SULIAT

Posted on Jul 26

Azure Management Tasks Part 4: How Manage the Storage Account.

#cloud #tutorial #azure #microsoft

INTRODUCTION

The VM is sorted, it's on the right network, sized properly, and shutting itself down on schedule. Now it's time to turn to the last resource from Part 1: the storage account. So far it's just been sitting there, empty. In this part, we'll actually put it to work, storing a file two different ways, controlling exactly who can access it, and learning how to cut off that access when it's no longer needed.

Storage accounts in Azure aren't a single thing they're a collection of services. We'll touch two of the most common: blob storage (via containers) and file shares. Then we'll look at how to grant temporary, revocable access to what we've stored using a shared access signature (SAS).

What You'll Need

Access to the Azure portal.
The storage account created back in Part 1, sitting inside guided-project-rg.
A file you don't mind uploading for testing,a photo works fine.

Step 1: Create a Storage Container.

From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created in the Prepare exercise. The storage account name is the hyperlink to the storage account. (Note: it should be associated with the resource group guided-project-rg).
On the storage account blade, under the Data storage submenu, select Containers.
Select + Add container.
In the Name field, enter storage-container.
Select Create.

Upload a file to the storage container

Select the storage container you just created.
Select Upload and upload the file you prepared.
Once the file is ready for upload, select Upload.

Change the access tier

Select the file you just uploaded (the file name is a hyperlink).
Select Change tier. .
Select Cold.
Select Save.
Select Home to return to the Azure portal home page.

Note: You just changed the access tier for an individual blob or file. To change the default access tier for all blobs within the storage account, you could change it at the storage account level.

Step 2: Create a file share.

Reopen the storage account.
On the storage account blade, under the Data storage submenu, select File shares.
Select + File share.

Note: its ok to select classic file share if that is what pops up for you.

On the Basics tab, in the name field enter file-share.
On the Backup tab, uncheck Enable backup.
Select Review + create.
Select Create.
Once the file share is created, select Upload.
Upload the same file you uploaded to the blob storage or a different file, it’s up to you.
Select Home to return to the Azure portal home page.

Step 3: Create a shared access signature token.

From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created in the Prepare exercise.
On the storage account blade, select Storage browser.
Expand Blob containers. Note: Blob container is another name for the storage containers. Items uploaded to a storage container are called blobs.
Select the storage container you created earlier, storage-container.
Select the ellipses (three dots) on the end of the line for the image you uploaded or just right-click on it.
Select Generate SAS.

Note: When you generate a shared access signature, you set the duration. Once the duration is over, the link stops working. The **Start automatically populates with the current date and time.

Set Signing method to Account key.
Set Signing key to Key 1.

Tip: There are two signing keys available. You can choose either one, or create SAS tokens with different durations.

Set Stored access policy to None.
Set Permissions to Read.
Enter a custom start and expiry time or leave the defaults.
Set Allowed protocols to HTTPS only.
Select Generate SAS token and URL.
Copy the Blob SAS URL and paste it in another window or tab of your browser. It should display the image you uploaded. Keep this tab or window open.
Select Home to return to the Azure portal home page.

Step 4: Rotate access keys

From the Azure portal home page, in the search box, enter storage accounts.
Select storage accounts under services.
Select the storage account you created in the Prepare exercise.
Expand the Security + networking submenu.
Select Access keys.
- For Key 1, select Rotate key.
Read and then acknowledge the warning about regenerating the access key by selecting Yes.
- Once you see the success message for rotating the access key, go back to the window or tab you used to check the SAS token and refresh the page. You should receive an authentication failed error.

CONCLUSION

You now have two working storage mechanisms, a blob container and a file share plus a concrete way to grant temporary access to what's stored in them, and just as importantly, a way to shut that access off on demand. Access tiers, SAS tokens, and key rotation are the kind of everyday levers that come up constantly once real files and real users are involved.

Next in the series, we'll move past individual resources and look at governance and protection. How to keep this entire environment compliant, cost-aware, and recoverable if something goes wrong.

DEV Community