You are developing a secure application in C# that interacts with an Azure Storage account. The application must generate a Shared Access Signature (SAS) token to grant an external service temporary read and write permissions to a private blob container named invoices. The solution must meet the following security requirements:
- Access must be limited to HTTPS only.
- The storage account access keys must not be exposed or used to sign the SAS.
- The SAS must be valid for exactly two hours, starting immediately, while accounting for potential clock synchronization differences between clients and Azure.
Which two actions should you perform to create the SAS token? (Select two.)
- Request a user delegation key from the BlobServiceClient using an Azure AD credential such as DefaultAzureCredential.Cevap
- Set the StartsOn property of the BlobSasBuilder to 10 minutes prior to the current UTC time.Cevap
- CGenerate a service SAS signed with the storage account's primary access key retrieved from Azure Key Vault.
- DSet the Protocol property of the BlobSasBuilder to SasProtocol.HttpsAndHttp to maximize client compatibility.
Cevap
To secure the SAS without exposing account keys and to handle potential clock synchronization issues, you must request a user delegation key using Azure AD credentials and set the start time of the SAS builder to 10 minutes in the past.
A User Delegation SAS uses Azure AD credentials (e.g. DefaultAzureCredential) to secure the token, which avoids exposing storage account access keys. Setting the start time 10 minutes in the past ensures the token is immediately valid even if client and server clocks are out of sync (clock skew).
Adım Adım Çözüm
Anahtar Kavram
User Delegation SAS configuration and clock skew mitigation