Part 4 : 📦 Managing Azure Storage - Containers, Access Tiers & Secure Access Control

Overview

With the virtual network and VM fully configured,the next responsibility shifted to storage management.

This part of the project focused on three critical things:

•Storing data efficiently

•Optimizing storage cost

•Controlling and revoking access securely

Here’s how I handled it 👇

Procedure 1: 📦 Creating a Storage Container & Uploading a Blob

Inside the existing storage account (guided-project-rg), I:
•Navigated to Data storage → Containers

•Created a new container called storage-container

•Uploaded a test image file

Once uploaded, Azure automatically assigned it the Hot access tier which is ideal for frequently accessed data.
But since this was just a test file, keeping it in Hot storage wasn’t cost-efficient.

Procedure 2:❄️ Changing the Access Tier (Cost Optimization)

To optimize cost:
•I selected the uploaded blob
•Clicked Change tier

•Switched it from Hot → Cold
•Saved the configuration

This reinforced an important cloud concept (storage tiers directly impacting cost),where not all data needs premium, high-frequency access.

Procedure 3: 📁 Creating a File Share

Beyond blob storage, I also needed to configure Azure Files for shared access scenarios.Inside the same storage account:
•I navigated to File shares

•Created a new share called file-share

•Enabled backup (for this lab)

•Uploaded a file into the share

Now the environment supported both:
•Blob storage (object-based)
•File shares (SMB-style shared storage)

Which are two different storage solutions and two different use cases.

Procedure 4: 🔐 Generating a Shared Access Signature (SAS Token)

Next came secure access control, where instead of giving full account access,i generated a Shared Access Signature (SAS) for the uploaded blob.

The Configuration included are :

•Signing method: Account key
•Signing key: Key 1
•Permissions: Read only
•Protocol: HTTPS only
•Custom expiration time

Once generated, i copied the Blob SAS URL into a new browser tab and it successfully displayed the image.

That link allowed temporary limited access.
This is powerful because:
•No need to share account keys
•Access is time-bound
•Permissions are granular

Procedure 5: 🔁 Rotating Access Keys (Revoking Access)

Granting access is only half the story,revoking access is just as important.Since the SAS token was signed using Key 1,i invalidated it by:
•Navigating to Security + networking → Access keys
•Selecting Rotate key for Key 1
•Confirming the regeneration

After the key rotation, I refreshed the SAS URL tab.

☑️ Result

• Authentication failed,access successfully revoked and this demonstrated a critical Azure security concept.
• Rotating storage account keys immediately invalidates all SAS tokens generated with that key.

📊 Final Outcome

By the end of this exercise, i had:
•Created and configured blob storage
•Optimized cost using access tiers
•Deployed Azure File Shares
•Generated secure, time-limited access
•Revoked access by rotating keys

🔑 Conclusion

This part of the guided project strengthened my understanding of:
•Storage architecture
•Access governance
•Cost management
•Real-world administrative control
Where cloud storage isn’t just about uploading files.It’s about managing lifecycle, security, and access responsibly.

Comments

[SKILL.SCH]

Welldone