You are writing a C# helper method using the `Azure.Storage.Blobs` SDK (v12) to generate a temporary Shared Access Signature (SAS) URL for a specific blob. The SAS URL must meet the following security and technical requirements:
- The SAS token must be signed using Microsoft Entra ID credentials (not storage account access keys).
- The SAS token must remain valid for exactly 2 hours.
- Access to the blob must be restricted to HTTPS only.
- The client must have read-only access (least privilege).
- The code must execute successfully without throwing runtime exceptions from the Azure Storage service.
You write the following C# method:
csharp
public static async Task<Uri> GenerateSecureBlobSasUriAsync(
BlobClient blobClient,
BlobServiceClient blobServiceClient,
string ipAddressRange)
{
// Step 1: Request User Delegation Key
DateTimeOffset keyStart = DateTimeOffset.UtcNow.AddMinutes(-15);
DateTimeOffset keyEnd = DateTimeOffset.UtcNow.AddDays(10);
UserDelegationKey delegationKey = await blobServiceClient.GetUserDelegationKeyAsync(keyStart, keyEnd);
// Step 2: Configure SAS Builder
BlobSasBuilder sasBuilder = new BlobSasBuilder
{
BlobContainerName = blobClient.BlobContainerName,
BlobName = blobClient.Name,
Resource = "b",
StartsOn = DateTimeOffset.UtcNow.AddMinutes(-15),
ExpiresOn = DateTimeOffset.UtcNow.AddHours(2),
Protocol = SasProtocol.HttpsAndHttp
};
sasBuilder.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.Write);
sasBuilder.IPRange = SasIPRange.Parse(ipAddressRange);
// Step 3: Generate and append SAS token
BlobSasQueryParameters sasParams = sasBuilder.ToSasQueryParameters(delegationKey, blobServiceClient.AccountName);
UriBuilder uriBuilder = new UriBuilder(blobClient.Uri)
{
Query = sasParams.ToString()
};
return uriBuilder.Uri;
}
Which three modifications must you make to the code to ensure it executes successfully and complies with all requirements?
- Change the keyEnd variable in Step 1 to a duration of 7 days or less from keyStart to prevent a runtime exception.Cevap
- Change the Protocol property of the BlobSasBuilder in Step 2 to SasProtocol.Https to restrict access to HTTPS only.Cevap
- Modify the SetPermissions method call in Step 2 to pass BlobSasPermissions.Read only, removing the Write permission.Cevap
- DAssign a Stored Access Policy identifier to the sasBuilder.Identifier property in Step 2 to enable immediate revocation.
- EInitialize the BlobServiceClient using a Storage Account Connection String rather than Microsoft Entra ID credentials before calling GetUserDelegationKeyAsync.
- FChange the Resource property of the BlobSasBuilder to "c" to ensure container-level permissions are evaluated instead of blob-level permissions.