Storage access keys and SAS tokens in Azure - Step-by-Step Execution

Process Flow - Storage access keys and SAS tokens

Start: User needs storage access

↓

Choose access method

↓

Use Access Key

↓

Full access

↓

Access storage

↓

End

User decides between full access with storage keys or limited access with SAS tokens to reach storage.

Execution Sample

Azure

1. User requests storage access
2. Chooses Access Key or SAS Token
3. Access Key grants full rights
4. SAS Token grants limited rights
5. User accesses storage accordingly

This flow shows how a user picks between storage keys and SAS tokens to access Azure Storage.

Process Table

Step	Action	Input	Access Granted	Result
1	User requests access	Request storage access	None yet	Waiting for method choice
2	Choose access method	Access Key	Full access	User can read/write all storage data
3	Access storage	Use Access Key	Full access	Storage operations succeed
4	Choose access method	SAS Token with read-only	Limited access	User can only read specified data
5	Access storage	Use SAS Token	Limited access	Storage operations limited to SAS scope
6	Expiration reached	SAS Token expired	No access	Access denied after expiry

💡 Access ends when user finishes or SAS token expires

Status Tracker

Variable	Start	After Step 2	After Step 4	After Step 6
Access Method	None	Access Key	SAS Token	Expired SAS Token
Access Level	None	Full	Limited	None
Access Valid	False	True	True	False

Key Moments - 2 Insights

Why does the SAS token provide limited access compared to the access key?

Because SAS tokens include specific permissions and expiry, as shown in steps 4 and 5 of the execution table, limiting what the user can do.

What happens when the SAS token expires?

At step 6, the SAS token is no longer valid, so access is denied, unlike access keys which remain valid until rotated.

Visual Quiz - 3 Questions

Look at the execution table, what access level does the user have after choosing the Access Key at step 2?

A No access

B Limited access

C Full access

D Expired access

💡 Hint

Refer to row 2, column 'Access Granted' in the execution table.

At which step does the SAS token expire and access become denied?

A Step 6

B Step 5

C Step 4

D Step 3

💡 Hint

Check the 'Expiration reached' action in the execution table.

If the user uses a SAS token with write permission, how would the 'Access Granted' column change at step 4?

A It would become full access like the access key

B It would still be limited access but include write rights

C It would deny all access

D It would expire immediately

💡 Hint

SAS tokens can be scoped with specific permissions as shown in step 4.

Concept Snapshot

Storage Access Keys and SAS Tokens:
- Access keys provide full control to storage.
- SAS tokens grant limited, time-bound access.
- Choose keys for full rights, SAS for scoped access.
- SAS tokens expire, keys remain until rotated.
- Use SAS tokens to safely share storage access.

Full Transcript

This visual execution shows how a user accesses Azure Storage using either storage access keys or SAS tokens. The user first requests access, then chooses between full access with an access key or limited access with a SAS token. Access keys grant full permissions to storage, allowing all operations. SAS tokens provide limited permissions and expire after a set time, restricting what the user can do. The execution table traces each step, showing the access level granted and the result of storage operations. Variable tracking shows how the access method and validity change over time. Key moments clarify why SAS tokens limit access and what happens when they expire. The quiz tests understanding of access levels and token expiration. This helps beginners see the difference between these two Azure Storage access methods clearly.

Practice

1. What is the main difference between a storage access key and a SAS token in Azure Storage?

easy

A. SAS tokens provide full access; storage access keys provide limited access.

B. Both provide full access but SAS tokens expire faster.

C. Storage access keys provide full access; SAS tokens provide limited, temporary access.

D. Storage access keys are only for blobs; SAS tokens are for all storage types.

Solution

1. Step 1: Understand storage access keys

   Storage access keys give full control over the entire storage account without restrictions.

2. Step 2: Understand SAS tokens

   SAS tokens grant limited, time-bound access to specific resources or actions within the storage account.

