RESPONSE ERROR (ServiceCode=AuthorizationPermissionMismatch) =====
Description=This request is not authorized to perform this operation using this permission.
RequestId:5188f336-801e-0071-0f7b-5fdab4000000
Time:2021-06-12T11:13:14.4715278Z, Details:
Code: AuthorizationPermissionMismatch
PUT https://kj21storageacount.blob.core.windows.net/kj-container/AzCopy%20Authorization.png?timeout=901
Authorization: REDACTED
Content-Length: [34020]
User-Agent: [AzCopy/10.10.0 Azure-Storage/0.13 (go1.15; Windows_NT)]
X-Ms-Blob-Cache-Control: []
X-Ms-Blob-Content-Disposition: []
X-Ms-Blob-Content-Encoding: []
X-Ms-Blob-Content-Language: []
X-Ms-Blob-Content-Md5: []
X-Ms-Blob-Content-Type: [application/pdf]
X-Ms-Blob-Type: [BlockBlob]
X-Ms-Client-Request-Id: [d8fa9da3-9a77-45fa-6aa8-6e292ba36080]
X-Ms-Version: [2019-12-12]

RESPONSE Status: 403 This request is not authorized to perform this operation using this permission.
Content-Length: [279]
Content-Type: [application/xml]
Date: [Sat, 12 Jun 2021 11:13:13 GMT]
Server: [Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0]
X-Ms-Client-Request-Id: [d8fa9da3-9a77-45fa-6aa8-6e292ba36080]
X-Ms-Error-Code: [AuthorizationPermissionMismatch]
X-Ms-Request-Id: [5188f336-801e-0071-0f7b-5fdab4000000]
X-Ms-Version: [2019-12-12]

Figure 2 – Microsoft Azure Storage and Database – Blob Service – AzCopy- Issue

As we can see the issue seems to be related to permissions. As I was writing an article on AzCopy tool, I knew that, the user must have at least one of the following role assignment to upload a new blob.

  • Storage Blob Data Contributor
  • Storage Blob Data Owner

The identity/account I was using has full access with all administrator roles assignment and owner roles assignment for the subscription and even I have configured the storage account and blob container using the same identity . So I was under impression that without the above role assignment I could upload the files but I was completely wrong. Also i came across with one article where it stated that, “Unlike most other areas in Azure the permissions of Owner don’t implicitly give you access to these ‘lower level’ permissions”.

Then I decided to assign one of the above role assignment to this account and for that I quickly move to my Storage Account (we can choose particular container also) => Access control (IAM) => Select Role Assignment Tab as showing in the following figure.

Figure 3 – Microsoft Azure Storage and Database – Blob Service – AzCopy- Add Role Assignment

And added one of the required role assignment as showing in the following figure.

Figure 4 – Microsoft Azure Storage and Database – Blob Service – AzCopy- AzCopy- Add Role Assignment

Now we have all required permission. When I re-run the command to upload file from my local drive to my azure container, it successfully uploaded my file as we can see in the following figures.

Figure 5 – Microsoft Azure Storage and Database – Blob Service – AzCopy- Uploaded
Figure 6 – Microsoft Azure Storage and Database – Blob Service – AzCopy- Uploaded

I hope this is informative to you. Please let me know if I missed anything important or if my understanding is not up to the mark.

Keep reading, share your thoughts, experiences. Feel free to contact us to discuss more.

If you have any suggestion / feedback / doubt, you are most welcome. Stay tuned on Knowledge-Junction, will come up with more such articles.

Thanks for reading 🙂 .

Tags:

Manas Ranjan Moharana

I'm a proud Indian, Son, Husband, Father, Author, Blogger, Self motivated person. I lives in Pune, Maharashtra and working for TietoEvry.pvt.ltd, to build Azure Solutions and Share Point Solutions.Microsoft certified Professional with 14 years of IT experience. Interest in learning and sharing something new, to be healthy.

You may also like...

1 Response

  1. Zane Wilson says:
    April 18, 2022 at 10:04 pm

    I am having a different 403 error. I am uploading large PST files for an email migration, and if the transfer takes too long, I get the same 403 Forbidden error that this article speaks about. I’m using the SAS logon documented by Microsoft here: https://docs.microsoft.com/en-us/microsoft-365/compliance/use-network-upload-to-import-pst-files?view=o365-worldwide

    Smaller files are fine – but when the transfer takes too long, the log file is fine for ages and then all of a sudden spits out a 403 and terminates. If there are many files in the directory being copied, they then all fail consecutively.

    Does azcopy create some sort of temporary key from the SAS URL (which presumably encodes a logon) that times out?

This site uses Akismet to reduce spam. Learn how your comment data is processed.

%d bloggers like this: