What is a Stored Access Policy in Azure?

Introduction

A Stored Access Policy is a simple way to manage access permissions and expiration times for Shared Access Signatures (SAS) in Azure. Instead of embedding these settings directly into every SAS token, you create a centralized policy attached to a container or blob. SAS tokens then reference this policy, making access management more flexible and easier to control.

Why Use a Stored Access Policy?

Stored Access Policies offer several benefits:

• Centralized Management: Define permissions, start times, and expiry times in one place instead of in every SAS token.
• Easy Revocation: Modify or revoke access instantly by updating or deleting the policy. All SAS tokens linked to the policy are immediately affected.
• Reusability: Use the same policy for multiple SAS tokens, reducing duplication and simplifying administration.
• Improved Security: Manage and adjust access control from a single location, making it easier to secure your resources.

How Does it Work?

1. Create the Policy:
   • Attach a stored access policy to a container or file share.
   • Define permissions (e.g., Read, Write), start time, and expiry time.
2. Generate SAS Tokens:
   • When creating a SAS token, reference the stored access policy by its name.
   • The SAS token inherits the permissions and time constraints from the policy.
3. Update or Revoke Access:
   • Change or delete the stored access policy to instantly update or revoke access for all SAS tokens referencing it.

When Should You Use It?

• Shared Settings: When multiple SAS tokens need the same permissions and expiration times.
• Frequent Updates: When access settings or expiration times are likely to change, making centralized updates more efficient.
• Quick Revocation: When you need a quick way to revoke access for many tokens at once.

Limitations of Stored Access Policies

• Supported Services: Available only for Blob Storage and File Storage.
• Policy Limits: Each container or file share can have a maximum of five stored access policies.

How to Use a Stored Access Policy

1. Create a Stored Access Policy

Stored Access Policies must be created for a container or file share.

1. Go to your Storage Account and select aContainer or a File share.
2. Create the Policy:
   • Under Settings, click on Access policy.
   • Add a new policy by clicking Add policy.
   • Set the following parameters:
     • Identifier: A unique name (e.g., CocanReadOnlyPolicy).
     • Permissions: Choose from Read, Write, Delete, List, etc.
     • Start time: Defines when the policy becomes active.
     • Expiry time: Defines when the policy expires.
   • Click Save to create the policy.

2. Generate a SAS Token Referencing the Policy

1. Navigate to Settings > Shared access tokens for our container.
2. For Stored access policy, select the policy we created earlier. If we have set Permissions, Start time and expiry time, they will not be editable. If we have set some or none, only the rest will be editable. For eample, if we set only Permissions within our policy, then Permissions will not be editable and Start and expiry date/time will be editable.
3. Click Generate SAS token and URL.
4. Copy the SAS token or URL for sharing with authorized users or applications.

3. Modify the Policy

1. Navigate to the container or file share where the policy resides.
2. Select Access policy under Settings.
3. Update the permissions, start time, or expiry time of the policy as needed.
4. Save the changes to apply them to all SAS tokens referencing this policy.

4. Revoke the Policy

1. Navigate to the container or file share where the policy resides.
2. Select Access policy under Settings.
3. Delete the stored access policy to immediately revoke access for all tokens tied to it.

Example Use Case

Imagine you have a shared container with several clients accessing files. Instead of creating individual SAS tokens with hard-coded permissions and expiry times, you create a ReadOnlyPolicy as a stored access policy. You can generate SAS tokens referencing this policy and easily manage or revoke access for all clients at once by modifying the policy.

Conclusion

A Stored Access Policy simplifies the way you manage SAS tokens in Azure. It’s a powerful tool for controlling access, especially when dealing with multiple tokens or frequently changing permissions. By using this centralized approach, you can save time, enhance security, and keep your storage resources organized.