DEV Community

Cover image for How to provide private storage for internal company documents
UMEOHIA NNAMDI
UMEOHIA NNAMDI

Posted on

How to provide private storage for internal company documents

In today’s digital landscape, protecting internal company documents is not just advisable, it’s essential. These documents frequently contain sensitive information such as financial data, strategic plans, employee records, and legal contracts. If compromised, whether through accidental exposure or inadequate infrastructure, the consequences can include data breaches, regulatory fines, and a loss of stakeholder trust.

A private storage account in Microsoft Azure is a type of storage account that blocks all public access, making sure only authorized users or applications within your network can access the data.

This article explains how companies can safely store their internal documents using modern cloud or in-office storage solutions.

Architecture diagram

Architecture diagram

Here are the steps to follow:

Create a storage account and configure high availability.

  1. Create a storage account for the internal private company documents. Steps:

A. Log into the Azure portal.

Log into the Azure portal

B. In the portal, search for and select Storage accounts.

search for and select Storage accounts

C. Select + Create.

Select + Create

D. Select a Resource.

Select a Resource

E. Set the Storage account name to private.

Set the Storage account name to private

F. Select review and then create.

Select review and then create

Create

G. Wait for the storage account to deploy.

Deploy

  1. Configure high availability. Steps:

A. Go to resource.

Go to resource

B. In the storage account, in the Data management section, select the Redundancy blade.

Data management and Redundancy

C. Ensure Geo-redundant storage (GRS) is selected.

Geo-redundancy storage

Geo-redundancy storage

D. Review the primary and secondary location information.

Review the primary and secondary location information

E. Save your changes.

Save

Create a storage container, upload a file, and restrict access to the file. Steps:

1.Create a private storage container for the corporate data.

A. In the storage account, in the Data storage section, select the Containers blade.

Data storage and containers

B. Select + add Container.

Select + Container

C. Ensure the Name of the container is private.

Ensure the Name of the container is private

D. Ensure the Public access level is Private (no anonymous access).

Private no anonymous access

E. Select create.

select create

  1. For testing, upload a file to the private container, test to ensure the file isn’t publicly accessible. Steps:

A. Select the container.

Select the container

B. Select Upload.

Select upload

C. Browse to files and select a file.

 Browse to files and select a file

D. Upload the file.

Upload the file

E. Select the uploaded file.

Select the uploaded file

F. On the Overview tab, copy the URL.

copy the URL

G. Paste the URL into a new browser tab.

Paste URL

H. Verify the file doesn’t display and you receive an error.

Error message

  1. Configure and test a shared access signature (SAS) for an external partner who requires read and write access to the file for at least the next 24 hours. Steps:

A. Select your uploaded blob file and move to the Generate SAS tab.

Select your uploaded blob file and move to the Generate SAS tab

B. In the Permissions drop-down, ensure the partner has only Read permissions.

ensure the partner has only Read permissions

C. Verify the Start and expiry date/time is for the next 24 hours.

Verify the Start and expiry date/time is for the next 24 hours

D. Select Generate SAS token and URL.

Select Generate SAS token and URL

E. Copy the Blob SAS URL to a new browser tab.

Copy the Blob SAS URL to a new browser tab

F. Verify you can access the file. If you have uploaded an image file it will display in the browser.

Verify you can access the file

Configure storage access tiers and content replication.

  1. To save on costs, after 30 days, move blobs from the hot tier to the cool tier. Steps: Steps: A. Return to the storage account. In the Overview section, notice the Default access tier is set to Hot.

 Return to the storage account. In the Overview section, notice the Default access tier is set to Hot.

B. In the Data management section, select the Lifecycle management blade.

 In the Data management section, select the Lifecycle management blade

C. Select Add rule.

Add rule

D. Set the Rule name to movetocool. Set the Rule scope to Apply rule to all blobs in the storage account. Select Next.

 Set the Rule name to movetocool. Set the Rule scope to Apply rule to all blobs in the storage account and next

E. Ensure Last modified is selected. Set More than (days ago) to 30. In the Then drop-down select Move to cool storage. Add the rule.

 Ensure Last modified is selected. Set More than (days ago) to 30. In the Then drop-down select Move to cool storage. Add the rule.

Ready

2.The public website files need to be backed up to another storage account.Steps :

A. In your storage account, create a new container called backup. Use the default values.

In your storage account, create a new container called backup. Use the default values

In your storage account, create a new container called backup. Use the default values

In your storage account, create a new container called backup. Use the default values

B. Navigate to your publicwebsite storage account. In the Data management section, select the Object replication blade. Select Create replication rules.

Navigate

C. Set the Destination storage account to the private storage account.

Set the Destination storage account to the private storage account

D. Set the Source container to public and the Destination container to backup. Create the replication rule.

Set the Source container to public and the Destination container to backup. Create the replication rule

Top comments (0)