Storage access keys and SAS tokens in Azure - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to create a SAS token with read permission.

Azure

sas_token = generate_sas(account_name, account_key, permission='[1]')

Drag options to blanks, or click blank then click option'

Awrite

Bread

Cdelete

Dlist

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'write' permission when only reading is needed.

Confusing 'list' permission with 'read'.

The SAS token must have 'read' permission to allow reading data.

2fill in blank

medium

Complete the code to specify the expiry time for the SAS token.

Azure

expiry_time = datetime.utcnow() + timedelta(hours=[1])

Drag options to blanks, or click blank then click option'

A1

B24

C0

D48

Attempts:

3 left

💡 Hint

Common Mistakes

Setting expiry to 0 hours which means immediate expiry.

Setting expiry too long, increasing risk.

The SAS token expiry is set to 1 hour from now for security best practice.

3fill in blank

hard

Fix the error in the code to generate a SAS token for a blob container.

Azure

sas_token = generate_container_sas(account_name, account_key, container_name, permission='[1]')

Drag options to blanks, or click blank then click option'

Adelete

Bcreate

Cexecute

Dread

Attempts:

3 left

💡 Hint

Common Mistakes

Using invalid permission 'execute' causing errors.

Confusing 'create' with 'read' permission.

Only valid permissions like 'read' can be used for container SAS tokens. 'execute' is invalid.

4fill in blank

hard

Fill both blanks to create a SAS token with write permission and expiry in 2 hours.

Azure

sas_token = generate_sas(account_name, account_key, permission='[1]', expiry=datetime.utcnow() + timedelta(hours=[2]))

Drag options to blanks, or click blank then click option'

Awrite

Bread

C2

D24

Attempts:

3 left

💡 Hint

Common Mistakes

Using 'read' permission instead of 'write'.

Setting expiry to 24 hours instead of 2.

The SAS token needs 'write' permission and expiry set to 2 hours from now.

5fill in blank

hard

Fill all three blanks to generate a SAS token with read permission, expiry in 4 hours, and resource type 'b'.

Azure

sas_token = generate_sas(account_name, account_key, permission='[1]', expiry=datetime.utcnow() + timedelta(hours=[2]), resource='[3]')

Drag options to blanks, or click blank then click option'

Awrite

Bread

C4

Db

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong resource type like 'c' instead of 'b'.

Setting permission to 'write' instead of 'read'.

The SAS token must have 'read' permission, expire in 4 hours, and target resource type 'b' (blob).

Practice

1. What is the main difference between a storage access key and a SAS token in Azure Storage?

easy

A. SAS tokens provide full access; storage access keys provide limited access.

B. Both provide full access but SAS tokens expire faster.

C. Storage access keys provide full access; SAS tokens provide limited, temporary access.

D. Storage access keys are only for blobs; SAS tokens are for all storage types.

Solution

1. Step 1: Understand storage access keys

   Storage access keys give full control over the entire storage account without restrictions.

2. Step 2: Understand SAS tokens

   SAS tokens grant limited, time-bound access to specific resources or actions within the storage account.

3. Final Answer:

   Storage access keys provide full access; SAS tokens provide limited, temporary access. -> Option C

4. Quick Check:

   Access scope = Full vs Limited [OK]

Hint: Full control = access keys; limited control = SAS tokens [OK]

Common Mistakes:

• Confusing SAS tokens as full access keys
• Thinking SAS tokens never expire
• Assuming access keys are resource-specific

2. Which of the following is the correct way to generate a SAS token for a blob container using Azure CLI?

easy

A. az storage blob generate-sas --container-name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage

B. az storage container generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage

C. az storage account generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z

D. az storage generate-sas --container mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z

Solution

1. Step 1: Identify the correct Azure CLI command for container SAS

   The command to generate a SAS token for a container is az storage container generate-sas.

2. Step 2: Check parameters

   az storage container generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage correctly uses container name, permissions, expiry, and account name parameters.

3. Final Answer:

   az storage container generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage -> Option B

4. Quick Check:

   Correct CLI command and parameters [OK]

Hint: Use 'container generate-sas' for containers, not 'blob generate-sas' [OK]

Common Mistakes:

• Using 'az storage blob generate-sas' for containers
• Omitting required parameters like --account-name
• Using incorrect command syntax

3. Given this SAS token snippet for a blob: ?sv=2023-01-01&ss=b&srt=sco&sp=rl&se=2024-07-01T00:00:00Z&st=2024-06-01T00:00:00Z&spr=https&sig=abc123, what permissions does it grant?

medium

A. Read and List permissions on blob service

B. Read and Write permissions on blob service

C. Full control on storage account

D. Only write permission on blob service

Solution

1. Step 1: Decode the SAS token parameters

   sp=rl means permissions are Read (r) and List (l).

2. Step 2: Understand service and resource types

   ss=b means the service is Blob storage.

3. Final Answer:

   Read and List permissions on blob service -> Option A

4. Quick Check:

   sp=rl means Read+List [OK]

Hint: Check 'sp' parameter for permissions letters [OK]

Common Mistakes:

• Confusing 'rl' with read-write
• Assuming full control from SAS token
• Ignoring service type 'ss' parameter

4. You created a SAS token with --permissions rwd but users report they cannot delete blobs. What is the likely cause?

medium

A. The SAS token lacks the 'Delete' permission 'x'.

B. The SAS token expired before use.

C. The storage account keys were regenerated.

D. The SAS token was generated for the wrong resource type.

Solution

1. Step 1: Understand permissions for delete

   Delete permission is represented by 'd', so 'rwd' includes delete.

2. Step 2: Check resource type relevance

   If the SAS token is generated for a container but used on blobs, or vice versa, permissions may not apply correctly.

3. Final Answer:

   The SAS token was generated for the wrong resource type. -> Option D

4. Quick Check:

   Permissions + resource type must match [OK]

Hint: Match SAS token resource type with intended use [OK]

Common Mistakes:

• Assuming 'x' is delete permission
• Ignoring resource type mismatch
• Not checking token expiry

5. You want to allow a third-party app to upload files to a specific blob container for 2 hours without exposing your storage account keys. Which approach is best?

hard

A. Generate a SAS token scoped to the container with write permission and 2-hour expiry.

B. Create a new storage account for the app.

C. Share the storage account access keys with the app.

D. Use a SAS token with full permissions and no expiry.

Solution

1. Step 1: Avoid sharing storage account keys

   Sharing keys gives full control and is insecure for third parties.

2. Step 2: Use SAS token with limited scope and expiry

   Generating a SAS token scoped to the container with write permission and a 2-hour expiry limits access and duration.

3. Step 3: Evaluate other options

   Creating a new storage account is unnecessary overhead; SAS token with full permissions and no expiry is insecure.

4. Final Answer:

   Generate a SAS token scoped to the container with write permission and 2-hour expiry. -> Option A

5. Quick Check:

   Limited scope + expiry = SAS token best practice [OK]

Hint: Use SAS tokens for limited, timed access, not keys [OK]

Common Mistakes:

• Sharing full access keys with third parties
• Using SAS tokens without expiry
• Creating unnecessary storage accounts