Revoking shared access signatures on individual blobs

3
votes

I am involved in building a service that, among others, must distribute access to files to clients, done through azure blobs. Clients should be capable of requesting a write lock to a file, meaning that for some specified amount of time, only that one client can write to the blob.

My question is concerned with how to implement such a locking mechanism. At the moment my solution is to give clients access through shared access signatures, with the service making sure that only one shared access with write access to each blob is active at a time.

The issue with this approach is when i wish to revoke access. If a client is done with its write operations before the shared access expires i would like to be able to revoke the signature so i can grant write access to someone else. By using container level policies i can only revoke access to all signatures using that policy, but my aim is to revoke access to the signature on a single individual blob.

So my question is: Is there some method to revoke the access of one specific shared access signature on a single blob? If not, are there any other ways to implement the kind of feature that i've described in Azure?

Thank you.

1
azureazure-blob-storage

1 Answers

4
votes

From documentation:

The permissions granted by a Shared Access Signature are attached to the account key used to create the signature, and the associated stored access policy (if any). If no stored access policy is specified, the only way to revoke a Shared Access Signature is to change the account key.

Also:

Additionally, the Shared Access Signature URL can reference a stored access policy that provides an additional level of control over a set of signatures, including the ability to modify or revoke access to the resource if necessary. For more information on resource-level access policies, see Using a Stored Access Policy.

So use a predefined stored access policy, if you want to have control over the revoking. Or create short living SAS's

By the way, acuiring a lock is called Blob Lease. Check out also this blog post on leasing blobs and locking.