Azure Storage SAS Key

Question

Hi,

We have had a potential security issue with one of our SAS storage keys and need to revoke it? What is the best process to completely disable the old SAS key please? Is there a way to have the old SAS key up and running whilst creating a new key too? The plan is to then delete the old key once all users have the new key.

Any help would be appreciated.

Thanks

Answer 1

@TWest-1253

I recommend referring to our Security recommendations for Blob storage which has some information on this. Relevant information from this:

Have a revocation plan in place for any SAS that you issue to clients -
If a SAS is compromised, you will want to revoke that SAS as soon as possible. To revoke a user delegation SAS, revoke the user delegation key to quickly invalidate all signatures associated with that key. To revoke a service SAS that is associated with a stored access policy, you can delete the stored access policy, rename the policy, or change its expiry time to a time that is in the past.

If a service SAS is not associated with a stored access policy (SAP) you cannot revoke it. You would need to regenerate the access key that was used to create the SAS. You could generate another SAS using the other key and have that in place before regenerating the key.

Hopefully this information helps you to resolve this issue. If not please let me know and I will be happy to assist further.

---

Please don’t forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

Answer 2

To configure a SAS expiration policy in the Azure portal, follow these steps:

Navigate to your storage account in the Azure portal.

Under Settings, select Configuration.

1. Locate the setting for Allow recommended upper limit for shared access signature (SAS) expiry interval, and set it to Enabled.
2. Specify the time values under Recommended upper limit for SAS expiry interval for the recommended interval for any new shared access signatures that are created on resources in this storage account.
3. Select Save to save your changes.