A developer requires temporary access to read and add messages to a single storage queue named orders-queue in the Azure Storage account productionstore. The access must comply with the following requirements:
- Access must be limited to the IP address range 198.51.100.40 to 198.51.100.50.
- All connection requests must use the HTTPS protocol.
- The access must be revocable at any time without rotating the storage account access keys and without affecting other clients.
Which configuration should you implement to meet these requirements?
- AUse Microsoft Entra ID credentials to sign a User Delegation SAS, and configure the IP and protocol constraints directly on the token.
- BCreate an Account SAS scoped to the queue service, specifying the IP and protocol constraints directly on the token.
- Create a stored access policy on the queue, and then generate a Service Shared Access Signature (SAS) that references this policy.Cevap
- DGenerate a Service SAS directly signed by the primary storage account key, and configure the IP and protocol restrictions on the storage account firewall.
Cevap
Create a stored access policy on the queue, and then generate a Service Shared Access Signature (SAS) that references this policy.
Creating a stored access policy on the queue and linking a Service SAS to it is the only way to satisfy all requirements. The stored access policy allows immediate revocation of the SAS by deleting or editing the policy, without rotating the storage account keys and affecting other clients. The SAS token itself supports constraints for HTTPS-only and specific IP address ranges.
Adım Adım Çözüm
Anahtar Kavram
Using stored access policies with Service SAS to enable revocation without access key rotation, and understanding resource support limitations of User Delegation SAS.
Tahmini Süre:1m 30s