azure:az-500:storage_security

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revision Previous revision
Next revision		 Previous revision
azure:az-500:storage_security [2022/07/20 19:02] – mmuzeazure:az-500:storage_security [2022/07/20 19:08] (current) – [Shared Access Signature(SAS)] mmuze
Line 12: Line 12:
   * [[https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview]]   * [[https://docs.microsoft.com/en-us/azure/storage/common/storage-sas-overview]]
   * [[https://docs.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory|Azure AD]] is the recommended way to provide authorization for storage account access.   * [[https://docs.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory|Azure AD]] is the recommended way to provide authorization for storage account access.
-  * A [[https://docs.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy|stored access policy]] is an additional level of protection that can be used in conjunction with //service-level shared access signatures (SAS)// authentication. It provides and expiration date and permissions that can be used independent of the SAS token/URL. This provides more flexibility for revoking access. 
- 
  
 ==== Types of Authorization ==== ==== Types of Authorization ====
Line 32: Line 30:
  
   * The only way to revoke a SAS (that was signed by a key) is to revoke (regenerate) the access key that was used to sign it. This is not ideal because that key could be used in other ways and this would be a disruptive operation. That is where a **stored access policy** can be of use (for service-level SAS only).   * The only way to revoke a SAS (that was signed by a key) is to revoke (regenerate) the access key that was used to sign it. This is not ideal because that key could be used in other ways and this would be a disruptive operation. That is where a **stored access policy** can be of use (for service-level SAS only).
 +  * There are tree types of SAS, user delegated, service SAS and account SAS.
   * A **user delegation** SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS applies to Blob storage only.   * A **user delegation** SAS is secured with Azure Active Directory (Azure AD) credentials and also by the permissions specified for the SAS. A user delegation SAS applies to Blob storage only.
   * A **service SAS** is secured with the storage account key. A service SAS delegates access to a resource in only one of the Azure Storage services: Blob storage, Queue storage, Table storage, or Azure Files. A service-level SAS applies to just one service (e.g. blob, Azure Files...).   * A **service SAS** is secured with the storage account key. A service SAS delegates access to a resource in only one of the Azure Storage services: Blob storage, Queue storage, Table storage, or Azure Files. A service-level SAS applies to just one service (e.g. blob, Azure Files...).
Line 37: Line 36:
  
   * A **SAS** can take one of two forms. **Ad hoc SAS** where the expiry and permissions are part of the SAS URI and Service **SAS** with **stored access policy** where the SAS references the policy that defines the expiry and permissions.   * A **SAS** can take one of two forms. **Ad hoc SAS** where the expiry and permissions are part of the SAS URI and Service **SAS** with **stored access policy** where the SAS references the policy that defines the expiry and permissions.
-==== Types ==== +    * A user delegated SAS and account SAS must be an ad hoc SAS
-  * **service-level**, gives access at the storage account level +
-  * **account level ** +
-  * **user delegation SAS**+
  
 ===== Stored Access Policy ===== ===== Stored Access Policy =====
 > A stored access policy provides an additional level of control over service-level shared access signatures (SAS) on the server side. > A stored access policy provides an additional level of control over service-level shared access signatures (SAS) on the server side.
 +  * A [[https://docs.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy|stored access policy]] is an additional level of protection that can be used in conjunction with //service-level shared access signatures (SAS)// authentication. It provides and expiration date and permissions that can be used independent of the SAS token/URL. This provides more flexibility for revoking access.
   * [[https://docs.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy]]   * [[https://docs.microsoft.com/en-us/rest/api/storageservices/define-stored-access-policy]]
  
  • azure/az-500/storage_security.1658343755.txt.gz
  • Last modified: 2022/07/20 19:02
  • by mmuze