What's the best practice to expose static files from storage account without anonymous access?

Question

Hi,

So I have a case where I see multiple storage accounts with anonymous access enabled on container level; the thing is it comes up as a security issue that the anonymous read access is enabled but after all the files in there are just static files served to some web application.

Is there any better approach to serve the files on web app without enabling anonymous read access on storage account? Is this even a security risk?

Answer 1

@Najam ul Saqib You can achieve this by using Shared Access Signatures (SAS) or Azure CDN.

You can generate SAS tokens that provide limited access to your storage account resources. These tokens can be configured to allow read access to specific files or containers for a defined period. Embed SAS URLs in your web app to securely access the static files. This way, only users with the correct SAS token can access the files. https://learn.microsoft.com/en-us/azure/storage/common/sas-expiration-policy?tabs=azure-portal

By integrating your storage account with Azure CDN, you can serve your static files through the CDN endpoints. Azure CDN can cache the files and serve them to users without exposing your storage account directly. You can configure the CDN to require authentication or use SAS tokens to control access to the files. https://learn.microsoft.com/en-us/azure/cdn/cdn-create-a-storage-account-with-cdn

If you have any questions, let me know in the comments.