3. Final Answer:

   Storage access keys provide full access; SAS tokens provide limited, temporary access. -> Option C

4. Quick Check:

   Access scope = Full vs Limited [OK]

Hint: Full control = access keys; limited control = SAS tokens [OK]

Common Mistakes:

• Confusing SAS tokens as full access keys
• Thinking SAS tokens never expire
• Assuming access keys are resource-specific

2. Which of the following is the correct way to generate a SAS token for a blob container using Azure CLI?

easy

A. az storage blob generate-sas --container-name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage

B. az storage container generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage

C. az storage account generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z

D. az storage generate-sas --container mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z

Solution

1. Step 1: Identify the correct Azure CLI command for container SAS

   The command to generate a SAS token for a container is az storage container generate-sas.

2. Step 2: Check parameters

   az storage container generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage correctly uses container name, permissions, expiry, and account name parameters.

3. Final Answer:

   az storage container generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage -> Option B

4. Quick Check:

   Correct CLI command and parameters [OK]

Hint: Use 'container generate-sas' for containers, not 'blob generate-sas' [OK]

Common Mistakes:

• Using 'az storage blob generate-sas' for containers
• Omitting required parameters like --account-name
• Using incorrect command syntax

3. Given this SAS token snippet for a blob: ?sv=2023-01-01&ss=b&srt=sco&sp=rl&se=2024-07-01T00:00:00Z&st=2024-06-01T00:00:00Z&spr=https&sig=abc123, what permissions does it grant?

medium

A. Read and List permissions on blob service

B. Read and Write permissions on blob service

C. Full control on storage account

D. Only write permission on blob service

Solution

1. Step 1: Decode the SAS token parameters

   sp=rl means permissions are Read (r) and List (l).

2. Step 2: Understand service and resource types

   ss=b means the service is Blob storage.

3. Final Answer:

   Read and List permissions on blob service -> Option A

4. Quick Check:

   sp=rl means Read+List [OK]

Hint: Check 'sp' parameter for permissions letters [OK]

Common Mistakes:

• Confusing 'rl' with read-write
• Assuming full control from SAS token
• Ignoring service type 'ss' parameter

4. You created a SAS token with --permissions rwd but users report they cannot delete blobs. What is the likely cause?

medium

A. The SAS token lacks the 'Delete' permission 'x'.

B. The SAS token expired before use.

C. The storage account keys were regenerated.

D. The SAS token was generated for the wrong resource type.

Solution

1. Step 1: Understand permissions for delete

   Delete permission is represented by 'd', so 'rwd' includes delete.

2. Step 2: Check resource type relevance

   If the SAS token is generated for a container but used on blobs, or vice versa, permissions may not apply correctly.

3. Final Answer:

   The SAS token was generated for the wrong resource type. -> Option D

4. Quick Check:

   Permissions + resource type must match [OK]

Hint: Match SAS token resource type with intended use [OK]

Common Mistakes:

• Assuming 'x' is delete permission
• Ignoring resource type mismatch
• Not checking token expiry

5. You want to allow a third-party app to upload files to a specific blob container for 2 hours without exposing your storage account keys. Which approach is best?

hard

A. Generate a SAS token scoped to the container with write permission and 2-hour expiry.

B. Create a new storage account for the app.

C. Share the storage account access keys with the app.

D. Use a SAS token with full permissions and no expiry.

Solution

1. Step 1: Avoid sharing storage account keys

   Sharing keys gives full control and is insecure for third parties.

2. Step 2: Use SAS token with limited scope and expiry

   Generating a SAS token scoped to the container with write permission and a 2-hour expiry limits access and duration.

3. Step 3: Evaluate other options

   Creating a new storage account is unnecessary overhead; SAS token with full permissions and no expiry is insecure.

4. Final Answer:

   Generate a SAS token scoped to the container with write permission and 2-hour expiry. -> Option A

5. Quick Check:

   Limited scope + expiry = SAS token best practice [OK]

Hint: Use SAS tokens for limited, timed access, not keys [OK]

Common Mistakes:

• Sharing full access keys with third parties
• Using SAS tokens without expiry
• Creating unnecessary storage accounts