Azure Functions にマネージド ID を割り当ててユーザー委任 SAS トークンを発行する

using namespace System.Net

# Input bindings are passed in via param block.
param($Request, $TriggerMetadata)

# Write to the Azure Functions log stream.
Write-Host "PowerShell HTTP trigger function processed a request. Create SAS Uri."

$StorageAccountName = "<お使いのストレージアカウント名>"
$ContainerName = "<お使いのコンテナ名>"
$BlobName = $Request.Body.fileName

# https://docs.microsoft.com/ja-jp/azure/storage/blobs/storage-blob-user-delegation-sas-create-powershell
$ctx = New-AzStorageContext -StorageAccountName $StorageAccountName -UseConnectedAccount

# https://docs.microsoft.com/ja-jp/powershell/module/az.storage/new-azstorageblobsastoken?view=azps-5.7.0#example-2--generate-a-blob-sas-token-with-life-time
$StartTime = Get-Date
$EndTime = $StartTime.AddHours(2.0)

if ($BlobName)
{
    $Uri = New-AzStorageBlobSASToken -Context $ctx `
        -Container $ContainerName `
        -Blob $BlobName `
        -Permission racwd `
        -StartTime $startTime `
        -ExpiryTime $EndTime `
        -FullUri
}
else
{
# Blob 単位の SAS を発行したい場合
# https://docs.microsoft.com/ja-jp/azure/storage/blobs/storage-blob-user-delegation-sas-create-powershell#create-a-user-delegation-sas-for-a-blob
    $Uri = New-AzStorageContainerSASToken -Context $ctx `
        -Name $ContainerName `
        -Permission racwdl `
        -ExpiryTime $EndTime `
        -FullUri
}

# Associate values to output bindings by calling 'Push-OutputBinding'.
Push-OutputBinding -Name Response -Value ([HttpResponseContext]@{
    StatusCode = [HttpStatusCode]::OK
    Body = "{`"url`":`"" + $Uri + "`"}"
})

# This file enables modules to be automatically managed by the Functions service.
# See https://aka.ms/functionsmanageddependency for additional information.
#
@{
    # For latest supported version, go to 'https://www.powershellgallery.com/packages/Az'. 
    # To use the Az module in your function app, please uncomment the line below.
    'Az' = '5.*'
}

# Azure Functions profile.ps1
#
# This profile.ps1 will get executed every "cold start" of your Function App.
# "cold start" occurs when:
#
# * A Function App starts up for the very first time
# * A Function App starts up after being de-allocated due to inactivity
#
# You can define helper functions, run commands, or specify environment variables
# NOTE: any variables defined that are not environment variables will get reset after the first execution

# Authenticate with Azure PowerShell using MSI.
# Remove this if you are not planning on using MSI or Azure PowerShell.
if ($env:MSI_SECRET) {
    Disable-AzContextAutosave -Scope Process | Out-Null
    Connect-AzAccount -Identity
}

# Uncomment the next line to enable legacy AzureRm alias in Azure PowerShell.
Enable-AzureRmAlias

# You can also define functions or aliases that can be referenced in any of your PowerShell functions.

{
  "url": "https://<ストレージアカウント名>.blob.core.windows.net/<コンテナ名>?<SAS トーコン>"
}