Cannot access source document location with the current permissions

Question

When trying this quickstart guide https://learn.microsoft.com/en-us/azure/cognitive-services/translator/document-translation/quickstarts/get-started-with-rest-api?pivots=programming-language-rest-api, I successfully created the translator and storage resources to translate documents in batch.

I use curl to try the translation, the api successfully accept the request:

cmd /c curl "https://<endpoint>.cognitiveservices.azure.com/translator/text/batch/v1.0/batches" -i -X POST --header "Content-Type: application/json" --header "Ocp-Apim-Subscription-Key: <key>" --data "@document-translation.json"

HTTP/1.1 202 Accepted

Content-Length: 0

X-RequestId: b4826024-29d4-4ffb-a53b-3335b12fc4a1

Operation-Location: https://<endpoint>.cognitiveservices.azure.com/translator/text/batch/v1.0/batches/4d003a4a-4032-4845-a3a7-f1736f56e87c

Strict-Transport-Security: max-age=31536000; includeSubDomains; preload

apim-request-id: b4826024-29d4-4ffb-a53b-3335b12fc4a1

x-content-type-options: nosniff

x-ms-region: East US

Date: Tue, 16 May 2023 20:19:03 GMT

This is the json:

{
    "inputs": [{
        "storageType": "File",
        "source": {
            "sourceUrl": "https://<endpoint>.blob.core.windows.net/src/document-translation-sample.docx?sp=r&st=2023-05-16T18:34:34Z&se=2023-05-17T02:34:34Z&skoid=a4db8411-463b-4a9f-84d3-75a1c98708f4&sktid=72f988bf-86f1-41af-91ab-2d7cd011db47&skt=2023-05-16T18:34:34Z&ske=2023-05-17T02:34:34Z&sks=b&skv=2022-11-02&spr=https&sv=2022-11-02&sr=b&sig=Xcmg41owGOsw7UkmDywELd5IHtz4vow1b%2Fr%2BC0SZetI%3D"
        },
        "targets": [{
            "targetUrl": "https://<endpoint>.blob.core.windows.net/tgt/Target-Spanish.docx?sp=wl&st=2023-05-16T16:59:38Z&se=2023-05-23T00:59:38Z&skoid=a4db8411-463b-4a9f-84d3-75a1c98708f4&sktid=72f988bf-86f1-41af-91ab-2d7cd011db47&skt=2023-05-16T16:59:38Z&ske=2023-05-23T00:59:38Z&sks=b&skv=2022-11-02&sv=2022-11-02&sr=c&sig=LLBw6qa38WsVGU6%2BtdNh2GeAl%2Fw5amrvdRlEm1aewjQ%3D",
            "language": "es"
        }]
    }]
}

When I try to get the status of the translation, I find that the service couldn't translate because some access error in the storage account:

{"id":"4d003a4a-4032-4845-a3a7-f1736f56e87c","createdDateTimeUtc":"2023-05-16T20:19:03.8964513Z","lastActionDateTimeUtc":"2023-05-16T20:19:04.4210061Z","status":"ValidationFailed","error":{"code":"InvalidRequest","message":"Cannot access source document location with the current permissions.","target":"Operation","innerError":{"code":"InvalidDocumentAccessLevel","message":"Cannot access source document location with the current permissions."}},"summary":{"total":0,"failed":0,"success":0,"inProgress":0,"notYetStarted":0,"cancelled":0,"totalCharacterCharged":0}}

Although I set the SAS (both source and target containers) as indicated in here https://learn.microsoft.com/en-us/azure/cognitive-services/Translator/document-translation/how-to-guides/create-sas-tokens?tabs=Containers

read, list for source and write, list for target.

I appreciate your help.

Answer 1

I was facing the same error but I was able to avoid it using different SAS token for input and output urls. It seems if the SAS token is the same, even if it contains all the permissions, the process fails.