You have a private Azure Blob Storage account named `storeorigin` containing static web assets in a container named `images`. You deploy an Azure CDN Standard from Microsoft endpoint to deliver these assets. You must configure the solution so that the CDN endpoint can retrieve the assets using a Shared Access Signature (SAS) token, while ensuring clients can access the assets using clean URLs that do not expose the SAS token. Which sequence of actions should you perform?
- 1Generate a Shared Access Signature (SAS) token for the private storage container with Read and List permissions.
- 2Update the Origin path field of the Azure CDN endpoint to include the container name and the generated SAS token.
- 3Configure the Query string caching behavior of the CDN endpoint to Ignore query strings.
- 4Purge the CDN endpoint cache to clear any legacy unauthenticated or incorrectly cached content.
Answer
To configure Azure CDN with a private Blob Storage origin, you must first generate a SAS token for the storage container. Next, modify the CDN endpoint's Origin path to append the container name and the SAS token. Follow this by setting the query string caching behavior to ignore query strings, which allows clients to bypass sending the token. Finally, purge the CDN endpoint to apply the changes.
The correct sequence begins with securing origin access by generating a SAS token for the private container. This token must then be configured on the CDN side via the Origin path so that the CDN can authenticate requests to the backend. To hide the SAS token from the end users, the query string caching policy is set to ignore query strings, ensuring that clean client URLs are cached and mapped to the backend requests that include the Origin path token. A cache purge is the final step to make the configuration immediately effective.
Step-by-Step Solution
Key Concept
Integrating Azure CDN with private storage origins using Shared Access Signature (SAS) tokens and query string caching behavior configurations.