A customer asked me if they could expose an Azure Blob Storage Account through their existing Azure API Management (APIM) portal. In their case, the Storage Account was set to not allow public access and only allow private endpoint access. However, their front-end Single Page App (SPA) needed to be able to access blobs inside this container for display to the user. They already had APIM available for securely exposing their back-end publicly.
Therefore, they can add an endpoint to their existing API and have APIM direct the request to Blob Storage. In their case, the backend already generated a Shared Access Signature (SAS) token, so APIM didn’t need to generate one (using a Managed Identity).
Steps
First, a new endpoint needs to be added to the API to allow callers to request blobs. The backend needs to be set to the URI of Blob Storage.
In this API definition, we need to capture the path after the URI so we can append it to the backend URI later. We can use a wildcard to ensure all the forward slashes after the first one are captured {*path}. Using this syntax creates a template parameter with the captured URI for use later.
In the “Frontend” settings, we can define this.
In the “Inbound processing” section, we can define the APIM policy needed.
We will use the rewrite-uri policy to take the template parameter captured before and add it to the new URI.
<policies>
<inbound>
<base />
<rewrite-uri template="@(context.Request.MatchedParameters["path"])" copy-unmatched-params="true" />
...Now that we have APIM set up correctly, we can test we can access the blob through the APIM endpoint.
Original request directly against Blob Storage
Invoke-WebRequest -Uri "https://sty2uwyzq1mdiyz.blob.core.windows.net/test/nestedFolder1/nestedFolder2/demo-file.txt?sp=r&st=2024-11-11T22:37:52Z&se=2024-11-12T06:37:52Z&spr=https&sv=2022-11-02&sr=b&sig=8wHyoOno0jJNotARealSaSTokenBbFkgx%2Bv5lzXCALLuo%3D"
StatusCode : 200
StatusDescription : OK
Content : Q: What kind of bear is best?
A: False, black bear!New request through APIM
Invoke-WebRequest -Uri "https://apim-y2uwyzq1mdiyz.azure-api.net/testService/get-blob/test/nestedFolder1/nestedFolder2/demo-file.txt?sp=r&st=2024-11-11T22:37:52Z&se=2024-11-12T06:37:52Z&spr=https&sv=2022-11-02&sr=b&sig=8wHyoOno0jJNotARealSaSTokenBbFkgx%2Bv5lzXCALLuo%3D" -Headers $headers
StatusCode : 200
StatusDescription : OK
Content : Q: What kind of bear is best?
A: False, black bear!