A healthcare provider plans to allow external clinical researchers to upload trial datasets to a specific Azure Blob Storage container. You need to design an access solution that meets the following requirements:
- The researchers must have write access for a maximum of 48 hours.
- You must be able to revoke access immediately if a security compromise is detected.
- The solution must minimize administrative effort.
Which two actions should you include in the design? (Select TWO.)
- Create a stored access policy on the blob container.Answer
- Generate a Shared Access Signature (SAS) token that references the stored access policy.Answer
- CGenerate an ad-hoc Shared Access Signature (SAS) token with a 48-hour lifetime directly on the container.
- DAssign the Storage Blob Data Contributor role directly to each researcher's individual guest user account.
Answer
To meet the security and revocation requirements with minimal administrative overhead, you must create a stored access policy on the blob container and generate a Shared Access Signature (SAS) token that references this policy.
To meet the requirement of immediate revocation, you must define a stored access policy on the blob container and then generate a Shared Access Signature (SAS) token that references this policy. If a compromise is detected, you can delete or modify the stored access policy, which immediately invalidates the SAS token without needing to rotate the storage account keys.
Step-by-Step Solution
Key Concept
Delegating access to Azure Storage containers securely using Stored Access Policies to support revocation.
Estimated Time:1m 0s