Managing Azure Storage: Containers, File Shares, and Security Tokens
Introduction
Storage is the backbone of any cloud application. In Azure, Storage Accounts provide a versatile foundation for holding everything from unstructured data like images to structured file shares for collaborative work. In this guide, we will walk through the lifecycle of data management: creating containers, uploading blobs, managing cost-efficiency through access tiers, and securing your data using Shared Access Signatures (SAS). We will also cover the critical administrative task of revoking access by rotating security keys.
Create a Storage Container
- Login to Microsoft Azure at https://portal.azure.com.
- From the Azure portal home page, in the search box, enter storage accounts.
- Select storage accounts under services.
Select the storage account you created in the Prepare exercise. The storage account name is the hyperlink to the storage account. (Note: it should be associated with the resource group
guided-project-rg.)
On the storage account blade, under the Data storage submenu, select Containers.
Select + Add container.
In the Name field, enter
storage-container.Select Create.
Great! With a storage container created, you can upload a blob to the container. Locate a picture that you can upload, either on your computer or from the internet, and save it locally to make uploading easier.
Upload a File to the Storage Container
Select the storage container you just created.
Select Upload and upload the file you prepared.
Once the file is ready for upload, select Upload.
With the file uploaded, notice that the Access tier is displayed. For something we uploaded just for testing, it doesn’t need to be assigned to the Hot access tier. In the next few steps, you’ll change the access tier for the file.
Change the Access Tier
Select the file you just uploaded (the file name is a hyperlink).
Select Change tier.
Select Cold.
-
Select Save.
Note: You just changed the access tier for an individual blob or file. To change the default access tier for all blobs within the storage account, you could change it at the storage account level.
Select Home to return to the Azure portal home page.
Good job! You’ve successfully uploaded a storage blob and changed the access tier from Hot to Cold. Next, you’ll work with file shares.
Create a File Share
- From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created earlier (associated with
guided-project-rg).
On the storage account blade, under the Data storage submenu, select File shares.
Select + File share.
On the Basics tab, in the name field enter
file-share.
On the Backup tab, uncheck Enable backup.
Select Review + create, then select Create.
Once the file share is created, select Upload and upload the same file or a different one.
Select Home to return to the Azure portal home page.
Create a Shared Access Signature (SAS) Token
The Azure admin wants you to use shared access tokens or keys to control access to files.
From the Azure portal home page, search for and select storage accounts.
Select your storage account.
On the storage account blade, select Storage browser.
Expand Blob containers. (Note: Blob container is another name for the storage containers.)
Select
storage-container.
Select the ellipses (three dots) at the end of the line for the image you uploaded and select Generate SAS.
Set Signing method to Account key and Signing key to Key 1.
Set Stored access policy to None and Permissions to Read.
Enter a custom start and expiry time or leave the defaults.
Set Allowed protocols to HTTPS only.
Select Generate SAS token and URI.
Copy the Blob SAS URL and paste it into a new browser tab. Your image should appear. Keep this tab open.
Select Home to return to the Azure portal home page.
Rotate Access Keys
To revoke access, you need to invalidate the SAS token by rotating the key used to sign it.
- Navigate back to your Storage account.
Expand the Security + networking submenu and select Access keys.
For Key 1, select Rotate key.
Acknowledge the warning by selecting Yes.
Once successful, go back to the browser tab where you viewed the image via the SAS URL and refresh the page. You should receive an authentication failed error.
Conclusion
Managing Azure Storage is about balancing accessibility with security and cost. By moving data to the Cold tier, you've optimized storage costs for infrequently accessed data. By creating and then revoking a Shared Access Signature through key rotation, you have practiced a fundamental cloud security principle: ensuring that access is granted only for as long as it is needed. These skills form the basis of robust data management in any Azure-based project.
I would like to hear from you
Top comments (0)