List of required allowed services, allowed resource types and allowed permissions for SAS

Question

what are the minimal list of allowed services, allowed resource types and allowed permission to be enabled during generation of SAS for backup\restore on sql managed instance

Answer 1

Hi @VeeraOruganti-4036, The SAS configuration for backup/restore operations could possibly be as little as (not tested) the following:

Allowed Service: Blob
Allowed Resource Types: Object (Service & Container may also be required)
Allowed Permissions: Read, Write, Create

If there are other actions that allow you to browse and create/list Azure storage blob containers in the Azure Portal or from T-SQL, then the allowed permissions and allowed resource types will need to include the additional scope. More information about Blob Service operations and permissions, which details the specific information you are looking for.

For general information about Shared Access Signatures, please see: Grant limited access to Azure Storage resources using shared access signatures (SAS)