Skip to main content

Notes on Azure + PowerShell + Account SAS

Well, below are my notes on using account Shared access signatures in Azure using Azure PowerShell modules.

Theory

Let's get the basics out of the way first.

A shared access signature is a way to delegate access to resources in a storage account, without sharing the storage account keys.

SAS gives us granular control over the delegated access by :
  • Specifying the start and expiry time.
  • Specifying the permissions granted e.g Read/Write/Delete
  • Specifying the Source IP address where the requests will originate from.
  • Specifying the protocol to be used e.g HTTP/HTTPS.


There are two types of SAS.
  1. Service SAS: This type of SAS delegates access to resources in a single storage service. Note - Azure storage is made of Blob, Queue, Table and File services.
  2. Account SAS: This type of SAS delegates access to resources in one or more storage services. In addition, it can also delegate access to the operations that apply to a given service.
So, in a nutshell, SAS is a signed URI that delegates access to one or more storage resources. Note that this URI basically contains all the information in it.

Now the SAS can take two forms.
  1. Ad-hoc SAS: This type of SAS contains/implies all the constraints in the SAS URI e.g. start time, end time, and permissions. Both Service and Account SAS can take this form.
  2. SAS with stored access policy: A stored access policy can be used to define the above constraints e.g. start/end time and permissions on a resource container (blob container, table, queue, or file share). So when a SAS is applied on the resource container it inherits the above constraints from the stored access policy.

    Note - Currently Service SAS can only take this form.
One more thing of importance is that while creating Service SAS tokens, it is a best practice to have stored access policy associated with the resource containers in place because the SAS can simply be revoked (if needed) by deleting the stored access policy.

If you do not follow above then you have to revoke the storage account key which was used to generate the SAS token.

Example: Create and use an account SAS

For this post, I will be showing how to create an account SAS to grant service-level API access to Blob and file storage services and then using a client to update the service properties.

Following the .NET code samples listed here

 +azureprep (resource group)
   \-azprepstore (storage account)
       \-testblobcontainer1 (blob container)
           \- docker.png (blob)

Create an Account SAS token


First, step is to create the Account SAS token using AzureRM and AzureSM PowerShell modules.




Use Account SAS token (created above)


Open another PowerShell console, this will act as a client. The intent here is to show that using SAS token one can access the storage resource independently from another client.





 Hope this is useful.

References:


Using Shared access signatures

Create and use an account SAS (.NET)
Labels:

Popular posts from this blog

Test connectivity via a specific network interface

Recently while working on a Private cloud implementation, I came across a scenario where I needed to test connectivity of a node to the AD/DNS via multiple network adapters.  Many of us would know that having multiple network routes is usually done to take care of redundancy. So that if a network adapter goes down, one can use the other network interface to reach out to the node. In order to make it easy for everyone to follow along, below is an analogy for the above scenario: My laptop has multiple network adapters (say Wi-Fi and Ethernet) connected to the same network. Now how do I test connectivity to a Server on the network only over say Wi-Fi network adapter?
Get-FullPost »

PowerShell + SCCM : Run CM cmdlets remotely

Today I saw a tweet about using implicit remoting to load the Configuration Manager on my machine by Justin Mathews . It caught my eye as I have never really tried it, but theoretically it can be done. Note - The second tweet says "Cannot find a provider with the name CMSite", resolution to which is in the Troubleshooting section at the end.
Get-FullPost »

PowerShell + WPF + GUI : Hide (Use) background PowerShell Console

Few years back, I had started wrapping my PowerShell scripts with some sort of GUI built using Windows Forms (used Primal Forms CE mostly). Things went fine for a while but then I stumbled across awesome posts by MVP Boe Prox on using WPF with PowerShell to do the same. (check Resources section) I had been procrastinating the idea of playing with WPF for a while but then had a great discussion with MVP Chendrayan (Chen) and got inspired to do it. One can use Visual Studio (Express Edition - which is free) to design the UI and then consume the XAML in PowerShell script...Isn't that Cool ! See resources section for links on that. Often when we write the Code to present a nice UI to the end user there is a PowerShell console running in the background. In this post I would like to share a trick to hide/show the background console window. This trick works with both Winforms and XAML. Note - PowerGUI & Visual Studio Express are absolutely FREE ! For the demo o...
Get-FullPost »