PHP Access to Private Azure Storage Container

Question

My PHP application, hosted in an Azure VM, needs to access images stored in a private Azure Storage Container.

Has anyone implemented a successful approach? I have 3 ideas (below).

Option 1 - using Azure Managed Identity

1. give the app a managed identity
2. give RBAC read permissions on the container
3. make a curl request in PHP to the VM instance metadata endpoint to get an access token
4. use this token in all requests for images (how would I persist the token in my app?)

Option 2 - using Azure BLOB Storage SDK for PHP

1. use Azure Blob Storage SDK to retrieve an image
2. this requires returning the storage key from my vault to the app

Option 3 - using Azure Shared Access Signature

1. generate a new SAS in PHP for each image
2. requires storage account key

Thanks!

Answer 1

According to your need and description, I think using Azure Managed Identity to access Azure storage is better than other ways. Because, according to your description, if we use the second or third way, we need to get the storage key from Azure key vault. It also needs us to use the MSI to access it. Besides, regarding the third way, we need to consider the life cycle of sas token. So I suggest you use the MSI to access Azure storage.

Regarding how to use MSI to access Azure storage, please refer to the document.

1. Configure managed identities fro VM vai Azure Portal

2. Grant the VM access to an Azure Storage container

3. Get Token

Method: GET
URL: http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://storage.azure.com/
Headers: Metadata : true

4. Test. For example, I call the rest api to get blob

Method: GET
URL: https://myaccount.blob.core.windows.net/mycontainer/myblob
Headers: 
         x-ms-version: 2019-02-02
         Authorization : Bearer <access_token>