Describe the bug

Before #2873, setting the environment variable AZURE_STORAGE_SAS_TOKEN would work fine because the default behavior was to open the bucket via the environment: https://github.com/google/go-cloud/pull/2873/files#diff-9ee8a1ad2dadc385fec784185cfeacacb8796a02b4da3b576dfe5e3a9346d753L154-R169

Now, an account key MUST be provided for that to work, but that defeats the purpose of the SAS token in the first place.

To Reproduce

Attempt to download or upload a blob with AZURE_STORAGE_SAS_TOKEN and AZURE_STORAGE_ACCOUNT. Azure will attempt to access the file publicly:

FATAL: blob (key "myblob") (code=Unknown): write error: -> github.com/Azure/azure-storage-blob-go/azblob.newStorageError, /Users/stanhu/.gvm/pkgsets/go1.15.3/global/pkg/mod/github.com/!azure/[email protected]/azblob/zc_storage_error.go:42
===== RESPONSE ERROR (ServiceCode=PublicAccessNotPermitted) =====
Description=Public access is not permitted on this storage account.

Expected behavior

The upload works.

Version

v0.21.0

Additional context

I think the fix here should be to tweak that if statement to look at sasToken.