SAS = Shared Access Signature

Overview

Why: Allows us to create custom security at a granular level for Azure Storage to

• Specific folder/file (e.g., a folder within a container)
• Specific action (Read, List, Delete, Write, ….)
• Provide to a specific person (whoever has the URI --- manage security via control over who has access to the URI)

This is finer control than storage account level Keys that give full access to the full account (all containers, etc.)

Process Steps

Summary

1. Create a Container / Folder in Azure Storage

2. Create a Policy using the Azure Storage Explorer desktop application

3. Run Power Shells script to generate a URI that provides access to the policy

1 – Create Container

No detail here - we know how to do this.

2 – Create Policy

1. Open Azure Storage Explorer
2. Navigate to the container/folder you want to create a policy on
3. in the "Actions" tab, click on  "Manage Access Policies…"
4. Click the "Add" button
   1. Limit of 5? In the desktop app – may need to pursue other methods via scripting
5. 
6. Done -   ready to create URI in next section

 

3 – Creature URI

1. Open Power Shell template. See file "Azure Storage Generate SAS Demo Template.ps1" (in BTech Private Site - Products and Services Documentation).

The current use case where Data Office is generating SAS token is to support Autodesk Connector copy activity. This token is generated to authenticate Boomi to access storage container field2-inbox. See script: Boomi-Field2-inbox-SAS-Token-Script

2. Modify the variable declarations for your storage/container/folder:

Variable	Description	Example
$SubscriptionID		"b3e29c6c-055b-493c-b486-f56bd388bd6b" # Swinerton
$TenantID		"5d793645-a4cb-4dc9-90f2-c691a6fb6f16" #Swinerton
$ResourceGroupName		"WU-DATAOFFICE-QA-RG"
$StorageAcctName		"swinfieldmanagementdev"
$ContainerName		"field2-inbox"
$PolicyName		"field2-inbox-DEMO"
$Baseurl		"https://swinfieldmanagementdev.blob.core.windows.net/"

 

3. Open Windows PowerShell ISE (As Administrator). Run this command to allow for the scripts to run: Set-ExecutionPolicy RemoteSigned [SV1] 

 

4. Run the updated script & Observe the generated SAS URI:

4-Renew SAS URI Token

https://stackoverflow.com/questions/68671540/refresh-sas-token-for-azure-blob-storage

Examples

 

How to Test the token?

Tool for Testing: Azure Storage Explorer

1. Open the Connect Dailog on the left side of the pane. This will open a pop out window
2. Select Resource> ADLS Gen2 container or directory.
3. Select Shared Access Signature URL (SAS).
4. Enter Connection Info
5. Confirm   you are able to perform read , write or any other activity that is included in the permissions for the SAS token.

 

 

Related Processes

How to view SAS Policies

SAS policies can be viewed using:

1. Azure Storage Container:

• Right click on storage container
• View Manage Access Policies

1. Powershell script.

The current script for generating SAS URI token includes a cmdlet to return all access policies on a container (Line 32)

Get-AzStorageContainerStoredAccessPolicy -Container $ContainerName -Context $storagecontainerContext ## list policy for container

Inventory generated URI's

https://swinerton.sharepoint.com/sites/privatesite_btech/System%20Documentation/SAS_URI_Inventory.xlsx?web=1

How to Extend Expired SAS Policies

 

Known Issue + Fix: "Not Digitally signed"

If you get an error saying ".ps1 is not digitally signed. The script will not execute on the system.", run the script below:

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

(via: https://caiomsouza.medium.com/fix-for-powershell-script-not-digitally-signed-69f0ed518715)

Open Questions

• Can you create a policy with no start/end date?

 

 

 

Prerequisites

PowerShell Modules needed to be installed:

Az.Storage

Install-Module -Name Az -Scope CurrentUser -Repository PSGallery -Force -AllowClobber

 

 

Debugging:

Error: cannot be loaded because running scripts is disabled on this system.

Run this command: Set-ExecutionPolicy RemoteSigned