You have an Azure Storage account named financestorage that contains a blob container named audits. You need to grant an external audit application temporary access to read and list blobs in the audits container. The solution must meet the following requirements:
- Limit access to the IP address range 203.0.113.0/24.
- Allow connections only over HTTPS.
- Limit access to a duration of 8 hours.
- Provide the ability to immediately revoke access before the 8-hour period expires without rotating the storage account access keys.
Which two actions should you perform? (Select two.)
- Create a stored access policy on the audits container.Cevap
- Generate a service SAS for the audits container that references the stored access policy.Cevap
- CGenerate an account SAS that has the IP range and expiration time configured directly on the token.
- DAssign the Reader Azure RBAC role to the application's identity at the financestorage level.
- EEnable the firewall bypass for trusted Microsoft services on the financestorage account.
Cevap
To meet the requirements, you must create a stored access policy on the container and generate a service SAS that references this policy.
To satisfy the requirements of immediate revocation without key rotation, a stored access policy must be used. Stored access policies are supported on service SAS tokens (which apply at the container level). By creating a stored access policy on the container and generating a service SAS that references it, you can revoke access at any time by simply deleting the policy or changing its expiration date. This avoids rotating the storage account keys.
Adım Adım Çözüm
Anahtar Kavram
Stored access policies provide the ability to revoke service SAS tokens immediately without rotating the storage account access keys.