Error: (InvalidDocumentAccessLevel): Cannot access source document location with the current permissions. Azure Translator service

Hi @Ridhima Nagar

As the solution worked for testing by using SAS but isn't feasible for your automated application. We can consider other options using Azure Managed Identities, Azure AD application, Storage account Key, Access control Lists (ACLs), Key vaults and Blob Storage Client libraries.

1. Managed Identities:
   • Azure Managed Identities provide an identity for applications to use when connecting to resources that support Azure AD authentication. This can help you avoid dealing with SAS tokens.
   • You can assign a managed identity to your application (e.g., an Azure VM, Azure App Service, or Azure Function) and then grant the necessary permissions to this identity to access the blob storage.
   • Your application can then use Azure SDKs to authenticate using the managed identity without needing to manage secrets or tokens.
2. Azure AD Authentication:
   • Use Azure Active Directory (Azure AD) to authenticate and authorize access to your Azure Blob Storage.
   • Set up role-based access control (RBAC) to grant the required permissions to your application's service principal or managed identity.
   • Use the Azure SDKs to obtain an OAuth token and access the storage account.
3. Storage Account Key:
   • Although not the most secure method, you can use storage account keys for accessing Azure Blob Storage.
   • Retrieve the storage account key from the Azure portal or through Azure CLI and configure your application to use this key for authentication.
   • Rotate your storage account keys regularly to enhance security.
4. Access Control Lists (ACLs):
   • Use Access Control Lists (ACLs) on your blobs or containers to control access.
   • This method allows you to define fine-grained access controls without relying on SAS tokens.
5. Azure Key Vault:
   • Store your storage account keys or other secrets in Azure Key Vault.
   • Configure your application to retrieve these secrets from Key Vault securely.
   • This approach reduces the risk of exposing sensitive information directly in your application code or configuration.
6. Azure Blob Storage Client Libraries:
   • Use Azure Blob Storage client libraries to simplify authentication and access management.
   • These libraries often support various authentication methods, including managed identities and Azure AD.

Here's a brief example of how you might use a managed identity with Azure SDK for Python:

from azure.identity import DefaultAzureCredential 
from azure.storage.blob import BlobServiceClient 

# Use DefaultAzureCredential to authenticate with managed identity 
credential = DefaultAzureCredential() 

# Create a BlobServiceClient using the managed identity 
blob_service_client = BlobServiceClient(account_url="https://<your-storage-account-name>.blob.core.windows.net", credential=credential) 

# Now you can perform operations like listing containers 
containers = blob_service_client.list_containers() 
for container in containers: 
	print(container.name)

By using one of these alternative approaches, you can avoid the need for SAS tokens and still securely access your Azure Blob Storage resources in an automated and scalable manner.

Hope this helps!

Please do consider to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you.

Thanks!