Storage access keys and SAS tokens in Azure - Step-by-Step Execution

Process Flow - Storage access keys and SAS tokens

Start: User needs storage access

↓

Choose access method

↓

Use Access Key

↓

Full access

↓

Access storage

↓

End

User decides between full access with storage keys or limited access with SAS tokens to reach storage.

Execution Sample

Azure

1. User requests storage access
2. Chooses Access Key or SAS Token
3. Access Key grants full rights
4. SAS Token grants limited rights
5. User accesses storage accordingly

This flow shows how a user picks between storage keys and SAS tokens to access Azure Storage.

Process Table

Step	Action	Input	Access Granted	Result
1	User requests access	Request storage access	None yet	Waiting for method choice
2	Choose access method	Access Key	Full access	User can read/write all storage data
3	Access storage	Use Access Key	Full access	Storage operations succeed
4	Choose access method	SAS Token with read-only	Limited access	User can only read specified data
5	Access storage	Use SAS Token	Limited access	Storage operations limited to SAS scope
6	Expiration reached	SAS Token expired	No access	Access denied after expiry

💡 Access ends when user finishes or SAS token expires

Status Tracker

Variable	Start	After Step 2	After Step 4	After Step 6
Access Method	None	Access Key	SAS Token	Expired SAS Token
Access Level	None	Full	Limited	None
Access Valid	False	True	True	False

Key Moments - 2 Insights

Why does the SAS token provide limited access compared to the access key?

Because SAS tokens include specific permissions and expiry, as shown in steps 4 and 5 of the execution table, limiting what the user can do.

What happens when the SAS token expires?

At step 6, the SAS token is no longer valid, so access is denied, unlike access keys which remain valid until rotated.

Visual Quiz - 3 Questions

Look at the execution table, what access level does the user have after choosing the Access Key at step 2?

A No access

B Limited access

C Full access

D Expired access

💡 Hint

Refer to row 2, column 'Access Granted' in the execution table.

At which step does the SAS token expire and access become denied?

A Step 6

B Step 5

C Step 4

D Step 3

💡 Hint

Check the 'Expiration reached' action in the execution table.

If the user uses a SAS token with write permission, how would the 'Access Granted' column change at step 4?

A It would become full access like the access key

B It would still be limited access but include write rights

C It would deny all access

D It would expire immediately

💡 Hint

SAS tokens can be scoped with specific permissions as shown in step 4.

Concept Snapshot

Storage Access Keys and SAS Tokens:
- Access keys provide full control to storage.
- SAS tokens grant limited, time-bound access.
- Choose keys for full rights, SAS for scoped access.
- SAS tokens expire, keys remain until rotated.
- Use SAS tokens to safely share storage access.

Full Transcript

This visual execution shows how a user accesses Azure Storage using either storage access keys or SAS tokens. The user first requests access, then chooses between full access with an access key or limited access with a SAS token. Access keys grant full permissions to storage, allowing all operations. SAS tokens provide limited permissions and expire after a set time, restricting what the user can do. The execution table traces each step, showing the access level granted and the result of storage operations. Variable tracking shows how the access method and validity change over time. Key moments clarify why SAS tokens limit access and what happens when they expire. The quiz tests understanding of access levels and token expiration. This helps beginners see the difference between these two Azure Storage access methods clearly.