Azure Storage Authorization options explained in detail

Azure Storage provides several authorization options to secure access to its resources.

Each method caters to different scenarios, offering flexibility, security, and control based on your requirements.

Below are the available options.

Azure Active Directory (Azure AD) Authorization

Azure AD is the most secure and recommended method for managing access to Azure Storage.

Features

• Uses identity-based access control via Azure AD.

• Integrates with Role-Based Access Control (RBAC).

• Does not require access keys, making it more secure.

Supported Scenarios

• Blob Storage and Queue Storage support Azure AD.

• Ideal for enterprises with centralized identity management.

How to Use

1. Assign Azure roles to users, groups, or service principals to define access permissions.

   • Example: "Storage Blob Data Reader" or "Storage Queue Data Contributor."

2. Applications can authenticate using:

   • Managed identities (for Azure resources).

   • Service principals with certificates or secrets.

Example CLI Command

xxxxxxxxxx
4
1
az role assignment create \
2
--assignee <principal-id> \
3
--role "Storage Blob Data Reader" \
4
--scope "/subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>"

Shared Key Authorization

The Shared Key method uses the storage account's account keys to authorize access.

Features

• Grants full access to all storage account resources.

• Provides a high level of access control but requires careful handling of keys.

Use Cases

• When Azure AD integration is not feasible.

• For legacy applications that need direct access.

How to Use

1. Retrieve the storage account keys from the Azure Portal under Access keys.

2. Use the keys in applications or tools (e.g., Azure Storage Explorer).

Shared Access Signatures (SAS)

SAS provides temporary and granular access to specific resources.

Features

• Delegates access to storage resources without sharing account keys.

• Can define:

  • Permissions (Read, Write, Delete, etc.)

  • Start and expiry time

  • IP restrictions

  • Protocol restrictions (HTTP/HTTPS)

Use Cases

• Temporary file sharing or uploads.

• Delegating limited access to third-party applications.

Types of SAS

1. User Delegation SAS (uses Azure AD credentials).

2. Service SAS (scopes access to specific resources).

3. Account SAS (broader access across multiple services).

Anonymous Public Access

Certain resources in Azure Blob Storage (e.g., containers or blobs) can be made publicly accessible.

Features

• Enables access without authentication.

• Can be limited to:

  • Container-level access.

  • Blob-level access.

Use Cases

• Hosting static websites.

• Serving publicly available files.

How to Use

1. Set the container’s access level to:

   • Private (no public access).

   • Blob (blob-level public access).

   • Container (container-level public access).

2. Use the Azure Portal or CLI to configure these settings.

Managed Identity for Azure Resources

Managed identities allow Azure services (e.g., VMs, Azure Functions) to authenticate with Azure Storage without requiring credentials.

Features

• Automatically managed by Azure.

• Works with Azure AD and RBAC.

Use Cases

• Secure access for Azure-hosted applications or services.

• Reduces the need for storing secrets or keys in your code.

How to Use

1. Enable a managed identity for your Azure resource.

2. Assign an appropriate Azure role (e.g., "Storage Blob Data Contributor") to the resource.

Access Control Lists (ACLs) for Blob Storage

ACLs provide finer-grained permissions on blob containers or individual blobs.

Features

• Works in combination with Azure AD.

• Permissions include Read, Write, and Execute.

Use Cases

• Scenarios requiring file-level or folder-level permissions.

Cross-Origin Resource Sharing (CORS)

CORS allows web applications to securely access resources in Azure Storage from different domains.

Features

• Configures rules to control which domains can interact with your storage account.

Use Cases

• Web applications accessing Azure Blob Storage or Azure Table Storage directly.

How to Use

1. Configure CORS rules in the Azure Portal under the Storage Account > CORS settings.

2. Define allowed methods, headers, and origins.

Comparison of Authorization Methods

Best Practices for Authorization

1. Use Azure AD for secure, identity-based access.

2. Avoid using Shared Key unless absolutely necessary.

3. Restrict SAS Tokens:

   • Set expiry times.

   • Limit permissions and IP ranges.

4. Use Managed Identities for Azure-hosted applications.

5. Regularly review access logs and monitor storage account activity using Azure Monitor.

Summary

By selecting the right authorization method and implementing best practices, you can ensure secure and efficient access to your Azure Storage resources.