Repository: vectordotdev/vector (language: rust)

Issue:
Azure Blob Storage: SAS tokens are supported alongside Access Keys
### A note for the community

<!-- Please keep this note for the community -->
* Please vote on this issue by adding a 👍 [reaction](https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/) to the original issue to help the community and maintainers prioritize this request
* If you are interested in working on this issue or have submitted a pull request, please leave a comment
<!-- Thank you for keeping this note for the community -->


### Use Cases

At the moment the documentation for Azure Blob on the connection string states that only Access Keys are supported for the `connection_string`, however this is not true, SAS tokens are supported. (See https://vector.dev/docs/reference/configuration/sinks/azure_blob/#connection_string)

The following options are required at the storage account level to create a SAS that is valid for Vector to pass health check + send data to blob storage.

![Screenshot 2022-11-29 at 9 28 58 PM](https://user-images.githubusercontent.com/67296324/204707750-908fa154-a130-41aa-abf3-ad9aa5983b81.png)

If you don't care about the health check, then you can drop `container` and `read` permissions.

![Screenshot 2022-11-29 at 9 27 54 PM](https://user-images.githubusercontent.com/67296324/204707616-e4b8f6e4-26c9-4e84-a67a-ca1337043a6f.png)


And one has to manually add `;AccountName=storageaccountname` even if the `connection_string` has a `BlobEndpoint=https://storageaccountname.blob.core.usgovcloudapi.net/` which overrides the `AccountName`. This was refactored in https://github.com/vectordotdev/vector/pull/15336 which means that this extra little bit is no longer required.


### Attempted Solutions

_No response_

### Proposal

_No response_

### References

- https://github.com/vectordotdev/vector/pull/15336

### Version

0.25.2


Discussion / hints:

Fix patch:
diff --git a/src/sinks/azure_blob/config.rs b/src/sinks/azure_blob/config.rs
index bdf1182f384ee..9d3df438ff625 100644
--- a/src/sinks/azure_blob/config.rs
+++ b/src/sinks/azure_blob/config.rs
@@ -42,12 +42,26 @@ impl TowerRequestConfigDefaults for AzureBlobTowerRequestConfigDefaults {
 pub struct AzureBlobSinkConfig {
     /// The Azure Blob Storage Account connection string.
     ///
-    /// Authentication with access key is the only supported authentication method.
+    /// Authentication with an access key or shared access signature (SAS)
+    /// are supported authentication methods. If using a non-account SAS,
+    /// healthchecks will fail and will need to be disabled by setting
+    /// `healthcheck.enabled` to `false` for this sink
+    ///
+    /// When generating an account SAS, the following are the minimum required option
+    /// settings for Vector to access blob storage and pass a health check.
+    /// | Option                 | Value              |
+    /// | ---------------------- | ------------------ |
+    /// | Allowed services       | Blob               |
+    /// | Allowed resource types | Container & Object |
+    /// | Allowed permissions    | Read & Create      |
     ///
     /// Either `storage_account`, or this field, must be specified.
     #[configurable(metadata(
         docs::examples = "DefaultEndpointsProtocol=https;AccountName=mylogstorage;AccountKey=storageaccountkeybase64encoded;EndpointSuffix=core.windows.net"
     ))]
+    #[configurable(metadata(
+        docs::examples = "BlobEndpoint=https://mylogstorage.blob.core.windows.net/;SharedAccessSignature=generatedsastoken"
+    ))]
     pub connection_string: Option<SensitiveString>,
 
     /// The Azure Blob Storage Account name.
diff --git a/website/cue/reference/components/sinks/base/azure_blob.cue b/website/cue/reference/components/sinks/base/azure_blob.cue
index 147a65125f54f..05e980c328bcf 100644
--- a/website/cue/reference/components/sinks/base/azure_blob.cue
+++ b/website/cue/reference/components/sinks/base/azure_blob.cue
@@ -149,12 +149,23 @@ base: components: sinks: azure_blob: configuration: {
 		description: """
 			The Azure Blob Storage Account connection string.
 
-			Authentication with access key is the only supported authentication method.
+			Authentication with an access key or shared access signature (SAS)
+			are supported authentication methods. If using a non-account SAS,
+			healthchecks will fail and will need to be disabled by setting
+			`healthcheck.enabled` to `false` for this sink
+
+			When generating an account SAS, the following are the minimum required option
+			settings for Vector to access blob storage and pass a health check.
+			| Option                 | Value              |
+			| ---------------------- | ------------------ |
+			| Allowed services       | Blob               |
+			| Allowed resource types | Container & Object |
+			| Allowed permissions    | Read & Create      |
 
 			Either `storage_account`, or this field, must be specified.
 			"""
 		required: false
-		type: string: examples: ["DefaultEndpointsProtocol=https;AccountName=mylogstorage;AccountKey=storageaccountkeybase64encoded;EndpointSuffix=core.windows.net"]
+		type: string: examples: ["DefaultEndpointsProtocol=https;AccountName=mylogstorage;AccountKey=storageaccountkeybase64encoded;EndpointSuffix=core.windows.net", "BlobEndpoint=https://mylogstorage.blob.core.windows.net/;SharedAccessSignature=generatedsastoken"]
 	}
 	container_name: {
 		description: "The Azure Blob Storage Account container name."


Test patch: