Storage access keys and SAS tokens in Azure - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is a Storage Access Key in Azure Storage?

A Storage Access Key is a secret key that grants full access to all data in an Azure Storage account. It acts like a master password to manage and access storage resources.

beginner

What does SAS stand for and what is its purpose?

SAS stands for Shared Access Signature. It allows you to grant limited and time-bound access to Azure Storage resources without sharing the storage account keys.

intermediate

How does a SAS token improve security compared to using Storage Access Keys directly?

A SAS token limits access by specifying permissions, resource types, and expiration time, reducing risk if the token is exposed. Storage Access Keys provide full access without restrictions.

intermediate

Name two types of SAS tokens in Azure Storage.

1. User Delegation SAS - uses Azure Active Directory credentials for enhanced security. 2. Service SAS - grants access based on storage account keys.

beginner

Why should you avoid sharing Storage Access Keys directly?

Because Storage Access Keys provide full control over the storage account, sharing them increases risk of unauthorized access. Using SAS tokens is safer as they limit permissions and duration.

What does a Shared Access Signature (SAS) token allow you to do?

A Reset the storage account keys

B Provide full access to the storage account

C Grant limited, time-bound access to storage resources

D Encrypt data in the storage account

A SAS token grants limited and time-bound access to storage resources without exposing full account keys.

Which of the following is a risk of sharing Storage Access Keys directly?

A Unauthorized full access to storage account

B Automatic expiration of access

C Limited access to specific files

D Access only to read data

Storage Access Keys provide full access, so sharing them risks unauthorized full control.

What is a User Delegation SAS?

A A SAS token signed with storage account keys

B A tool to encrypt storage data

C A key to reset storage account passwords

D A SAS token signed with Azure AD credentials

User Delegation SAS tokens are signed using Azure Active Directory credentials for better security.

Which permission can you NOT restrict with a SAS token?

A Write access

B Reset storage account keys

C Delete access

D Read access

SAS tokens cannot reset storage account keys; that requires full access via Storage Access Keys.

Why is it best practice to use SAS tokens instead of Storage Access Keys for sharing access?

A SAS tokens provide limited, revocable access

B Storage Access Keys only allow read access

C Storage Access Keys are free to share

D SAS tokens never expire

SAS tokens limit access scope and duration, making them safer for sharing.

Explain the difference between Storage Access Keys and SAS tokens in Azure Storage.

Think about access scope and security risks.

Describe scenarios where you would use a SAS token instead of a Storage Access Key.

Consider safety and control when sharing access.