You have an Azure Storage account named financestorage that contains a blob container named audits. You need to grant an external audit application temporary access to read and list blobs in the audits container. The solution must meet the following requirements:
- Limit access to the IP address range 203.0.113.0/24.
- Allow connections only over HTTPS.
- Limit access to a duration of 8 hours.
- Provide the ability to immediately revoke access before the 8-hour period expires without rotating the storage account access keys.
Which two actions should you perform? (Select two.)
- Create a stored access policy on the audits container.Answer
- Generate a service SAS for the audits container that references the stored access policy.Answer
- CGenerate an account SAS that has the IP range and expiration time configured directly on the token.
- DAssign the Reader Azure RBAC role to the application's identity at the financestorage level.
- EEnable the firewall bypass for trusted Microsoft services on the financestorage account.
Answer
To meet the requirements, you must create a stored access policy on the container and generate a service SAS that references this policy.
To satisfy the requirements of immediate revocation without key rotation, a stored access policy must be used. Stored access policies are supported on service SAS tokens (which apply at the container level). By creating a stored access policy on the container and generating a service SAS that references it, you can revoke access at any time by simply deleting the policy or changing its expiration date. This avoids rotating the storage account keys.
Step-by-Step Solution
Key Concept
Stored access policies provide the ability to revoke service SAS tokens immediately without rotating the storage account access keys.