remove storage blob connection string and access using userDelegation sas or manageIdentity

Question

HI
I want to remove dependency from storage account connection string key and need to use manageIdentity or userDelegation sas in my Web app. which is having dot net core in backend and react in front end.
i want to access all blobs and queue from storage account.

please suggest best example to maintain security.

Answer 1

Hi Amit Thore,

Lets follow below points to securely access Azure Storage blobs and queues without using a connection string.

1.To use Managed Identity, your backend must be hosted on an Azure service that supports it, Start by enabling System Assigned Managed Identity in the Azure Portal under your resource’s Identity settings. Then, assign the necessary roles to this Managed Identity on your Storage Account: "Storage Blob Data Contributor for accessing blobs" and "Storage Queue Data Contributor for working with queues".

In your .NET Core application, use 'DefaultAzureCredential' from the Azure Identity SDK, which automatically uses Managed Identity when running in Azure. This lets you access blobs and queues securely without needing connection strings. Locally, it uses your Azure CLI login for authentication, making development seamless. 

2.For frontend access, User Delegation SAS is recommended as it provides temporary, limited access to storage resources. This approach avoids exposing sensitive keys in frontend code.

In the backend, generate the SAS token using .NET Core by obtaining a User Delegation Key from Azure Storage. This key is specific to the authenticated user and respects their Azure AD permissions. After generating the SAS URL, return it to the React frontend via a secured API endpoint.

In React, use the SAS URL to access blobs, ensuring secure access with temporary and least-privileged permissions. This allows users to download or view blobs without revealing storage account keys. 

3.To maintain strong security: Generate SAS tokens only in the backend to protect against exposure in the frontend. Limit SAS token permissions (e.g., read-only) and set short expiration times for added security. Secure your backend API using Azure AD authentication to ensure only authorized users can request SAS tokens. Always use HTTPS to protect SAS tokens from interception.

For Reference please refer,

https://learn.microsoft.com/en-us/entra/identity-platform/multi-service-web-app-access-storage?tabs=azure-portal%2Cprogramming-language-csharp

https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas

https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview

If you have any further assistant, do let me know.

If the answer is helpful, please click Accept Answer and kindly upvote it so that other people who faces similar issue may get benefitted from it.