Handling SAS tokens using shared access policy (azure storage)

Question

I am sending blobs to an Azure Storage account. I have one customer with 3 IOT clients who each write to their own container.

I use a share access policy to create a SAS URI to each container.

I am not using an expire data when creating the shared access policy. The generated SAS URI is copied to a config file that each of the clients use this to write blobs to the storage.

This works fine. On the client I create the container using

CloudBlobContainer _container = new CloudBlobContainer(new Uri("https://myhubstorage.blob.core.windows.net/containername?sv=2015-04-05&sr=c&si=containername&sig=xxxxx"));

The token above is retrieved from a config file

To send blobs I use

var newBlob = _container.GetBlockBlobReference(filePath);

Now this works, but I'm not sure if this is the best approach. The reason is that I do not have an expiry on the shared access policy used to create the container SAS token. I don't want to distribute a new SAS token for the container each time it expires (would have to update the config file. Also I do not want the clients to have access to the storage account key).

If a client is compromised I can revoke the shared access policy so the other clients will not be affected.

But is this the best approach to solve this regarding security? Input would be appreciated.

Yang Xia - Microsoft Yang Xia - Microsoft · Accepted Answer · 2017-03-07T02:41:50

Using a shared access policy is suggested, however, you may need to notice that you can set up to 5 stored access policies for a container (It looks not a problem for you since there are only 3 IoT clients).

You might also want to refer to best practices for using SAS for a full list.

Handling SAS tokens using shared access policy (azure storage)

1 Answers