An administrator needs to configure temporary access to a container named reports-archive in an Azure Storage account named corpdatafiles2026. The access must be restricted to an on-premises application running on a server with the IP address . The application only requires read access for a duration of exactly 4 hours, and the connection must be secured using HTTPS. The administrator must also ensure that access can be revoked immediately if a security compromise occurs, without impacting other applications that are currently using different SAS tokens. Which configuration should the administrator implement to meet these requirements?
- AGenerate an Account SAS and set the expiration time directly in the token.
- Generate a Service SAS associated with a Stored Access Policy on the container.Cevap
- CAssign the Contributor Azure RBAC role at the storage account level to the application.
- DConfigure a Service SAS and enable the 'Allow trusted Microsoft services' firewall setting.
Cevap
Generate a Service SAS associated with a Stored Access Policy on the container.
Generating a Service SAS associated with a Stored Access Policy is the correct approach. A Stored Access Policy allows you to define permissions and expiration times on the container level. If the SAS is compromised, the administrator can delete or modify the policy, which immediately invalidates all SAS tokens generated from it, without disrupting other SAS tokens or requiring storage account key rotation.
Adım Adım Çözüm
Anahtar Kavram
Stored Access Policies allow control over Service SAS parameters, enabling instant revocation of specific tokens by deleting or altering the underlying policy without rotating the account access keys.