Learning Secure Storage Endpoints in Azure

Secure storage endpoints in Azure are critical for safeguarding data stored in Azure Storage accounts.

They ensure secure and private access to storage resources by leveraging encryption, firewalls, virtual network integration, and other security features.

Below is a detailed explanation of secure storage endpoints.

Secure Endpoints and Protocols

Azure Storage endpoints are the URLs used to access different storage services, such as Blob, File, Table, or Queue.

By default, Azure provides secure (HTTPS) endpoints.

Default Endpoint Structure

Each storage account has separate endpoints for its services:

Blob Storage

https://<account-name>.blob.core.windows.net

File Storage

https://<account-name>.file.core.windows.net

Queue Storage

https://<account-name>.queue.core.windows.net

Table Storage

https://<account-name>.table.core.windows.net

HTTPS-Only Access

• Azure Storage enforces HTTPS-only connections by default.

• This ensures that data in transit is encrypted using TLS (Transport Layer Security), preventing interception by unauthorized parties.

• You can configure the storage account to disallow HTTP completely via the Azure Portal or CLI:

xxxxxxxxxx
3
1
az storage account update \
2
--name <account-name> \
3
--https-only true

Firewall and Virtual Network Integration

Azure Storage accounts include built-in networking features to restrict access:

Firewall Rules

You can restrict access to specific public IP ranges or Azure services.

Default behavior

Open access to all networks unless explicitly configured.

Example

Configuring IP-based restrictions:

• Only allow access from the range 192.168.0.0/24.

xxxxxxxxxx
4
1
az storage account update \
2
--name <account-name> \
3
--resource-group <group-name> \
4
--firewall-rules "192.168.0.0/24"

Private Endpoints

Allow secure, private access to your storage account from within your Azure Virtual Network (VNet) via the Azure backbone network.

Private Endpoints

• Assign a private IP address within the VNet for the storage account.

• Prevents exposure to the public internet.

• Example endpoint URL: https://<account-name>.privatelink.blob.core.windows.net

Service Endpoints

• Extend VNet security to Azure Storage without requiring private IPs.

• Configure virtual network service endpoints to enable secure communication between Azure Storage and specific subnets.

Shared Access Signature (SAS)

Shared Access Signature (SAS) provides secure, temporary, and scoped access to storage resources.

Features

• Specify time limits and permissions (read, write, delete).

• Supports IP address restrictions.

SAS Types

• Account SAS: Grants access to multiple services in the storage account.

• Service SAS: Grants access to a specific service (e.g., a blob container).

• User Delegation SAS: Uses Azure Active Directory for token-based access.

Example: Generate a Blob SAS URL

xxxxxxxxxx
6
1
az storage blob generate-sas \
2
--account-name <account-name> \
3
--container-name <container-name> \
4
--name <blob-name> \
5
--permissions r \
6
--expiry "2024-12-01T00:00:00Z"

Encryption

Azure Storage supports encryption for data both in transit and at rest:

Data in Transit

• Encrypted using TLS 1.2 or higher.

• HTTPS-only endpoint access ensures encryption during communication.

Data at Rest

By default, Azure encrypts data at rest using Microsoft-managed keys.

Options for enhanced encryption:

1. Customer-Managed Keys (CMK)

• Store your encryption keys in Azure Key Vault or HSM (Hardware Security Module).

• Provides complete control over key rotation and access.

2. Double Encryption

• Adds an additional encryption layer for greater security.

3. Client-Side Encryption

• Encrypt data before uploading it to Azure Storage.

• Suitable for scenarios requiring end-to-end encryption.

Advanced Security Features

Microsoft Defender for Storage

• Provides advanced threat protection for Azure Storage accounts.

• Monitors for anomalies, such as:

  • Unusual access patterns.

  • Unauthorized access attempts.

  • Data exfiltration.

• Alerts are integrated with Azure Security Center.

Cross-Origin Resource Sharing (CORS)

• Allows secure, restricted cross-origin requests to Azure Storage from browsers.

• Configure rules specifying:

  • Allowed origins.

  • Allowed methods (GET, POST, etc.).

  • Exposed headers.

Network Security with Azure Storage

To prevent data leakage and unauthorized access, implement network controls:

Restrict Public Access

• Block public access to all blob containers unless explicitly required.

• Default setting: Public access is disabled for new storage accounts.

IP Restrictions

• Specify allowed public IP ranges for accessing the storage account.

• Blocks requests from unlisted IPs.

Logging and Monitoring

• Use Storage Analytics to log all storage requests, including:

  • Request types (e.g., GET, PUT).

  • Success/failure status.

  • Client IP addresses.

• Use Azure Monitor to track metrics like bandwidth, latency, and errors.

Example Scenarios

Scenario 1: Secure Access for Applications

• Use Managed Identities to authenticate Azure-hosted applications.

• Connect securely without storing credentials in the code.

Scenario 2: Private Data Access

• Create a Private Endpoint for the storage account.

• Limit access to resources within the virtual network.

Scenario 3: Temporary Third-Party Access

• Generate a SAS token with limited permissions and expiration.

Summary

By combining secure endpoints, encryption, network restrictions, and monitoring tools, Azure provides a robust framework for securing your storage resources.