It's all NET: September 2016

This post discusses about the steps you would do in order to provide controlled access to any resource in Azure Blob Storage.

I put forth this post for a couple of reasons. First, there was no single source which precisely told me how to achieve access control using SAS without a single line of code; second, to aggregate information that I found scattered around. Hope this helps someone who is precisely in a position similar to mine a couple of weeks ago :)
Thanks to some brilliant articles which made my understand what I did finally!! I have provided links to a couple of them in this post.

Introduction

I shall assume that the reader has basic knowledge of Microsoft Azure cloud platform and its blob storage service. If you are new to the concepts, check this excellent series of articles by Robin Shahan. At my work, we use Microsoft Azure to provide SaaS solution to the customers. Last week we came across a requirement to share resources hosted in azure blob storage account to vendors and other stakeholders in an access controlled way. To achieve this, we used SAS (shared access signature) and Microsoft Storage Explorer tool.

Azure Blob Storage is one of the components of the storage features of the Azure platform. Blob stands for “binary large object” – blobs are basically files of any type. The blobs are stored in the cloud in Microsoft’s servers, and they can be accessed by URLs with or without authentication tokens and REST APIs. The blobs are stored inside containers. Containers are analogous to folders in a file system.

Types of container access levels

Private means only someone with the credentials for the storage account can access the container and the blobs therein.
Public blob means nobody can iterate through the container to get a list of blobs. A blob can be accessed via a URL that specifically points to the Blob.
Public container means the container and blobs are public, so if someone knows the container name, they can access all blobs in it and they can get a list and iterate through them.

I would choose private containers for my scenario. Having said that, the resources to be shared will be uploaded into private container so nobody without proper permission would not be able to access them.

Shared Access Signature

A shared access signature (SAS) is a URI that allows administrator to specify the time span and permissions allowed for access to a storage resource such as a blob or container. A SAS URI contains link to the resource along with a few query string parameters. Below is an example SAS URI.

https://myaccount.blob.core.windows.net/saascontainer/saasblob.txt?sv=2014-02-14&st=2014-12-23T22%3A18%3A26Z&se=2014-12-23T22%3A23%3A26Z&sr=b&sp=rw&sig=Z%2FRHIX5Xcg0Mq2rqI3OlWTjEg2tYkboXr1P9ZUXDtkk%3D

Types of SAS

SAS can be created as an ad-hoc SAS or using an access policy.

Ad-hoc SAS contains the resource name to which it provides access, the time span for which it is valid, access permissions and signature contained in the URI itself. Ad-hoc SAS is associated with an access key of the storage account. To revoke an ad-hoc SAS, the access key with which it is associated need to be regenerated. Regeneration of access key is not advisable as this access key might be used by other client applications.
SAS can be generated using an access policy. A container can have up to 5 access policies. An access policy would contain time span and access permissions. To revoke a SAS generated using an access policy, the administrator can delete the access policy and this makes the SAS URI invalid. The client will no longer have access to the storage resource.

Microsoft Storage Explorer

Microsoft Azure Storage Explorer is a standalone app from Microsoft that allows working easily with Azure Storage data. Azure Storage Explorer can be used for performing following actions.

Connect to Azure storage account by providing the account credentials and selecting the subscription.
Connect to storage account using SAS URL that has been shared for controlled access. Only container SAS and account SAS are supported; blob SAS is not supported.
Create and delete containers.
Upload, download and delete files from containers.
Create and remove shared access policies for a container.
Generate SAS URL for individual blob, container or storage account.
Controlled access (both action and time frame) to specific area of storage account can be given for clients using SAS URL and same can be revoked by deleting the access policy corresponding to the SAS. So no regeneration of storage account access key is required.
The clients with account SAS (created with read only access) can view all the containers and blob in the storage account.
The clients with container SAS (created with read only access) can list all the blobs inside the container and download the files.

I personally prefer Microsoft's storage explorer to other similar tools, not just because it is free but also for it excellent usability. You can find a concise list of similar tools here

Azure Storage Explorer - Basic Operations

Download Azure Storage Explorer and install it on the system. Installation is a straightforward one with a series of next clicks.

Connecting to azure account in MS Azure storage explorer

Open MS Azure Storage Explorer from Start Menu.
Click on Azure Account Settings button (shown below) from the side bar.

Click on Add an account link.
Provide email id and click on Continue.
Provide the password and click on Sign In.
The subscriptions mapped to your account are displayed in side bar. Select the appropriate subscription and click on Apply.
Now the user should be able to see the storage accounts available under the selected subscription.

Creating container in storage account

Select the appropriate blob storage account
Right click on Blob Containers and select Create Blob Container
Provide the name for the container and press Enter. By default, the container is created with private only access (this is recommended). To change it, right click the container name and select Set Public Access Level.

Uploading files to container in storage account

Select the desired container in the side bar and click on Refresh on the tool bar.
Click on Upload and select Upload Files.
Select the file to upload and keep blob type as Block blob and click on Upload.
Verify the success message in the Activity Log below for the upload activity.

Granting access to private blobs

It is good to choose SAS based on access policy than ad-hoc SAS because revoking access is not possible without access key regeneration if you opt for the latter.

Creating Access Policy

Right click the container and select Manage Access Policies.
Click on Add.
Provide a name for the policy in Id field, start and expiry times and access rights.

Click on Save

Generating SAS URL

Right click the container and select Get Shared Access Signature.
Select the access policy and click on Create.
The SAS URL displayed in the dialog is all one need to access the private blobs. Share the SAS in a secured manner.

Revoking access to private blobs

Since SAS URL has been created based on access policy, revoking access is as simple as deleting the access policy.

Right click the container and select Manage Access Policies.
Click on the Remove button against the appropriate access policy. As per our example remove the readaccesspolicy.
Click on Save.
Now the access to the stakeholder provided with this access policy is revoked.

Using SAS URL to access shared resources

Now if you are a stakeholder, how would you access the shared resources? I would choose Azure Storage Explorer for that too as it is straightforward with the tool.

Open MS Azure Storage Explorer from Start Menu
Click on Connect to Azure Storage button (shown below) from the side bar.

Paste the SAS URL shared to access the resource.
Click on Next. Verify the connection summary and click on Connect.
Now the container should be seen under node Local and Attached > Storage Accounts > SAS-Attached Service > Blob Containers as shown below.