Soru

Zorluk: Çok zorShared Access Signatures and Token-based Storage Security

You are writing a C# helper method using the `Azure.Storage.Blobs` SDK (v12) to generate a temporary Shared Access Signature (SAS) URL for a specific blob. The SAS URL must meet the following security and technical requirements:
- The SAS token must be signed using Microsoft Entra ID credentials (not storage account access keys).
- The SAS token must remain valid for exactly 2 hours.
- Access to the blob must be restricted to HTTPS only.
- The client must have read-only access (least privilege).
- The code must execute successfully without throwing runtime exceptions from the Azure Storage service.

You write the following C# method:

csharp
public static async Task<Uri> GenerateSecureBlobSasUriAsync(
BlobClient blobClient,
BlobServiceClient blobServiceClient,
string ipAddressRange)
{
// Step 1: Request User Delegation Key
DateTimeOffset keyStart = DateTimeOffset.UtcNow.AddMinutes(-15);
DateTimeOffset keyEnd = DateTimeOffset.UtcNow.AddDays(10);

UserDelegationKey delegationKey = await blobServiceClient.GetUserDelegationKeyAsync(keyStart, keyEnd);

// Step 2: Configure SAS Builder
BlobSasBuilder sasBuilder = new BlobSasBuilder
{
BlobContainerName = blobClient.BlobContainerName,
BlobName = blobClient.Name,
Resource = "b",
StartsOn = DateTimeOffset.UtcNow.AddMinutes(-15),
ExpiresOn = DateTimeOffset.UtcNow.AddHours(2),
Protocol = SasProtocol.HttpsAndHttp
};

sasBuilder.SetPermissions(BlobSasPermissions.Read | BlobSasPermissions.Write);
sasBuilder.IPRange = SasIPRange.Parse(ipAddressRange);

// Step 3: Generate and append SAS token
BlobSasQueryParameters sasParams = sasBuilder.ToSasQueryParameters(delegationKey, blobServiceClient.AccountName);

UriBuilder uriBuilder = new UriBuilder(blobClient.Uri)
{
Query = sasParams.ToString()
};

return uriBuilder.Uri;
}

Which three modifications must you make to the code to ensure it executes successfully and complies with all requirements?

  1. Change the keyEnd variable in Step 1 to a duration of 7 days or less from keyStart to prevent a runtime exception.Cevap
  2. Change the Protocol property of the BlobSasBuilder in Step 2 to SasProtocol.Https to restrict access to HTTPS only.Cevap
  3. Modify the SetPermissions method call in Step 2 to pass BlobSasPermissions.Read only, removing the Write permission.Cevap
  4. D
    Assign a Stored Access Policy identifier to the sasBuilder.Identifier property in Step 2 to enable immediate revocation.
  5. E
    Initialize the BlobServiceClient using a Storage Account Connection String rather than Microsoft Entra ID credentials before calling GetUserDelegationKeyAsync.
  6. F
    Change the Resource property of the BlobSasBuilder to "c" to ensure container-level permissions are evaluated instead of blob-level permissions.

Cevap

To ensure successful execution and security compliance, you must: 1. Reduce the User Delegation Key lifetime to 7 days or less by modifying keyEnd. 2. Limit the allowed protocol to HTTPS only by setting the SasBuilder Protocol to SasProtocol.Https. 3. Adhere to least privilege by setting permissions to BlobSasPermissions.Read only.
To ensure the code runs without throwing a runtime error and meets the security requirements, three modifications are necessary: first, the User Delegation Key lifetime must be capped at 7 days; second, the SAS builder must restrict protocols to HTTPS only; third, the SAS permissions must be restricted to Read only.

Adım Adım Çözüm

1
Analyze the User Delegation Key lifetime limits.
The current code requests a key valid for 10 days. The maximum lifetime for a User Delegation Key is 7 days, so keyEnd must be adjusted to a maximum of 7 days after keyStart to prevent a runtime RequestFailedException.
Azure Storage enforces a strict 7-day limit on the validity period of the signing key used for user delegation.
2
Evaluate the protocol security requirement.
The current configuration uses SasProtocol.HttpsAndHttp, which allows unencrypted HTTP access. The Protocol property must be updated to SasProtocol.Https to meet the HTTPS-only security mandate.
Restricting the protocol at the SAS level ensures the storage service rejects any non-HTTPS traffic using this token.
3
Apply the principle of least privilege to SAS permissions.
The current code grants Read and Write permissions. Since the requirement is read-only (download) access, the BlobSasPermissions.Write flag must be removed, leaving only BlobSasPermissions.Read.
Least privilege security practices dictate that users should only receive the minimum permissions necessary to complete their task.

Anahtar Kavram

User Delegation SAS configuration, lifetime limits, and least privilege in Azure Storage.
Bu soruyu puanla