Скачать или смотреть How to Add a Shared Access Policy to an Azure Service Bus Queue Using Python

Learn the correct way to create and update Shared Access policies on Azure Service Bus queues with Python, including a workaround for known SDK issues.
---
This video is based on the question https://stackoverflow.com/q/79484309/ asked by the user 'Jeff' ( https://stackoverflow.com/u/9241857/ ) and on the answer https://stackoverflow.com/a/79485138/ provided by the user 'swathipil-msft' ( https://stackoverflow.com/u/15364179/ ) at 'Stack Overflow' website. Thanks to these great users and Stackexchange community for their contributions.

Visit these links for original content and any more details, such as alternate solutions, latest updates/developments on topic, comments, revision history etc. For example, the original title of the Question was: Adding Shared Access policy to Queue with python in ASB

Also, Content (except music) licensed under CC BY-SA https://meta.stackexchange.com/help/l...
The original Question post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license, and the original Answer post is licensed under the 'CC BY-SA 4.0' ( https://creativecommons.org/licenses/... ) license.

If anything seems off to you, please feel free to drop me a comment under this video.
---
Introduction

Managing access to Azure Service Bus queues is essential for secure communication. Shared Access Signatures (SAS) policies enable fine-grained permissions like send and listen operations.

This post addresses how to add a new Shared Access Policy to an existing Service Bus queue using Python, and highlights a known issue in the Azure SDK with the solution.



The Problem

You might try to use the Azure Service Bus Python SDK's get_queue and update_queue methods to fetch and modify queue authorization rules:

[[See Video to Reveal this Text or Code Snippet]]

However, calling update_queue results in a HTTP 400 Bad Request error — due to a bug in the SDK's AuthorizationRule model serialization.



Why Does This Happen?

The SDK expects certain mandatory fields for the authorization rule.

The AuthorizationRule instance must specify the rule type, keys (primary_key and secondary_key), and properly formatted permissions.

Missing or incorrectly set fields cause Azure Service Bus to reject the update request.



The Fix: Properly Constructing AuthorizationRule

Wait for the fix in the upcoming Azure Service Bus SDK release that addresses this bug.

Meanwhile, you can create a compliant AuthorizationRule like this:

[[See Video to Reveal this Text or Code Snippet]]

Key points:

Set type="SharedAccessAuthorizationRule" explicitly.

Provide generated primary_key and secondary_key with secure random values.

Use AccessRights.LISTEN and AccessRights.SEND constants.



Summary

Directly modifying a queue's authorization_rules requires careful setup because the Azure SDK expects fully defined authorization rules.

Always include keys and the correct type to avoid 400 errors.

Use the secure key generation approach shown above.

Keep your azure-servicebus package up to date to get official fixes.

This method empowers you to programmatically manage precise access policies on queues, improving your Azure Service Bus security management with Python.