how to create access keys and how to link that to storage account

Vishwa teja Devarakonda 0

Actually i want to create access keys and link to storage account and also provide me the navigation steps how to create and retrieve the secrets and passwords which we stored

Vishwa teja Devarakonda 0 Reputation points

2024-11-15T10:51:07.13+00:00

Waiting for your reply
Hari Babu Vattepally 715 Reputation points Microsoft Vendor

2024-11-20T05:13:31.97+00:00

Hi @Vishwa teja Devarakonda

Just following up to see if the below answer helped. Also, let us know if the issue is resolved or still persists, so that we would like to assist you closely. Please do consider clicking Accept Answer as accepted answers help community as well. Also, please click on Yes for the survey 'Was the answer helpful'.

1 answer

Hari Babu Vattepally 715 Reputation points Microsoft Vendor

2024-11-18T06:11:45.5366667+00:00
Hi @Vishwa teja Devarakonda

Greeting! Welcome to Microsoft Q&A Forum and thanks for posting your query here!

Apologies for delay in reply!

To create access keys for your Azure storage account, Azure automatically generates two 512-bit storage account access keys when you create the account. You can view and copy these keys through the Azure portal, PowerShell, or Azure CLI.

Steps to Create and Retrieve Access Keys:

Using Azure Portal:

Go to your storage account in the Azure portal.

Under Security + networking, select Access keys.

Your account access keys will be displayed, and you can select Show keys to view them.

You can copy the key value or the entire connection string.

Using PowerShell:

Use the Get-AzStorageAccountKey command to retrieve your account access keys. example:

$storageAccountKey = (Get-AzStorageAccountKey -ResourceGroupName <resource-group> -Name <storage-account>).Value[0]

Using Azure CLI:

Use az storage account keys list command to list your account access keys. example:

az storage account keys list --resource-group <resource-group> --account-name <storage-account>

Linking Access Keys to Storage Account:

The access keys are inherently linked to your storage account as they are used to authorize access to the data within that account. You can use these keys in your application code to connect to Azure Storage.

Managing Secrets and Passwords:

For managing secrets and passwords, it is recommended to use Azure Key Vault. This allows you to securely store and manage sensitive information. You can create a Key Vault and store your secrets there, providing a secure way to manage sensitive information.

Please refer the below documents which will guide you with additional steps.

Manage storage account access keys

View account access keys

Manually rotate access keys

I hope this helps! Let me know in the comments if you have further questions. Comment is the fastest way to reach the experts for any questions or help you need.

Please don’t forget to Accept Answer and hit Yes for "was this answer helpful" wherever the information provided helps you, this can be beneficial to other community members for remediation for similar issues.
Please sign in to rate this answer.
Hari Babu Vattepally 715 Reputation points Microsoft Vendor

2024-11-18T07:34:05.0633333+00:00

@Vishwa teja Devarakonda I would like to check if the issue is resolved or still persists. So that we will work closely in resolving the issue. Please let us know if the above answer helped in resolving the issue, we will be glad to assist you better for any assistance.

Hari Babu Vattepally 715 Reputation points Microsoft Vendor

2024-11-18T09:12:18.3566667+00:00

Hi @Vishwa teja Devarakonda

Apologies for inconvenience caused!

I understand that you would like to create access keys and link it to storage account, please follow the below method in order to link access keys to an Azure storage account and use them for Authorization.

Use access keys to authenticate your applications when making requests to this Azure storage account. Store your access keys securely - for example, using Azure Key Vault - and don't share them. We recommend regenerating your access keys regularly. As mentioned in the above answer, you can follow the steps to retrieve keys.

Note: If you provide the access key to the client, customer or anyone it's like giving complete access to the Storage account (root password) It's not recommend giving to others.

Always be careful to protect your access keys. Use Azure Key Vault to manage and rotate your keys securely. Avoid distributing access keys to other users, hard coding them, or saving them anywhere in plain text that is accessible to others. Rotate your keys if you believe they may have been compromised.

