Examkin

Question

Difficulty: MediumShared Access Signatures and Token-based Storage Security

You are configuring security for an Azure Blob Storage container named `partner-imports` that multiple external clients use to upload diagnostic data. Each client requires write-only permissions. You must ensure that you can immediately revoke access for any individual client if their credentials are leaked, without affecting other clients and without rotating the storage account access keys. Which configuration should you use?

  1. A Service SAS associated with a unique Stored Access Policy for each client.Answer
  2. B
    An ad-hoc Service SAS with a 3030-day expiration time for each client.
  3. C
    An ad-hoc Account SAS with a 3030-day expiration time for each client.
  4. D
    A Service SAS associated with a single Stored Access Policy shared by all clients.

Answer

A Service SAS associated with a unique Stored Access Policy for each client.
A Stored Access Policy (SAP) defines constraints on the container level. When a Service SAS is associated with an SAP, Azure Storage validates the SAS against the policy. Modifying or deleting the SAP immediately invalidates all Service SAS tokens associated with it. By using a unique SAP for each client, you can revoke access for an individual client by deleting or modifying their specific policy without affecting others.

Step-by-Step Solution

1
Analyze the revocation and isolation requirements for external client access to Azure Blob Storage.
Identified that rotating the storage account access keys is not permitted, and revoking one client must not impact other clients.
This eliminates solutions that rely on account-level key rotation or shared credentials.
2
Evaluate the capability of ad-hoc Shared Access Signatures (SAS) to meet the revocation requirement.
Ad-hoc SAS tokens (whether Service or Account level) cannot be individually revoked before their expiration time without rotating the storage account key used to sign them.
Ad-hoc tokens do not have an external control mechanism once issued.
3
Select a mechanism that supports individual token invalidation without key rotation.
Stored Access Policies (SAPs) allow changing permissions or expiration times, or deleting the policy entirely, which instantly invalidates any associated Service SAS tokens.
Using a unique Stored Access Policy for each client provides the required isolation and instant revocation capability.

Key Concept

Stored Access Policies for Service SAS Revocation
Rate this question

Topics

Shared Access Signatures and Token-based Storage Security

More questions from this topic