How to generate SAS Token to connect to Azure Storage Account - File Share?

1
votes

In order to connect to Azure Shared Storage(in particularly File Share) to perform tasks like copying/removing/modifying files from remote to azure storage, we need either SAS(Shared Access Signature) or Active Directory Settings Enabled (and then assign roles based on requirement).

I wanted to implement the access using SAS approach, I tried generating SAS from UI, tried generating SAS by making use of Access Keys(Present Inside Storage Account - Confidential and most important key for storage account) both worked. But UI approach isn't conducive in my case, and Access token can't be given to anyone apart from the administrator.

So is there a way to generate SAS using Azure AD credentials or some service where we can create an account and password/key and that account can be used to create SAS token via curl(REST call) and not generating SAS via access keys(admin key).

2
azureazure-storageaccess-tokenfileshare
Do I get you right, that you want users to be able to create the appropriate SAS tokens for themselves without giving them full access to the whole storage account? – Manuel Batsching
yes , I want the user can write to only their folder or file share and not control storage account as a whole. – mozilla_firefox

2 Answers

1
votes

The tricky part is to let your users create a sas token for the file share without granting them permissions on the whole storage account.

You can use a middle tier application that creates the SAS token and allow the users to use that app. An azure function with an HTTP trigger can be used for example. You grant the azure function access to the storage account using a Managed Service Identity and secure the access to the Azure function either with Active Directory or a function key, that you distribute to your users.

0
votes

You can try with this approach:

A SAS token for access to a container, directory, or blob may be secured by using either Azure AD credentials or an account key. Microsoft recommends that you use Azure AD credentials when possible as a security best practice, rather than using the account key, which can be more easily compromised. When your application design requires shared access signatures, use Azure AD credentials to create a user delegation SAS for superior security.

Create a User delegation SAS

Generate a User Delegation Key:

POST https://myaccount.blob.core.windows.net/?restype=service&comp=userdelegationkey