that are dependent on the storage account. All clients that use the access key to access the storage account must be updated to use the new key. If you require more granular control over blob resources, or if you want to provide permissions for operations other than Read operations, you can use a shared access signature to make a resource accessible to users. Optional: A container or blob can be made available for public access by setting a container's permissions. A container, blob, queue, or table may be available for signed access via a shared access signature (a shared access signature is authenticated through a different mechanism). Design Guidance When you design storage security, consider the following: Capability Capability Decision Points Capability Models in Use Considerations Storage accounts can The decision about what type of This is something that is unique to every be created with access control to apply to the customer in Azure. In general, the internal (private) or storage accounts depends guidance is to always start with internal external (public) entirely on the type of data (private) access only, then find reasons access. stored in those accounts and how (exceptions) why the data may need that data needs to be accessed external (public) access. and protected. Most companies do not need to have external access directly to their data. Storage keys can be Storage keys should be treated To permit access to storage resources used to protect like highly privileged credentials without giving out your access keys, you storage accounts (such as Domain Admin can use a shared access signature. A against unauthorized credentials). They should be shared access signature provides access usage. limited to a few selected, trusted to a resource in your account for an resources within the organization. interval that you define and with the permissions that you specify. If you need to grant access to storage accounts without sharing If your service requires that you exercise more granular control over blob resources, or if you want to provide
that are dependent on the storage account. All clients that use the access key to access the storage account must be updated to use the new key. If you require more granular control over blob resources, or if you want to provide permissions for operations other than Read operations, you can use a shared access signature to make a resource accessible to users. Optional: A container or blob can be made available for public access by setting a container's permissions. A container, blob, queue, or table may be available for signed access via a shared access signature (a shared access signature is authenticated through a different mechanism). Design Guidance When you design storage security, consider the following: Capability Considerations Capability Decision Points Capability Models in Use Storage accounts can be created with internal (private) or external (public) access. The decision about what type of access control to apply to the storage accounts depends entirely on the type of data stored in those accounts and how that data needs to be accessed and protected. This is something that is unique to every customer in Azure. In general, the guidance is to always start with internal (private) access only, then find reasons (exceptions) why the data may need external (public) access. Most companies do not need to have external access directly to their data. Storage keys can be used to protect storage accounts against unauthorized usage. Storage keys should be treated like highly privileged credentials (such as Domain Admin credentials). They should be limited to a few selected, trusted resources within the organization. If you need to grant access to storage accounts without sharing To permit access to storage resources without giving out your access keys, you can use a shared access signature. A shared access signature provides access to a resource in your account for an interval that you define and with the permissions that you specify. If your service requires that you exercise more granular control over blob resources, or if you want to provide