- Lab
- Cloud
Use Shared Access Signatures (SAS) to Limit Storage Account Access
In this hands-on lab, you will learn how to restrict access to an Azure Storage account by generating and testing Service-level and Account-level Shared Access Signatures (SAS). Using the Azure portal, you will create a blob container, upload sample files, and generate SAS tokens with defined permissions (Read and List). You'll then connect remotely through Azure Storage Explorer using these SAS tokens to verify permissions. Testing will demonstrate how the generated SAS URIs permit users to view and list blobs, but explicitly restrict operations such as deleting. By completing this lab, you will gain practical experience in managing secure and controlled access to Azure Storage using SAS tokens.
Path Info
Table of Contents
-
Challenge
Create a Blob Container and Upload Blobs
Log into Azure the Azure portal, create a blob container, and upload sample files via Storage Browser.
Note: Choose small files that do not contain confidential or personal information.
-
Challenge
Create a Service Shared Access Signature (SAS)
- Generate a service Shared Access signature for the container that you created in the previous objective, set permissions to Read and List.
- Generate and copy the SAS URI for later use.
-
Challenge
Connect and Test the Service Shared Access Signature (SAS)
- Use Azure Storage Explorer from the virtual machine to connect to the blob container using the Shared Access Signature (SAS)
- Test access by attempting actions that are not permitted by the Shared Access Signature (SAS), for example, attempt to delete a file.
-
Challenge
Create an Account Shared Access Signature (SAS)
-
Generate an account Shared Access signature for the Storage account, set the following permissions:
- Allowed services: Blobs
- Allowed resource types: Service, Container, and Object
- Permissions: Read and List
-
Generate and copy the connection string for later use.
-
-
Challenge
Connect and Test the Account Shared Access Signature (SAS)
- Use Azure Storage Explorer from the virtual machine to connect to the storage account using the Shared Access Signature (SAS).
- Test access by attempting actions that are not permitted by the Shared Access Signature (SAS), for example, attempt to delete a file.
What's a lab?
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Provided environment for hands-on practice
We will provide the credentials and environment necessary for you to practice right within your browser.
Guided walkthrough
Follow along with the author’s guided walkthrough and build something new in your provided environment!
Did you know?
On average, you retain 75% more of your learning if you get time for practice.