1
votes

I like to setup a Azure few Azure Storage Containers for few external users out in Internet. I want to setup shared key based on container and share it with them so that they can upload files to my container.

I don't want them to have Azure account and other privileges except pushing files into the container they have to.

Will Azure Supports this scenario? Read lot of authentication and other possibilities but no clue.

3

3 Answers

3
votes

You should use Shared Access Signatures (SAS) with Stored Access Policies. You should never distribute your storage account key - anyone with this key basically has admin rights to your storage account.

With Stored Access Policies you can define policies (access level, expiration) at the storage account or container level. You can then use a SAS, which is basically a URI referencing the stored access policy and signed with the storage account access key. This allows you to change or revoke the policy at any time.

Full documentation here:
https://msdn.microsoft.com/en-us/library/azure/ee393343.aspx

1
votes

BenV is correct that you should restrict access to your storage account key very carefully. SAS tokens were created to enable delegation of access rights to resources such as containers, blobs, tables and queues. The SAS token can be both time limited (eg - 2 hours) or contain only a subset of permissions (read, insert, delete etc). See the following two articles for more information: Access control overview and SAS tutorial.

0
votes

You do not need to share azure login credentials in order to upload a file to a container.

However you can only grant access to a azure storage account, not to individual container. In order to do that you need to share the storage account 'access key'

enter image description here
with other users. They can then upload the files to whatever containers they please in the same storage account.

You could try this by using BlobTransferUtility to upload files to a storage container.