Skip to content

Commit 2cfcc7f

Browse files
pauljewellmsftpauljewellmsft
committed
Edits
1 parent 91aa515 commit 2cfcc7f

File tree

3 files changed

+36
-37
lines changed

3 files changed

+36
-37
lines changed

‎articles/storage/blobs/storage-blob-dotnet-get-started.md

Lines changed: 24 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -61,8 +61,6 @@ To learn more about creating and managing client objects, see [Create and manage
6161

6262
You can authorize a `BlobServiceClient` object by using an Azure Active Directory (Azure AD) authorization token, an account access key, or a shared access signature (SAS).
6363

64-
To learn more about each of these authorization mechanisms, see [Authorize access to data in Azure Storage](../common/authorize-data-access.md).
65-
6664
## [Azure AD](#tab/azure-ad)
6765

6866
To authorize with Azure AD, you'll need to use a security principal. The type of security principal you need depends on where your application runs. Use this table as a guide.
@@ -93,6 +91,28 @@ public static void GetBlobServiceClient(ref BlobServiceClient blobServiceClient,
9391

9492
If you know exactly which credential type you'll use to authenticate users, you can obtain an OAuth token by using other classes in the [Azure Identity client library for .NET](/dotnet/api/overview/azure/identity-readme). These classes derive from the [TokenCredential](/dotnet/api/azure.core.tokencredential) class.
9593

94+
## [SAS token](#tab/sas-token)
95+
96+
Create a [Uri](/dotnet/api/system.uri) by using the blob service endpoint and SAS token. Then, create a [BlobServiceClient](/dotnet/api/azure.storage.blobs.blobserviceclient) by using the [Uri](/dotnet/api/system.uri).
97+
98+
```csharp
99+
public static void GetBlobServiceClientSAS(ref BlobServiceClient blobServiceClient,
100+
string accountName, string sasToken)
101+
{
102+
string blobUri = "https://" + accountName + ".blob.core.windows.net";
103+
104+
blobServiceClient = new BlobServiceClient
105+
(new Uri($"{blobUri}?{sasToken}"), null);
106+
}
107+
```
108+
109+
To learn more about generating and managing SAS tokens, see the following articles:
110+
111+
- [Grant limited access to Azure Storage resources using shared access signatures (SAS)](../common/storage-sas-overview.md?toc=/azure/storage/blobs/toc.json)
112+
- [Create an account SAS with .NET](../common/storage-account-sas-create-dotnet.md)
113+
- [Create a service SAS for a container or blob](sas-service-create.md)
114+
- [Create a user delegation SAS for a container, directory, or blob with .NET](storage-blob-user-delegation-sas-create-dotnet.md)
115+
96116
## [Account key](#tab/account-key)
97117

98118
Create a [StorageSharedKeyCredential](/dotnet/api/azure.storage.storagesharedkeycredential) by using the storage account name and account key. Then use that object to initialize a [BlobServiceClient](/dotnet/api/azure.storage.blobs.blobserviceclient).
@@ -119,30 +139,8 @@ BlobServiceClient blobServiceClient = new BlobServiceClient(connectionString);
119139

120140
For information about how to obtain account keys and best practice guidelines for properly managing and safeguarding your keys, see [Manage storage account access keys](../common/storage-account-keys-manage.md).
121141

122-
## [SAS token](#tab/sas-token)
123-
124-
Create a [Uri](/dotnet/api/system.uri) by using the blob service endpoint and SAS token. Then, create a [BlobServiceClient](/dotnet/api/azure.storage.blobs.blobserviceclient) by using the [Uri](/dotnet/api/system.uri).
125-
126-
```csharp
127-
public static void GetBlobServiceClientSAS(ref BlobServiceClient blobServiceClient,
128-
string accountName, string sasToken)
129-
{
130-
string blobUri = "https://" + accountName + ".blob.core.windows.net";
131-
132-
blobServiceClient = new BlobServiceClient
133-
(new Uri($"{blobUri}?{sasToken}"), null);
134-
}
135-
```
136-
137-
To generate and manage SAS tokens, see any of these articles:
138-
139-
- [Grant limited access to Azure Storage resources using shared access signatures (SAS)](../common/storage-sas-overview.md?toc=/azure/storage/blobs/toc.json)
140-
141-
- [Create an account SAS with .NET](../common/storage-account-sas-create-dotnet.md)
142-
143-
- [Create a service SAS for a container or blob](sas-service-create.md)
144-
145-
- [Create a user delegation SAS for a container, directory, or blob with .NET](storage-blob-user-delegation-sas-create-dotnet.md)
142+
> [!IMPORTANT]
143+
> The account access key should be used with caution. If your account access key is lost or accidentally placed in an insecure location, your service may become vulnerable. Anyone who has the access key is able to authorize requests against the storage account, and effectively has access to all the data. `DefaultAzureCredential` provides enhanced security features and benefits and is the recommended approach for managing authorization to Azure services.
146144
147145
---
148146

