- Lab
-
Libraries: If you want this lab, consider one of these libraries.
- Cloud
Use Shared Access Signatures (SAS) to Limit Storage Account Access
In this hands-on lab, you will learn how to restrict access to an Azure Storage account by generating and testing Service-level and Account-level Shared Access Signatures (SAS). Using the Azure portal, you will create a blob container, upload sample files, and generate SAS tokens with defined permissions (Read and List). You'll then connect remotely through Azure Storage Explorer using these SAS tokens to verify permissions. Testing will demonstrate how the generated SAS URIs permit users to view and list blobs, but explicitly restrict operations such as deleting. By completing this lab, you will gain practical experience in managing secure and controlled access to Azure Storage using SAS tokens.
Lab Info
Table of Contents
-
Challenge
Create a Blob Container and Upload Blobs
Log into Azure the Azure portal, create a blob container, and upload sample files via Storage Browser.
Note: Choose small files that do not contain confidential or personal information.
-
Challenge
Create a Service Shared Access Signature (SAS)
- Generate a service Shared Access signature for the container that you created in the previous objective, set permissions to Read and List.
- Generate and copy the SAS URI for later use.
-
Challenge
Connect and Test the Service Shared Access Signature (SAS)
- Use Azure Storage Explorer from the virtual machine to connect to the blob container using the Shared Access Signature (SAS)
- Test access by attempting actions that are not permitted by the Shared Access Signature (SAS), for example, attempt to delete a file.
-
Challenge
Create an Account Shared Access Signature (SAS)
-
Generate an account Shared Access signature for the Storage account, set the following permissions:
- Allowed services: Blobs
- Allowed resource types: Service, Container, and Object
- Permissions: Read and List
-
Generate and copy the connection string for later use.
-
-
Challenge
Connect and Test the Account Shared Access Signature (SAS)
- Use Azure Storage Explorer from the virtual machine to connect to the storage account using the Shared Access Signature (SAS).
- Test access by attempting actions that are not permitted by the Shared Access Signature (SAS), for example, attempt to delete a file.
Real skill practice before real-world application
Hands-on Labs are real environments created by industry experts to help you learn. These environments help you gain knowledge and experience, practice without compromising your system, test without risk, destroy without fear, and let you learn from your mistakes. Hands-on Labs: practice your skills before delivering in the real world.
Learn by doing
Engage hands-on with the tools and technologies you’re learning. You pick the skill, we provide the credentials and environment.
Follow your guide
All labs have detailed instructions and objectives, guiding you through the learning process and ensuring you understand every step.
Turn time into mastery
On average, you retain 75% more of your learning if you take time to practice. Hands-on labs set you up for success to make those skills stick.