{"id":10298,"date":"2018-03-20T00:00:00","date_gmt":"2018-03-20T05:00:00","guid":{"rendered":"https:\/\/threecloud.wpengine.com\/post\/external-access-to-azure-storage\/"},"modified":"2023-05-01T15:23:56","modified_gmt":"2023-05-01T20:23:56","slug":"external-access-to-azure-storage","status":"publish","type":"post","link":"https:\/\/3cloudsolutions.com\/resources\/external-access-to-azure-storage\/","title":{"rendered":"External Access to Azure Storage"},"content":{"rendered":"

There are multiple ways to allow external access to Azure storage accounts, some better (and more secure) than others. Today, I\u2019d like to share with you 3 methods to access your storage accounts externally, as well as the preferred methods for doing so.<\/span><\/p>\n

1.\u00a0 Access Keys<\/strong> \u2013 This is one way to allow access, but I don’t highly recommend using it. Why? There are only 2 access keys that exist for your storage account. If you use one, it will be a problem later, since when you have to change it, you\u2019ll have to change everything referring to that storage account. These keys should be used for applications or special use cases that you can manage accordingly.<\/p>\n

If you share these access keys outside of the organization, this could create problem, as you don\u2019t want to have to go in and change them if you feel that the key has been violated in some way.<\/p>\n

2.\u00a0 Share Access Signatures (SAS)<\/strong> – \u00a0A much better option. This is designed to limit access to your storage account and the containers they\u2019re involved in. They allow you to establish security at a more granular level than access keys. With this method, you can use one storage account and create multiple signatures and allow for specific security access.<\/p>\n

This works great for when a company is sending you data and you want to store it somewhere and then give them secure access to your Azure environment. There are expiration properties, so you can allow access for a designated amount of time or if things change, it\u2019s easy to kill the key and stop access.<\/p>\n

3.\u00a0 Share Access Policies<\/strong> \u2013 This is your best option for supporting external entities to get the data into the storage account and is the easiest to manage. Shared access policies leverage shared access signatures and must be created with PowerShell. They are easily managed without creating a new SAS every time.<\/p>\n