Instead of giving Access key to other, please provided SAS key --> Shared Key authorization: https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview , This article provides complete detailed information how to access SAS for clients with certain duration, time and access level.

Microsoft recommends using Azure Active Directory (Azure Entra ID) to authorize requests against blob and queue data, if possible, instead of Shared Key. Azure Entra ID provides superior security and ease of use over Shared Key. For more information about authorizing access to data with Azure Entra ID, see Authorize access to Azure blobs and queues using Azure Active Directory.

Azure storage connection string: A connection string includes the authorization information required for your application to access data in an Azure Storage account at runtime using Shared Key authorization. You can configure connection strings to:

Connect to the Azure storage emulator.

Access a storage account in Azure.

Access specified resources in Azure via a shared access signature (SAS).

For more information, refer to this article

If you look in the Azure portal under the storage account in question and look in the "Access Keys" item in the left-side nav, there it shows you the two provided keys and the entire connection string needed to access the storage account.

Reason for two keys? it's to avoid downtime. let's say, if you had only one key and used it multiple places. Suddenly you had to share it to someone for some reason. So, you might need to regenerate this key (As you have already shared it) and update it in all places where you used it previously. So, to avoid this, we have secondary key, which you can share and regenerate it so that, primary key will be still valid.

Authorize requests to Azure Storage: Every request made against a secured resource in the Blob, File, Queue, or Table service must be authorized. Authorization ensures that resources in your storage account are accessible only when you want them to be, and only to those users or applications to whom you grant access: https://learn.microsoft.com/en-us/rest/api/storageservices/authorize-requests-to-azure-storage

Also, additionally you can use the below authorization methods to link access keys to an azure storage account.

Use access key in Shared Key Authorization: You can include the access key in the request header when accessing Azure Storage.

Example: Using the Azure SDK for .NET

using Azure.Storage.Blobs; // Set your storage account name and key string storageAccountName = "<YourStorageAccountName>"; string storageAccountKey = "<YourAccessKey>"; string connectionString = $"DefaultEndpointsProtocol=https;AccountName={storageAccountName};AccountKey={storageAccountKey};EndpointSuffix=core.windows.net"; // Create a BlobServiceClient var blobServiceClient = new BlobServiceClient(connectionString);

Using Shared Access Signatures (SAS): SAS token allows you to grant limited access to your storage resources (like blob) for a specific time without sharing your access keys.

Here is how to create a SAS token:

using Azure.Storage.Blobs; using Azure.Storage.Sas; // Create a BlobServiceClient var blobServiceClient = new BlobServiceClient(connectionString); // Get a reference to the container var containerClient = blobServiceClient.GetBlobContainerClient("<YourContainerName>"); // Create a SAS token for the container BlobSasBuilder sasBuilder = new BlobSasBuilder { ExpiresOn = DateTimeOffset.UtcNow.AddHours(1), // Set expiration time Permissions = BlobSasPermissions.Read | BlobSasPermissions.Write, // Set permissions }; // Generate the SAS token string sasToken = sasBuilder.ToSasQueryParameters(new StorageSharedKeyCredential(storageAccountName, storageAccountKey)).ToString(); // Use the SAS token to access the resource string blobUri = $"{containerClient.Uri}?{sasToken}"; // This is your URL with SAS token

Use SAS tokens for temporary access instead of using access keys directly.

Hope this helps!

Kindly let us know if the above helps or you need further assistance on this issue.

Please do consider to "Accept the answer” and “up-vote” / "resurvey" whenever the information provided helps you, this can be beneficial to other community members.

Hari Babu Vattepally 715 Reputation points Microsoft Vendor

2024-11-19T05:20:46.36+00:00

Hi @Vishwa teja Devarakonda

Following up to see if the above answer was helpful. If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know. We will be glad to assist you further.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

how to create access keys and how to link that to storage account

1 answer

Your answer