Does azure blob support customer-provided encryption key in urls?

Question

Hello! I have a question about azure blob functionality:

As far as I understand, I can submit READ and WRITE responses with with SAS token and customer provided key in the following manner:

POST:  https://$ACCOUNT.blob.core.windows.net/$CONTAINER/PATH?$SAS_TOKEN

Headers:

x-ms-encryption-key: $KEY
x-ms-encryption-key-sha256: $SHA256
x-ms-encryption-algorithm:  AES256.

Can I somehow incorporate these headers in url, so url will be self-sufficient to query data with customer provided key WITHOUT specifying headers, e.g. something like:

POST:  https://$ACCOUNT.blob.core.windows.net/$CONTAINER/PATH?$SAS_TOKEN&key=$KEY&key-sha256=$SHA256&alg=AES256

Answer 1

@Aliaksandr Ivanou Thanks for reaching out. Firstly, apologies for the delay in responding here and any inconvenience this issue may have caused.

For customer-provided, encryption keys in URL is not supported.

If you wish you may leave your feedback here All the feedback you share in these forums will be monitored and reviewed by the Microsoft engineering teams responsible for building Azure

Please let us know if you have any further queries. I’m happy to assist you further.

----------

Please do not forget to and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.