You are developing a solution that stores sensitive media files in an Azure Blob Storage container named mediafiles. You need to grant a partner application temporary access to read and list the blobs in this container. The security requirements state that you must be able to revoke this access immediately if a compromise occurs, without rotating the storage account keys or affecting other SAS tokens.
Which two actions should you perform to implement this security requirement?
- Create a stored access policy on the container.Answer
- Generate a service SAS that is associated with the stored access policy.Answer
- CGenerate an account SAS that references the stored access policy.
- DCreate a stored access policy at the storage account level.
Answer
To implement the revocation requirement, you should create a stored access policy on the container and then generate a service SAS that is associated with that stored access policy.
Creating a stored access policy on the container and generating a service SAS that references it is correct because it allows the SAS lifetime and permissions to be managed directly by the policy. If a compromise is suspected, the policy can be deleted or updated, instantly revoking all SAS tokens that reference it without affecting other services or requiring account key rotation.
Step-by-Step Solution
Key Concept
Stored Access Policies and SAS Revocation