What are the ways to revoke access to blob storage.

Question

What are the ways to revoke access to blob storage?

Answer 1

@Jatin Slater Welcome to Microsoft Q&A Forum, Thank you for posting your query here!

Are you referring to SAS or Stored access policy?

Modifying or revoking a stored access policy: To modify the parameters of the stored access policy, you can call the access control list operation for the resource type to replace the existing policy, specifying a new start time, expiry time, or set of permissions. For example, if your existing policy grants read and write permissions to a resource, you can modify it to grant only read permissions for all future requests. In this case, the signed identifier of the new policy, as specified by the ID field, would be identical to the signed identifier of the policy you are replacing.

To revoke a stored access policy, you can delete it, rename it by changing the signed identifier, or change the expiry time to a value in the past. Changing the signed identifier breaks the associations between any existing signatures and the stored access policy. Changing the expiry time to a value in the past causes any associated signatures to expire. Deleting or modifying the stored access policy immediately affects all of the shared access signatures associated with it.

To remove a single access policy, call the resource's Set ACL operation, passing in the set of signed identifiers that you wish to maintain on the container. To remove all access policies from the resource, call the Set ACL operation with an empty request body.

For Shared Access Signature: Define a stored access policy for a service SAS. Stored access policies give you the option to revoke permissions for a service SAS without having to regenerate the storage account keys. Set the expiration on these very far in the future (or infinite) and make sure it's regularly updated to move it farther into the future.

Best practices when using SAS: https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview#best-practices-when-using-sas

If you want to revoke access, you can simply change the stored access policy and all SAS URI’s that inherited from that stored access policy will immediately be modified; this is preferable to changing the storage account key!

Stored access policies are set on a container by writing a complete list of the policies to be used. If you want to revoke access to one of the policies, you can remove it by writing the list of policies and excluding that one. If you want to change the permissions on one of the policies, you have to overwrite the stored policy list with a new list including the modified policy.

Additional information: how to revoke Shared Access Signature in Azure SDK

Hope this helps!

Kindly let us know if the above helps or you need further assistance on this issue.

----------------------------------------------------------------------------------------------------------------------------------------------------

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.