How to Restrict Azure Storage Access to Specific Domains Similar to Cloudflare's WAF?

Phạm Trung 0 Reputation points
2024-09-24T05:31:44.9566667+00:00

I'm using Azure Blob Storage to host images for my website, and I want to ensure that only my specified domain(s) can access these images. Essentially, I need to block all access from other domains, similar to how Cloudflare's Web Application Firewall (WAF) operates.

I've tried various methods, including setting up Azure CDN, Azure Front Door, and even creating custom rules, but none of these approaches have worked as intended. I also looked into using Shared Access Signatures (SAS), but it doesn't seem to fit my requirements.

My goal is to configure Azure Blob Storage so that even if a user opens developer tools (F12), copies the image URL, and pastes it directly into the browser's address bar, they should not be able to view the image unless it's accessed through my specified domain.

Is there a way to achieve this level of domain-specific access control in Azure Blob Storage? How can I prevent unauthorized direct access to my blob URLs while allowing my domain to serve these images?

Azure Storage Accounts
Azure Storage Accounts
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
3,145 questions
Azure Blob Storage
Azure Blob Storage
An Azure service that stores unstructured data in the cloud as blobs.
2,839 questions
Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
808 questions
0 comments No comments
{count} votes

1 answer

Sort by: Most helpful
  1. KarishmaTiwari-MSFT 20,037 Reputation points Microsoft Employee
    2024-09-24T23:49:18.0933333+00:00

    @Phạm Trung Azure Blob Storage doesn’t natively support direct domain-based access control for blob URLs.

    However, Azure Storage Accounts provide built-in firewall settings that allow you to restrict access based on IP ranges and virtual networks. You can do this by going to Azure Portal -> your Azure storage account-> Security + Networking->Networking -> Firewalls and virtual networks. While it doesn't restrict access by domain name, you can restrict access by the public IP address associated with the domain.

    If you only want to block reading you could encrypt the files (although that would require decryption on the other end).

    Authorize access to blobs using Microsoft Entra ID

    0 comments No comments

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.