An organization has a web application that provides temporary write access to an Azure Blob Storage container named `uploads` for external clients. You must meet the following requirements:
- Enable the security team to revoke access tokens immediately without impacting other clients or rotating the storage account keys.
- Limit the lifetime of individual client tokens to a maximum of 30 minutes.
- Enforce the use of secure connections only.
Which two actions should you perform to meet these requirements?
- Create a stored access policy on the container and specify the policy identifier when generating a service-level SAS token.Cevap
- Set the allowed protocols on the stored access policy or the generated SAS token to HTTPS only.Cevap
- CCreate a stored access policy at the storage account level and associate it with an account-level SAS token.
- DGenerate a SAS token signed with Microsoft Entra ID credentials and associate it with a stored access policy.
Cevap
Create a stored access policy on the container and specify the policy identifier when generating a service-level SAS token, and set the allowed protocols on the stored access policy or the generated SAS token to HTTPS only.
The correct actions are to create a stored access policy on the container and reference it when generating a service-level SAS, and to enforce HTTPS only on the policy or token. A stored access policy allows for immediate revocation of the associated SAS tokens by modifying or deleting the policy. Restricting the protocol to HTTPS ensures all transit is encrypted.
Adım Adım Çözüm
Anahtar Kavram
Implementing container-level stored access policies to manage and revoke Service Shared Access Signatures (SAS) with protocol constraints.