Storage access keys and SAS tokens in Azure - Time & Space Complexity
We want to understand how the time to access Azure Storage changes when using access keys versus SAS tokens.
Specifically, how the number of operations grows as we perform more storage requests.
Analyze the time complexity of generating and using SAS tokens versus using storage access keys.
// Using storage access key directly
var client = new BlobServiceClient(storageAccountUrl, new StorageSharedKeyCredential(accountName, accountKey));
await client.GetBlobContainerClient(containerName).GetBlobClient(blobName).DownloadAsync();
// Using SAS token
var sasToken = GenerateSasToken(containerName, permissions, expiry);
var sasClient = new BlobServiceClient(storageAccountUrl + "?" + sasToken);
await sasClient.GetBlobContainerClient(containerName).GetBlobClient(blobName).DownloadAsync();
This code shows two ways to access blobs: one with a storage key, one with a SAS token.
Look at what repeats when accessing storage multiple times.
- Primary operation: Blob download requests to Azure Storage service.
- How many times: Once per blob access, regardless of key or SAS token.
- Additional operation for SAS: SAS token generation, which happens once per token creation.
Each blob download requires one request. SAS token generation is a one-time cost.
| Input Size (n) | Approx. Api Calls/Operations |
|---|---|
| 10 | 10 blob downloads + 1 SAS token generation (if using SAS) |
| 100 | 100 blob downloads + 1 SAS token generation |
| 1000 | 1000 blob downloads + 1 SAS token generation |
Pattern observation: The number of blob download calls grows linearly with n; SAS token generation stays constant.
Time Complexity: O(n)
This means the time grows directly in proportion to the number of storage accesses.
[X] Wrong: "Generating SAS tokens for each request is necessary and scales well."
[OK] Correct: Generating a SAS token each time adds extra overhead and is inefficient; usually one token is generated and reused for many requests.
Understanding how repeated storage access scales helps you design efficient cloud apps and shows you grasp practical cloud performance.
What if we generated a new SAS token for every blob access? How would the time complexity change?