Storage access keys and SAS tokens in Azure - Mini Project: Build & Apply

Storage access keys and SAS tokens

📖 Scenario: You are managing access to an Azure Storage account for a small company. You need to set up the initial storage account keys, then create a Shared Access Signature (SAS) token to allow limited access to a container without sharing the full keys.

🎯 Goal: Build a simple Azure Storage configuration that defines storage account keys and generates a SAS token with specific permissions.

📋 What You'll Learn

Create a dictionary called storage_keys with two keys: primary_key and secondary_key with exact string values.

Add a variable called container_name with the exact value mycontainer.

Write a function called generate_sas_token that takes container_name and returns a SAS token string with read and write permissions.

Create a final dictionary called storage_access that includes storage_keys, container_name, and the SAS token from generate_sas_token.

💡 Why This Matters

🌍 Real World

Managing access to Azure Storage accounts securely by using keys and SAS tokens is common in cloud applications to control who can read or write data.

💼 Career

Understanding storage keys and SAS tokens is essential for cloud engineers and developers working with Azure Storage to implement secure and flexible access controls.

1

Create storage account keys dictionary

Create a dictionary called storage_keys with the exact keys 'primary_key' and 'secondary_key' and their values as 'abc123primary' and 'xyz789secondary' respectively.

Azure

# Create the storage_keys dictionary with primary_key and secondary_key
# Your code here

Hint

Use curly braces to create a dictionary with the exact keys and values.

2

Add container name variable

Add a variable called container_name and set it to the string 'mycontainer'.

Azure

storage_keys = {
    'primary_key': 'abc123primary',
    'secondary_key': 'xyz789secondary'
}
# Add the container_name variable
# Your code here

Hint

Assign the exact string 'mycontainer' to the variable container_name.

3

Write SAS token generation function

Write a function called generate_sas_token that takes one parameter container_name and returns the string 'sas_token_for_' + container_name + '_rw' to simulate a SAS token with read and write permissions.

Azure

storage_keys = {
    'primary_key': 'abc123primary',
    'secondary_key': 'xyz789secondary'
}
container_name = 'mycontainer'
# Define the generate_sas_token function
# Your code here

Hint

Define a function that returns the SAS token string by concatenating fixed parts with the container_name parameter.

4

Create final storage access dictionary

Create a dictionary called storage_access with keys 'keys', 'container', and 'sas_token'. Assign storage_keys to 'keys', container_name to 'container', and the result of generate_sas_token(container_name) to 'sas_token'.

Azure

storage_keys = {
    'primary_key': 'abc123primary',
    'secondary_key': 'xyz789secondary'
}
container_name = 'mycontainer'

def generate_sas_token(container_name):
    return 'sas_token_for_' + container_name + '_rw'

# Create the storage_access dictionary
# Your code here

Hint

Create a dictionary with the exact keys and assign the correct variables and function call as values.

Practice

1. What is the main difference between a storage access key and a SAS token in Azure Storage?

easy

A. SAS tokens provide full access; storage access keys provide limited access.

B. Both provide full access but SAS tokens expire faster.

C. Storage access keys provide full access; SAS tokens provide limited, temporary access.

D. Storage access keys are only for blobs; SAS tokens are for all storage types.

Solution

1. Step 1: Understand storage access keys

   Storage access keys give full control over the entire storage account without restrictions.

2. Step 2: Understand SAS tokens

   SAS tokens grant limited, time-bound access to specific resources or actions within the storage account.

3. Final Answer:

   Storage access keys provide full access; SAS tokens provide limited, temporary access. -> Option C

4. Quick Check:

   Access scope = Full vs Limited [OK]

Hint: Full control = access keys; limited control = SAS tokens [OK]

Common Mistakes:

• Confusing SAS tokens as full access keys
• Thinking SAS tokens never expire
• Assuming access keys are resource-specific

2. Which of the following is the correct way to generate a SAS token for a blob container using Azure CLI?

easy

A. az storage blob generate-sas --container-name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage

B. az storage container generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage

C. az storage account generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z

D. az storage generate-sas --container mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z

Solution

1. Step 1: Identify the correct Azure CLI command for container SAS

   The command to generate a SAS token for a container is az storage container generate-sas.

2. Step 2: Check parameters

   az storage container generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage correctly uses container name, permissions, expiry, and account name parameters.

3. Final Answer:

   az storage container generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage -> Option B

4. Quick Check:

   Correct CLI command and parameters [OK]

Hint: Use 'container generate-sas' for containers, not 'blob generate-sas' [OK]

Common Mistakes:

• Using 'az storage blob generate-sas' for containers
• Omitting required parameters like --account-name
• Using incorrect command syntax

3. Given this SAS token snippet for a blob: ?sv=2023-01-01&ss=b&srt=sco&sp=rl&se=2024-07-01T00:00:00Z&st=2024-06-01T00:00:00Z&spr=https&sig=abc123, what permissions does it grant?

medium

A. Read and List permissions on blob service

B. Read and Write permissions on blob service

C. Full control on storage account

D. Only write permission on blob service

Solution

1. Step 1: Decode the SAS token parameters

   sp=rl means permissions are Read (r) and List (l).

2. Step 2: Understand service and resource types

   ss=b means the service is Blob storage.

3. Final Answer:

   Read and List permissions on blob service -> Option A

4. Quick Check:

   sp=rl means Read+List [OK]

Hint: Check 'sp' parameter for permissions letters [OK]

Common Mistakes:

• Confusing 'rl' with read-write
• Assuming full control from SAS token
• Ignoring service type 'ss' parameter

4. You created a SAS token with --permissions rwd but users report they cannot delete blobs. What is the likely cause?

medium

A. The SAS token lacks the 'Delete' permission 'x'.

B. The SAS token expired before use.

C. The storage account keys were regenerated.

D. The SAS token was generated for the wrong resource type.

Solution

1. Step 1: Understand permissions for delete

   Delete permission is represented by 'd', so 'rwd' includes delete.

2. Step 2: Check resource type relevance

   If the SAS token is generated for a container but used on blobs, or vice versa, permissions may not apply correctly.

3. Final Answer:

   The SAS token was generated for the wrong resource type. -> Option D

4. Quick Check:

   Permissions + resource type must match [OK]

Hint: Match SAS token resource type with intended use [OK]

Common Mistakes:

• Assuming 'x' is delete permission
• Ignoring resource type mismatch
• Not checking token expiry

5. You want to allow a third-party app to upload files to a specific blob container for 2 hours without exposing your storage account keys. Which approach is best?

hard

A. Generate a SAS token scoped to the container with write permission and 2-hour expiry.

B. Create a new storage account for the app.

C. Share the storage account access keys with the app.

D. Use a SAS token with full permissions and no expiry.

Solution

1. Step 1: Avoid sharing storage account keys

   Sharing keys gives full control and is insecure for third parties.

2. Step 2: Use SAS token with limited scope and expiry

   Generating a SAS token scoped to the container with write permission and a 2-hour expiry limits access and duration.

3. Step 3: Evaluate other options

   Creating a new storage account is unnecessary overhead; SAS token with full permissions and no expiry is insecure.

4. Final Answer:

   Generate a SAS token scoped to the container with write permission and 2-hour expiry. -> Option A

5. Quick Check:

   Limited scope + expiry = SAS token best practice [OK]

Hint: Use SAS tokens for limited, timed access, not keys [OK]

Common Mistakes:

• Sharing full access keys with third parties
• Using SAS tokens without expiry
• Creating unnecessary storage accounts