Skip to content

Azure Blob Storage SAS Token

Service Name: Microsoft Azure Blob Storage

Service Description: Azure Blob Storage is Microsoft's object storage solution for the cloud. It's optimized for storing massive amounts of unstructured data, such as text or binary data. Shared Access Signatures (SAS) tokens provide secure delegated access to resources in storage accounts without sharing account keys.

Service Address: https://azure.microsoft.com/en-us/products/storage/blobs/

Validation Type: API Auth

IP Allow list: IP restrictions can be configured at the storage account level or as part of the SAS token parameters.

Secret Access Scope: Grants specific permissions (read, write, delete, list, etc.) to Azure Blob Storage containers and blobs for a specified time period.

Secret Revokement URL: https://learn.microsoft.com/en-us/azure/storage/common/storage-account-keys-manage

Secret Example: sv=2021-06-08&ss=b&srt=sco&sp=rwdlaciytfx&se=2023-06- 15T22:00:00Z&st=2023-06- 15T14:00:00Z&spr=https&sig=z5e3kjpFVNHEZyc%2BLOOnUEW4VYbBGwfJrPPLw1BcBF8%3 D

Suspicious Activity Investigation Instructions:

  • Review Azure Storage Analytics logs for unusual access patterns or operations
  • Check Azure Monitor and Activity logs for suspicious operations on the storage account
  • Verify if the SAS token is being used from unexpected IP addresses or locations
  • Monitor for unusual data transfer volumes or patterns
  • Review Azure Security Center alerts related to the storage account

Mitigation Instructions:

  • Regenerate the storage account keys to invalidate all existing SAS tokens
  • Create new SAS tokens with more restrictive permissions and shorter expiration times
  • Enable Azure Storage firewall and configure IP restrictions
  • Implement Azure Private Link for the storage account to restrict network access
  • Configure Azure Defender for Storage to detect potential security threats
  • Update applications to use Azure AD authentication instead of SAS tokens where possible
  • Enable soft delete and versioning to protect against data loss