‎articles/storage/blobs/storage-blob-java-get-started.md

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -87,8 +87,6 @@ To learn more about creating and managing client objects, see [Create and manage
8787

8888
You can authorize a `BlobServiceClient` object by using an Azure Active Directory (Azure AD) authorization token, an account access key, or a shared access signature (SAS).
8989

90-
To learn more about each of these authorization mechanisms, see [Authorize access to data in Azure Storage](../common/authorize-data-access.md).
91-
9290
## [Azure AD (Recommended)](#tab/azure-ad)
9391

9492
To authorize with Azure AD, you'll need to use a [security principal](../../active-directory/develop/app-objects-and-service-principals.md). Which type of security principal you need depends on where your application runs. Use the following table as a guide:

‎articles/storage/blobs/storage-blob-python-get-started.md

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -53,8 +53,6 @@ To learn more about creating and managing client objects, see [Create and manage
5353

5454
You can authorize a `BlobServiceClient` object by using an Azure Active Directory (Azure AD) authorization token, an account access key, or a shared access signature (SAS).
5555

56-
To learn more about each of these authorization mechanisms, see [Authorize access to data in Azure Storage](../common/authorize-data-access.md).
57-
5856
## [Azure AD](#tab/azure-ad)
5957

6058
To authorize with Azure AD, you'll need to use a [security principal](/azure/active-directory/develop/app-objects-and-service-principals). Which type of security principal you need depends on where your application runs. Use the following table as a guide:
@@ -74,6 +72,16 @@ The following example creates a `BlobServiceClient` object using `DefaultAzureCr
7472

7573
:::code language="python" source="~/azure-storage-snippets/blobs/howto/python/blob-devguide-py/blob-devguide-auth.py" id="Snippet_get_service_client_DAC":::
7674

75+
## [SAS token](#tab/sas-token)
76+
77+
To use a shared access signature (SAS) token, provide the token as a string and initialize a [BlobServiceClient](/python/api/azure-storage-blob/azure.storage.blob.blobserviceclient) object. If your account URL includes the SAS token, omit the credential parameter.
78+
79+
:::code language="python" source="~/azure-storage-snippets/blobs/howto/python/blob-devguide-py/blob-devguide-auth.py" id="Snippet_get_service_client_SAS":::
80+
81+
To learn more about generating and managing SAS tokens, see the following article:
82+
83+
- [Grant limited access to Azure Storage resources using shared access signatures (SAS)](../common/storage-sas-overview.md?toc=/azure/storage/blobs/toc.json)
84+
7785
## [Account key](#tab/account-key)
7886

7987
To use a storage account shared key, provide the key as a string and initialize a [BlobServiceClient](/python/api/azure-storage-blob/azure.storage.blob.blobserviceclient) object.
@@ -86,13 +94,8 @@ You can also create a `BlobServiceClient` object using a connection string.
8694

8795
For information about how to obtain account keys and best practice guidelines for properly managing and safeguarding your keys, see [Manage storage account access keys](../common/storage-account-keys-manage.md).
8896

89-
## [SAS token](#tab/sas-token)
90-
91-
To use a shared access signature (SAS) token, provide the token as a string and initialize a [BlobServiceClient](/python/api/azure-storage-blob/azure.storage.blob.blobserviceclient) object. If your account URL includes the SAS token, omit the credential parameter.
92-
93-
:::code language="python" source="~/azure-storage-snippets/blobs/howto/python/blob-devguide-py/blob-devguide-auth.py" id="Snippet_get_service_client_SAS":::
94-
95-
To generate and manage SAS tokens, see [Grant limited access to Azure Storage resources using shared access signatures (SAS)](../common/storage-sas-overview.md?toc=/azure/storage/blobs/toc.json).
97+
> [!IMPORTANT]
98+
> The account access key should be used with caution. If your account access key is lost or accidentally placed in an insecure location, your service may become vulnerable. Anyone who has the access key is able to authorize requests against the storage account, and effectively has access to all the data. `DefaultAzureCredential` provides enhanced security features and benefits and is the recommended approach for managing authorization to Azure services.
9699
97100
---
98101

0 commit comments

Comments
 (0)