Hotspot Question You have an Azure Storage account named storage1. You have an Azure Service app named App1 and an app named App2 that runs in an Azure container instance. Each app uses a managed…

Question

Exhibits

Answer Area

• App1:Access control (IAM)
  Access keysAdvanced securityAccess control (IAM)Shared access signatures (SAS)
• App2:Shared access signatures (SAS)
  Access keysAdvanced securityAccess control (IAM)Shared access signatures (SAS)

Explanation

For App1, use Access Control (IAM) with its managed identity for secret-less access, and for App2, use Shared Access Signatures (SAS) to meet the 30-day time-limited access requirement.

Approach. The question requires configuring access for two applications, App1 and App2, to read blobs from an Azure Storage account named storage1, with specific requirements:

1. App1: Is an Azure Service app and uses a managed identity. The goal is to minimize secrets.

   • Correct Selection: Access control (IAM)
   • Reasoning: Managed identities provide an identity for Azure services in Azure Active Directory (Azure AD), eliminating the need for secrets. To grant permissions to a managed identity, you use Azure Role-Based Access Control (RBAC), which is configured through 'Access control (IAM)' in the Azure portal. You would assign a role like 'Storage Blob Data Reader' to App1's managed identity on storage1. This approach uses zero secrets, fulfilling the 'minimize secrets' requirement perfectly.

2. App2: Runs in an Azure container instance and uses a managed identity. It needs to read blobs from storage1 for only the next 30 days, also minimizing secrets.

   • Correct Selection: Shared access signatures (SAS)
   • Reasoning: The crucial requirement for App2 is the 30-day time limit for access. While App2 also uses a managed identity, Azure RBAC roles (configured via IAM) do not inherently have an expiration date. Shared Access Signatures (SAS) are specifically designed for granting time-limited, granular, and scoped access to Azure Storage resources. A SAS token can be configured to expire after 30 days, directly meeting this critical requirement. Although a SAS token is a form of secret, it is temporary and scoped, making it a better choice for minimizing long-lived secrets compared to, for example, distributing full storage account keys. A User Delegation SAS, generated using an Azure AD identity (which could be App2's managed identity if it has appropriate permissions), would be the most secure way to issue a time-limited SAS while leveraging the managed identity concept for its generation.

Common mistakes.

• common_mistake. 1. Using 'Access keys' for either app: Access keys provide full administrative access to the storage account and never expire. This violates the 'minimize secrets' requirement (as they are static, high-privilege secrets) and cannot enforce a 30-day limit for App2. 2. Using 'Advanced security': This option refers to features like Azure Defender for Storage, data encryption, or network security settings. It is not an authentication or authorization mechanism for applications to access storage. 3. Using 'Access control (IAM)' for App2: While App2 uses a managed identity, and IAM is generally used with managed identities, IAM role assignments do not have an intrinsic expiration date. Therefore, it cannot meet the strict 'next 30 days' requirement for App2's access. Manually removing the role after 30 days would be required, which is not an inherent feature of the access mechanism itself. 4. Using 'Shared access signatures (SAS)' for App1: Although SAS provides controlled access, App1 has a managed identity and no time-limit requirement. Using IAM with a managed identity provides a completely secret-less authentication method, which is superior for 'minimizing secrets' compared to using a SAS token (which is itself a temporary secret).

Concept tested. Azure Storage security, authentication and authorization mechanisms (Managed Identities, Azure RBAC/IAM, Shared Access Signatures), and choosing the appropriate access method based on specific requirements such as minimizing secrets, time-limited access, and scope of permissions.

Reference. null

No community discussion yet for this question.