Not Recommended way of connecting with Storage Containers in the Example shown

Devesh 20

Please provide examples with best practices. The examples shown here does not use recommended way of connecting with Storage Containers. Access Keys based connection is old way of doing things. We are now in era of Managed Identity and RBACs.

Ref: https://learn.microsoft.com/en-us/training/modules/work-azure-blob-storage/4-develop-blob-storage-dotnet

This question is related to the following Learning Module

AmaranS 6,020 Reputation points Microsoft Vendor

2024-09-19T05:30:05.4833333+00:00

Hi Devesh,

Thank you for reaching out to us on the Microsoft Q&A forum.

We are looking into the issue, and we will get back to you soon.
RDash 1,825 Reputation points Microsoft Vendor

2024-09-19T05:56:45.29+00:00
Hi Devesh,

Thank you for reaching out to us on the Microsoft Q&A forum.

Absolutely, using Managed Identities and RBAC is a more secure and modern approach for connecting to Azure Storage. Here are some examples and best practices for using these methods:

Connecting to Azure Storage using Managed Identity

Scenario: An Azure VM or Azure App Service needs to access Azure Storage.

Step-by-Step Example

Enable Managed Identity for the Azure Resource

For an Azure VM:

Navigate to the VM in the Azure portal.

Go to the "Identity" section.

Enable the "System assigned" managed identity.

For an Azure App Service:

Navigate to the App Service in the Azure portal.

Go to the "Identity" section.

Enable the "System assigned" managed identity.

Grant the Managed Identity Access to Azure Storage

Navigate to the Azure Storage account in the Azure portal.

Go to "Access Control (IAM)".

Click "Add role assignment".

Select a role like "Storage Blob Data Contributor" or "Storage Blob Data Reader", depending on the level of access needed.

Assign the role to the managed identity of the VM or App Service.

Access Azure Storage in Code

For example, in a .NET application running on an Azure VM or App Service:

using Azure.Identity;

using Azure.Storage.Blobs;

var blobServiceClient = new BlobServiceClient(new Uri("<your-storage-account-url>"), new DefaultAzureCredential());

var containerClient = blobServiceClient.GetBlobContainerClient("<your-container-name>");

The DefaultAzureCredential class will automatically use the managed identity for authentication.

Using RBAC to Secure Access

Scenario: You want to manage access to your storage resources using RBAC roles.

Step-by-Step Example

Create or Use an Existing Role

Azure provides built-in roles such as "Storage Blob Data Contributor" and "Storage Blob Data Reader".

Navigate to "Roles" in the Azure portal to view or create custom roles if needed.

Assign the Role to a User or Service Principal

Go to the "Access Control (IAM)" section of the Azure Storage account.

Click "Add role assignment".

Select the appropriate role and assign it to a user, service principal, or managed identity.

Access Azure Storage with a Service Principal

For example, using a .NET application with a service principal:

using Azure.Identity;

using Azure.Storage.Blobs;

var credentials = new ClientSecretCredential("<tenant-id>", "<client-id>", "<client-secret>");

var blobServiceClient = new BlobServiceClient(new Uri("<your-storage-account-url>"), credentials);

var containerClient = blobServiceClient.GetBlobContainerClient("<your-container-name>");

Make sure the service principal has been granted the appropriate role on the Azure Storage account.

If you still facing an issue, please reach out to us will be happy to assist you.
I hope the information provided has been helpful to you! If so, please accept the answer by clicking the Accept Answer / Upvote on the post. We value your feedback, and it will help to assist others who might have a similar query. Thank you for your contribution in enhancing Microsoft Q&A!

Share via

Not Recommended way of connecting with Storage Containers in the Example shown

Your answer