Examkin

Question

Difficulty: Very hardManage Storage Access Keys and Shared Access Signatures (SAS)

An administrator is configuring temporary access to a blob container named compliance in an Azure Storage account named corpstorage. The administrator must generate a Shared Access Signature (SAS) that meets the following criteria:
- Avoids using storage account access keys for signing to prevent credential exposure.
- Allows read-only access to the blobs for an external auditing application.
- Remains valid for 4848 hours.
- Restricts access to HTTPS traffic originating from the IP range 203.0.113.0/24203.0.113.0/24.

The administrator, who holds the 'Contributor' role on the storage account, generates a User Delegation SAS and provides it to the auditing team. However, the auditing application receives an 'Authorization Failure' (HTTP 403403) error when attempting to read the blobs, even though the application's traffic originates from 203.0.113.50203.0.113.50 over HTTPS.

Which of the following describes the root cause of this failure and the correct resolution?

  1. A
    A User Delegation SAS has a maximum validity period of 11 hour. Create a stored access policy on the container and generate a Service SAS linked to that policy to support the 4848-hour duration.
  2. B
    The storage account firewall blocks the Entra ID token validation requests. Enable the 'Allow trusted Microsoft services to access this storage account' setting in the storage account networking configuration.
  3. C
    The external auditing application's security principal must be assigned the 'Storage Blob Data Reader' role in Microsoft Entra ID, as User Delegation SAS permissions are evaluated against the client's identity.
  4. The administrator lacks data-plane permissions to read the blobs. Assign the 'Storage Blob Data Reader' role to the administrator on the storage account or container.Answer

Answer

The administrator lacks data-plane permissions to read the blobs. Assign the 'Storage Blob Data Reader' role to the administrator on the storage account or container.
The correct option is that the administrator lacks data-plane permissions. A User Delegation SAS is signed using a user delegation key acquired via Microsoft Entra ID. When a client accesses Azure Storage using a User Delegation SAS, Azure evaluates the request based on the active Azure RBAC roles of the security principal who created the SAS. The 'Contributor' role only grants control-plane access (e.g., managing keys, configuring settings) and does not grant data-plane access to blob contents. Therefore, the administrator must be assigned a data-plane role like 'Storage Blob Data Reader'.

Step-by-Step Solution

1
Analyze the signature method of the SAS token.
The SAS is a User Delegation SAS, meaning it is signed using a user delegation key obtained from Microsoft Entra ID rather than the storage account access keys.
Understanding how the SAS is signed determines how authorization is evaluated by Azure Storage.
2
Evaluate the permissions of the security principal who created the SAS.
The administrator has the 'Contributor' role, which provides control-plane access but lacks data-plane permissions like 'Storage Blob Data Reader'.
Azure Storage evaluates User Delegation SAS requests using the active RBAC roles of the creator at the time of the request.
3
Identify the cause of the HTTP 403403 error.
Because the creator (administrator) does not have data-plane read permissions, the intersection of permissions between the SAS token and the creator's RBAC roles is empty, leading to an authorization failure.
A User Delegation SAS cannot grant more permissions than the creator currently possesses.
4
Determine the resolution.
Assign the 'Storage Blob Data Reader' role to the administrator so they have the required data-plane permissions when the SAS is evaluated.
Adding the data-plane role to the creator resolves the authorization issue without violating the requirement to avoid storage account keys.

Key Concept

User Delegation SAS Authorization and RBAC Roles
Rate this question

Topics

Manage Storage Access Keys and Shared Access Signatures (SAS)

More questions from this topic