Explore full list of SAS parameters in Azure URI

In Azure Storage, a Shared Access Signature (SAS) URI grants delegated access to resources in your storage account.

Understanding the structure of a SAS URI and its components is essential for secure and effective access management.

Structure of a SAS URI

A SAS URI typically consists of two main parts:

1. Resource URI

The base URL pointing to the specific storage resource (e.g., blob, container, file share).

2. SAS Token

A query string appended to the resource URI, containing parameters that define the scope, permissions, and validity of the SAS.

Example:

xxxxxxxxxx
1
1
https://<storage-account-name>.blob.core.windows.net/<container-name>/<blob-name>?<SAS-token>

Components of the SAS Token

The SAS token includes several query parameters that specify the details of the access granted:

• sv (Signed Version): The storage service version to use when handling requests made with this SAS.

• st (Signed Start): The UTC time when the SAS becomes valid.

• se (Signed Expiry): The UTC time after which the SAS is no longer valid.

• sr (Signed Resource): The resource the SAS applies to. Common values include:

  • b for blob

  • c for container

  • f for file

  • s for share

• sip (Signed IP): The IP address or range from which requests will be accepted.

• spr (Signed Protocol): The protocol permitted for requests made with the SAS (e.g., https).

• si (Signed Identifier): A unique value that correlates to an access policy specified for the resource.

• sdd (Signed Directory Depth): The directory depth for directory-scoped access (relevant for hierarchical namespaces).

• skt (Signed Key Start): The UTC time when the key becomes valid.

• ske (Signed Key Expiry): The UTC time after which the key is no longer valid.

• sks (Signed Services): The services accessible with the SAS (e.g., blob, file).

• srt (Signed Resource Types): The resource types accessible with the SAS (e.g., service, container, object).

• sp (Signed Permissions): The permissions granted by the SAS (e.g., read, write, delete).

• sip (Signed IP): The IP address or range from which requests will be accepted.

• spr (Signed Protocol): The protocol permitted for requests made with the SAS (e.g., https).

• si (Signed Identifier): A unique value that correlates to an access policy specified for the resource.

• sdd (Signed Directory Depth): The directory depth for directory-scoped access (relevant for hierarchical namespaces).

• skt (Signed Key Start): The UTC time when the key becomes valid.

• ske (Signed Key Expiry): The UTC time after which the key is no longer valid.

• sks (Signed Services): The services accessible with the SAS (e.g., blob, file).

• srt (Signed Resource Types): The resource types accessible with the SAS (e.g., service, container, object).

• sp (Signed Permissions): The permissions granted by the SAS (e.g., read, write, delete).

• sip (Signed IP): The IP address or range from which requests will be accepted.

• spr (Signed Protocol): The protocol permitted for requests made with the SAS (e.g., https).

• si (Signed Identifier): A unique value that correlates to an access policy specified for the resource.

• sdd (Signed Directory Depth): The directory depth for directory-scoped access (relevant for hierarchical namespaces).

• skt (Signed Key Start): The UTC time when the key becomes valid.

• ske (Signed Key Expiry): The UTC time after which the key is no longer valid.

• sks (Signed Services): The services accessible with the SAS (e.g., blob, file).

• srt (Signed Resource Types): The resource types accessible with the SAS (e.g., service, container, object).

• sp (Signed Permissions): The permissions granted by the SAS (e.g., read, write, delete).

• sip (Signed IP): The IP address or range from which requests will be accepted.

• spr (Signed Protocol): The protocol permitted for requests made with the SAS (e.g., https).

• si (Signed Identifier): A unique value that correlates to an access policy specified for the resource.

• sdd (Signed Directory Depth): The directory depth for directory-scoped access (relevant for hierarchical namespaces).

• skt (Signed Key Start): The UTC time when the key becomes valid.

• ske (Signed Key Expiry): The UTC time after which the key is no longer valid.

• sks (Signed Services): The services accessible with the SAS (e.g., blob, file).

• srt (Signed Resource Types): The resource types accessible with the SAS (e.g., service, container, object).

• sp (Signed Permissions): The permissions granted by the SAS (e.g., read