Possibility of Tracking Egress from Each Access Policy of Azure Blob Container

Question

Given the high egress costs on Azure, if multiple 'Access Policies' are associated with a blob container, is it possible to track how much data each user with access to those policies has egressed? This way, we could charge each client based on their download volume.

Answer 1

Hello KindCompute-6524,

Greetings! Welcome to Microsoft Q&A Platform.

As stated above the egress is charged mainly on the account level and not on the container level but it is possible to track data egress for each user with access to a blob container in Azure, which can help you charge clients based on their download volume.

Please enable Storage Analytics Logging - This will log all read (egress) operations on your blob storage. You can configure it to log data such as the requester’s IP address, which can help identify the user.

Analyze Logs with Azure Monitor: Use Azure Monitor to query and analyze the logs. You can write queries to summarize the amount of data egressed by each user. For example, you can use Kusto Query Language (KQL) to filter and aggregate the logs based on the user or IP address.

Use Access Policies and SAS Tokens: By associating different Shared Access Signatures (SAS) tokens with different access policies, you can track which token (and thus which user) is responsible for each egress operation.

If you partition your customer's data by container, then can monitor how much capacity is used by each customer. You can use Azure Storage blob inventory to take an inventory of blobs with size information. Then, you can aggregate the size and count at the container level. For an example, see Calculate blob count and total size per container using Azure Storage inventory.

You can also evaluate traffic at the container level by querying logs. To learn more about writing Log Analytic queries, see Log Analytics. To learn more about the storage logs schema, see Azure Blob Storage monitoring data reference.

Hope this information helps! please let us know if you have any further queries. I’m happy to assist you further.

---

Please "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

Hi KindCompute-6524 - Thanks for reaching out over Q&A Forum.

The egress is charged mainly on the account level and not on the container level. There isn't any option to get container level breakup

https://azure.microsoft.com/en-us/pricing/details/storage/blobs/

There is diagnostic logging available where in you have details regarding URL, Response size, operation etc however that will be a very lengthy & exhaustive process and the details might not co-relate.

You can start with below link for planning and management of storage costs.

https://learn.microsoft.com/en-us/azure/storage/common/storage-plan-manage-costs

Hope that helps!

Please let me know if there are any further queries/concerns, will be glad to assist.

---

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.