What is the best approach to utilize storage accounts outside of Azure?

Najam ul Saqib 340 Reputation points
2024-11-19T06:34:42.1366667+00:00

I want to understand the best approach to consume storage accounts outside of Azure on a web application.

Anonymous access and SAS are both discouraged, then what should be used?

Azure Storage Accounts
Azure Storage Accounts
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
3,267 questions
Azure Blob Storage
Azure Blob Storage
An Azure service that stores unstructured data in the cloud as blobs.
2,976 questions
{count} votes

1 answer

Sort by: Most helpful
  1. Deepanshukatara-6769 11,700 Reputation points
    2024-11-19T07:26:54.9466667+00:00

    Hello Najam ,
    To consume storage accounts outside of Azure in a web application while discouraging anonymous access and Shared Access Signatures (SAS), one alternative approach is to build a service application (Azure function )that acts as a proxy. In this setup, the user's device authenticates with the service application, which then authorizes access to Azure Storage resources. This method helps to avoid exposing storage account keys on insecure devices, although it does introduce additional overhead since all data transferred between the user's device and Azure Storage must pass through the service application.

    Another approach is to utilize Azure Role-Based Access Control (RBAC) to manage access permissions effectively. By assigning specific roles to users or applications, you can control who has access to the storage resources without exposing sensitive keys or using SAS.

    References:

    Please let us know if you have any other questions

    Thanks

    Deepanshu


Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.