Replicating AWS VPC-Endpoint Policies on Azure Private Endpoints for Granular Access Control

Question

How can we replicate AWS' VPC-endpoint policy on Azure's private-endpoint for granular access control?
This example illustrates restricting access to a specific S3 bucket.
As far as I can tell, an Azure private endpoint can be associated with a single storage account and is restricted to a single type of resource, e.g., containers, but cannot be restricted to a specific container (==S3 prefix/folder), when considering configurations that can be made from the private-endpoint.

Many thanks,
Omer.

Answer 1

@Omer Cohen ,

Welcome to the Microsoft Q&A Platform. Thank you for reaching out & I hope you are doing well.

Currently, private endpoint cannot be used to provide granular control over containers within a Blob.

For this requirement,

• You should consider using SAS tokens instead
• This can be done at Account level or Container Level
• See : Create SAS tokens for your storage containers

Hope this helps

Kindly let us know if this helps or you need further assistance on this issue.

Thanks,

Kapil

---

Please don’t forget to close the thread by clicking "Accept the answer" wherever the information provided helps you, as this can be beneficial to other community members.