URL to access private blob in Azure Storage

8
votes

We're just getting started with Azure Storage. In our scenario we upload to private blobs that we later need to access directly from our client app, e.g. images.

Is there a way to address private blobs in Azure Storage with a URL containing the access key?

Sifting through the MS docs all I could find so far is simple URL access via the blob URI, e.g. as given by the URI property of the CloudBlockBlob instance when listing blobs via the .net API.

Naturally accessing this from a web browser fails due to the blob not being public.
However, can we qualify the URL to also include the access key in order to allow authorized clients to access the blob..?

2
c#azureblobazure-storageazure-storage-blobs
Read this: docs.microsoft.com/en-us/azure/storage/common/… It describes the use of tokens to allow access to clients. – kkirk
@kkirk Yes, I was wondering about that and it doesn't quite seem to apply: "You can use a SAS when you want to provide access to resources in your storage account to any client not possessing your storage account's access keys" - I do own the access key. – ATV
If you own the access key, then you must generate a SAS token using it, and then access the file yourself using the SAS token. There are libraries to do a lot of the heavy lifting for you. – juunas
In that case, you can simply use that: docs.microsoft.com/en-us/azure/storage/blobs/…. There are security considerations here though. If you're fine with distributing your storage account access keys to all clients (e.g. your program is for company-internal use) then that's a way to go. If you're not, you should probably create a service between your blob storage and clients, which implements whatever security you need. – kkirk
@juunas ..after checking out the SDKs on github (client will be Objective-C, not C#) it looks like using the library to access Azure Storage will be much less of a hassle. Thanks for the input! – ATV

2 Answers

4
votes

This is the API for how you read blobs from storage:

https://docs.microsoft.com/en-us/rest/api/storageservices/get-blob

There is no URL-Parameter to pass the access key, only the header value Authorization. So you could do the request manually and e.g. add the resulting data as a base64 encoded image. I would advise against it if at all possible.

You must also be aware that by passing your access key to the client, you are effectively making your blob public anyways. You would be putting your data at more risk than anonymous access, since the access key allows more operations than anonymous access. This would also hold true for your objective-c app, even though its much more obfuscated there. SAS is the way to go there - create a backend service that creates a defined set of SAS tokens for given resources. It is however much more effort than simply obfuscating the full access key somewhere.

See "Features available to anonymous users":

https://docs.microsoft.com/en-us/azure/storage/blobs/storage-manage-access-to-resources

4
votes

You can generate an SAS URL and token for the private blob. Here's the process for generating this manually in the Azure portal, to test the concept. It will work even if your storage container is private, as it allows temporary, time limited access to the file using a URL that contains a token in it's query string.

Click on your file within the storage container, select the 'Generate SAS' tab, and in the right pane select enter image description here

This will generate a token, and a URL that includes the token, like below:

enter image description here

You can test downloading the URL as a file by using curl. Use the 2nd URL shown in the image above (the one that includes the full token and other parameters in the querystring), then do this (IMPORTANT - the URL must be in double quotes):

curl "<YOUR_URL>" --output myFileName.txt

Tip - this is also a good method for making files available to an Azure VM, if you need to install a file directly on the VM for any reason (I needed to do this to install an SSL certificate), you can generate the URL then curl to download the file, on the VM itself. E.g. connect to the VM first with Bastion or SSH, then use curl to download the file somewhere.