Examkin

Question

Difficulty: MediumPerform Blob and Container Operations using Azure Storage SDKs

You are implementing a secure file-sharing module in a Python application using the `azure-storage-blob` (v12) SDK. A client application needs temporary, read-only access to a specific report blob named `q4_report.pdf` located in a container named `reports`. To adhere to the principle of least privilege, you must generate a Shared Access Signature (SAS) token that restricts access to only this single blob, allowing only read operations, and expiring in one hour. Which code segment should you use to generate the SAS token?

  1. from datetime import datetime, timedelta
    from azure.storage.blob import generate_blob_sas, BlobSasPermissions

    sas_token = generate_blob_sas(
    account_name="mystorage",
    container_name="reports",
    blob_name="q4_report.pdf",
    account_key="mykey",
    permission=BlobSasPermissions(read=True),
    expiry=datetime.utcnow() + timedelta(hours=1)
    )    Answer
  2. B
    from datetime import datetime, timedelta
    from azure.storage.blob import generate_container_sas, ContainerSasPermissions

    sas_token = generate_container_sas(
    account_name="mystorage",
    container_name="reports",
    account_key="mykey",
    permission=ContainerSasPermissions(read=True),
    expiry=datetime.utcnow() + timedelta(hours=1)
    )
  3. C
    from datetime import datetime, timedelta
    from azure.storage.blob import generate_blob_sas, BlobSasPermissions

    sas_token = generate_blob_sas(
    account_name="mystorage",
    container_name="reports",
    blob_name="q4_report.pdf",
    account_key="mykey",
    permission=BlobSasPermissions(read=True, write=True, delete=True),
    expiry=datetime.utcnow() + timedelta(hours=1)
    )
  4. D
    from datetime import datetime, timedelta
    from azure.storage.blob import generate_account_sas, AccountSasPermissions, ResourceTypes

    sas_token = generate_account_sas(
    account_name="mystorage",
    account_key="mykey",
    resource_types=ResourceTypes(object=True),
    permission=AccountSasPermissions(read=True),
    expiry=datetime.utcnow() + timedelta(hours=1)
    )

Answer

The correct code segment uses `generate_blob_sas` from the `azure.storage.blob` package, targeting the specific blob name 'q4_report.pdf' inside the container 'reports', and specifies `BlobSasPermissions(read=True)` to ensure read-only access, adhering to the principle of least privilege.
The correct segment calls `generate_blob_sas` specifying the single target blob `q4_report.pdf` within the container `reports` and configuring `BlobSasPermissions(read=True)`. This ensures that access is locked down specifically to the requested blob with read-only permissions for one hour.

Step-by-Step Solution

1
Determine the required resource scope of the SAS token.
Since only a single specific blob ('q4_report.pdf') should be accessed, we must generate a blob-level SAS token using `generate_blob_sas` rather than `generate_container_sas` or `generate_account_sas`.
Generating a container-level or account-level SAS token would violate the principle of least privilege by exposing other blobs or services in the storage account.
2
Define the minimum required permissions.
We must specify `BlobSasPermissions(read=True)`.
Adding write or delete permissions grants unnecessary access to the client, violating the least privilege requirement.
3
Configure the token's lifetime.
Set `expiry` to `datetime.utcnow() + timedelta(hours=1)`.
This guarantees that the token will automatically expire after one hour as requested.

Key Concept

Generating Shared Access Signatures (SAS) with least privilege scopes and permissions using the Azure Storage Blobs SDK.
Rate this question

Topics

Perform Blob and Container Operations using Azure Storage SDKs

More questions from this topic