Examkin

Question

Difficulty: HardShared Access Signatures and Token-based Storage Security

You are developing a secure web application that runs on an Azure Virtual Machine. The application must generate a temporary URI to allow external clients to download PDF reports from a private Azure Blob Storage container named reports. To meet security requirements, you must not use storage account keys. Instead, you configure a User-Assigned Managed Identity for the Virtual Machine. In the application code, you successfully request a User Delegation Key and build a Shared Access Signature (SAS) token using the Azure.Storage.Blobs SDK. The SAS token is configured with read permissions and a lifetime of 11 hour. However, when external clients attempt to download a report using the generated SAS URI, they receive an HTTP 403403 (Forbidden) error. You verify that the Virtual Machine's managed identity has been assigned the Storage Blob Delegator role at the storage account level. Which action should you perform to resolve the HTTP 403403 error?

  1. A
    Add the List permission (BlobSasPermissions.List) when building the BlobSasBuilder object.
  2. B
    Configure a Stored Access Policy on the reports container and associate its identifier with the BlobSasBuilder object.
  3. Assign the Storage Blob Data Reader role to the managed identity at the storage account or container level.Answer
  4. D
    Grant the managed identity the Key Vault Secrets User role to allow it to retrieve the storage account's primary access key.

Answer

Assign the Storage Blob Data Reader role to the managed identity at the storage account or container level.
Assigning the Storage Blob Data Reader role to the managed identity is correct because a User Delegation SAS is authorized in two steps: first, the SAS token constraints are verified, and second, the Azure RBAC permissions of the Microsoft Entra ID principal that created the SAS are evaluated. The Storage Blob Delegator role only allows the managed identity to request a User Delegation Key; it does not grant permissions to read the container data. Assigning the Storage Blob Data Reader role resolves the HTTP 403 error by granting the identity the underlying data-plane permissions required to serve the read requests.

Step-by-Step Solution

1
Analyze the authorization flow of a User Delegation SAS.
A User Delegation SAS requires both the SAS token permissions to be valid and the Microsoft Entra ID security principal (managed identity) that requested the User Delegation Key to have the appropriate Azure RBAC permissions to perform the action.
Unlike Service SAS or Account SAS (which only check the token's validity and permissions because they are signed by the root account key), a User Delegation SAS is constrained by the security principal's active roles.
2
Evaluate the current role assignments of the managed identity.
The managed identity is assigned the Storage Blob Delegator role, which only allows it to run the generateUserDelegationKey action. It has no data-plane roles (like Storage Blob Data Reader).
To identify why the SAS token results in an HTTP 403 Forbidden error, we must verify if the identity itself has read access to the blobs.
3
Select the minimum privilege role that allows reading blob data.
Assign the Storage Blob Data Reader role to the managed identity for the storage account or container containing the reports.
This grants the managed identity the necessary RBAC permissions to read the blobs, completing the second stage of the User Delegation SAS authorization check.

Key Concept

User Delegation SAS Authorization and RBAC Constraints
Estimated Time:2m 0s
Rate this question

Topics

Shared Access Signatures and Token-based Storage Security

More questions from this topic