My topic today is Shared Access Signatures, or SAS, for accessing Azure storage.<\/p>\n
When working with Azure storage, the keys operate like route passwords to your storage. Because of this, they should never be stored in plain text, distributed to users or embedded in applications. In short, don\u2019t give out your account keys, use Shared Access Signatures instead.<\/p>\n
We can use Shared Access Signatures in two scenarios: for backup and restore operations with SQL Managed Instances and for managing storage accounts to Azure Databricks. Here are 3 things to know about SAS:<\/p>\n
1. Share Access Signatures are not stored in a recoverable way with your storage account.<\/strong><\/em> A bit of a shocking experience for most. Once you generate the signature, you should copy it to a desired location or to an intermediate space such as a Notepad.<\/p>\n When you close the window where you\u2019ve created the signature, you\u2019ll have to recreate it if you need it again. Microsoft does not store this signature anywhere within the platform, so it\u2019s not recoverable from that perspective. You\u2019ll need a copy of the various keys and connection strings if you plan to use that for more than one application.<\/p>\n 2. Share Access Signatures protect your account keys.<\/strong><\/em> If an SAS is exposed, you can terminate it without impacting other signatures or other account keys. However, if your account key were to be compromised, all Shared Access Signatures and other applications using that account key will need to be reset. A key reason why we recommend using SAS.<\/p>\n 3. Shared Access Signatures provide granular control to your storage.<\/strong><\/em> Access keys give you full rights to everything in your storage account, but with SAS you\u2019re able to limit the access capabilities of its users. You can limit capabilities such as read, write or update or to containers, plus you can timebox when the signature is valid for. This allows for temporary access to your storage account and easily managing different levels of access to folks within or outside of your organization.<\/p>\n