You are developing a solution that stores sensitive media files in an Azure Blob Storage container named mediafiles. You need to grant a partner application temporary access to read and list the blobs in this container. The security requirements state that you must be able to revoke this access immediately if a compromise occurs, without rotating the storage account keys or affecting other SAS tokens.
Which two actions should you perform to implement this security requirement?
- Create a stored access policy on the container.Cevap
- Generate a service SAS that is associated with the stored access policy.Cevap
- CGenerate an account SAS that references the stored access policy.
- DCreate a stored access policy at the storage account level.
Cevap
To implement the revocation requirement, you should create a stored access policy on the container and then generate a service SAS that is associated with that stored access policy.
Creating a stored access policy on the container and generating a service SAS that references it is correct because it allows the SAS lifetime and permissions to be managed directly by the policy. If a compromise is suspected, the policy can be deleted or updated, instantly revoking all SAS tokens that reference it without affecting other services or requiring account key rotation.
Adım Adım Çözüm
Anahtar Kavram
Stored Access Policies and SAS Revocation