Why Storage access keys and SAS tokens in Azure? - Purpose & Use Cases

The Big Idea

What if sharing your storage key could be as safe as giving a temporary guest pass instead of your house keys?

The Scenario

Imagine you have a big storage locker where you keep important files. To let friends use some files, you give them a copy of your main locker key. But if they lose it or share it with others, anyone can open your locker and take anything.

The Problem

Using the main storage key for everyone is risky and hard to control. If the key leaks, you must change it everywhere, causing downtime. Also, you can't limit what others can do or for how long, making your storage unsafe and management stressful.

The Solution

Storage access keys and SAS tokens let you share access safely. Instead of giving the main key, you create special temporary keys (SAS tokens) that only allow specific actions for a limited time. This way, you keep control and reduce risks.

Before vs After

✗ Before

Use mainStorageKey for all access
// No limits, full control given

✓ After

Create SAS token with read-only permission and expiry
// Share limited access safely

What It Enables

You can securely share storage access with precise control over permissions and time, protecting your data while enabling collaboration.

Real Life Example

A company shares a SAS token with a partner to upload files for one day only, preventing any other access and avoiding the risk of exposing the main storage key.

Key Takeaways

Manual sharing with main keys is risky and hard to manage.

SAS tokens provide limited, time-bound access for safety.

This approach protects data and simplifies secure collaboration.

Practice

1. What is the main difference between a storage access key and a SAS token in Azure Storage?

easy

A. SAS tokens provide full access; storage access keys provide limited access.

B. Both provide full access but SAS tokens expire faster.

C. Storage access keys provide full access; SAS tokens provide limited, temporary access.

D. Storage access keys are only for blobs; SAS tokens are for all storage types.

Solution

1. Step 1: Understand storage access keys

   Storage access keys give full control over the entire storage account without restrictions.

2. Step 2: Understand SAS tokens

   SAS tokens grant limited, time-bound access to specific resources or actions within the storage account.

3. Final Answer:

   Storage access keys provide full access; SAS tokens provide limited, temporary access. -> Option C

4. Quick Check:

   Access scope = Full vs Limited [OK]

Hint: Full control = access keys; limited control = SAS tokens [OK]

Common Mistakes:

• Confusing SAS tokens as full access keys
• Thinking SAS tokens never expire
• Assuming access keys are resource-specific

2. Which of the following is the correct way to generate a SAS token for a blob container using Azure CLI?

easy

A. az storage blob generate-sas --container-name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage

B. az storage container generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage

C. az storage account generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z

D. az storage generate-sas --container mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z

Solution

1. Step 1: Identify the correct Azure CLI command for container SAS

   The command to generate a SAS token for a container is az storage container generate-sas.

2. Step 2: Check parameters

   az storage container generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage correctly uses container name, permissions, expiry, and account name parameters.

3. Final Answer:

   az storage container generate-sas --name mycontainer --permissions rwl --expiry 2024-12-31T23:59:00Z --account-name mystorage -> Option B

4. Quick Check:

   Correct CLI command and parameters [OK]

Hint: Use 'container generate-sas' for containers, not 'blob generate-sas' [OK]

Common Mistakes:

• Using 'az storage blob generate-sas' for containers
• Omitting required parameters like --account-name
• Using incorrect command syntax

3. Given this SAS token snippet for a blob: ?sv=2023-01-01&ss=b&srt=sco&sp=rl&se=2024-07-01T00:00:00Z&st=2024-06-01T00:00:00Z&spr=https&sig=abc123, what permissions does it grant?

medium

A. Read and List permissions on blob service

B. Read and Write permissions on blob service

C. Full control on storage account

D. Only write permission on blob service

Solution

1. Step 1: Decode the SAS token parameters

   sp=rl means permissions are Read (r) and List (l).

2. Step 2: Understand service and resource types

   ss=b means the service is Blob storage.

3. Final Answer:

   Read and List permissions on blob service -> Option A

4. Quick Check:

   sp=rl means Read+List [OK]

Hint: Check 'sp' parameter for permissions letters [OK]

Common Mistakes:

• Confusing 'rl' with read-write
• Assuming full control from SAS token
• Ignoring service type 'ss' parameter

4. You created a SAS token with --permissions rwd but users report they cannot delete blobs. What is the likely cause?

medium

A. The SAS token lacks the 'Delete' permission 'x'.

B. The SAS token expired before use.

C. The storage account keys were regenerated.

D. The SAS token was generated for the wrong resource type.

Solution

1. Step 1: Understand permissions for delete

   Delete permission is represented by 'd', so 'rwd' includes delete.

2. Step 2: Check resource type relevance

   If the SAS token is generated for a container but used on blobs, or vice versa, permissions may not apply correctly.

3. Final Answer:

   The SAS token was generated for the wrong resource type. -> Option D

4. Quick Check:

   Permissions + resource type must match [OK]

Hint: Match SAS token resource type with intended use [OK]

Common Mistakes:

• Assuming 'x' is delete permission
• Ignoring resource type mismatch
• Not checking token expiry

5. You want to allow a third-party app to upload files to a specific blob container for 2 hours without exposing your storage account keys. Which approach is best?

hard

A. Generate a SAS token scoped to the container with write permission and 2-hour expiry.

B. Create a new storage account for the app.

C. Share the storage account access keys with the app.

D. Use a SAS token with full permissions and no expiry.

Solution

1. Step 1: Avoid sharing storage account keys

   Sharing keys gives full control and is insecure for third parties.

2. Step 2: Use SAS token with limited scope and expiry

   Generating a SAS token scoped to the container with write permission and a 2-hour expiry limits access and duration.

3. Step 3: Evaluate other options

   Creating a new storage account is unnecessary overhead; SAS token with full permissions and no expiry is insecure.

4. Final Answer:

   Generate a SAS token scoped to the container with write permission and 2-hour expiry. -> Option A

5. Quick Check:

   Limited scope + expiry = SAS token best practice [OK]

Hint: Use SAS tokens for limited, timed access, not keys [OK]

Common Mistakes:

• Sharing full access keys with third parties
• Using SAS tokens without expiry
• Creating unnecessary storage accounts