A service SAS for lock photos was emailed with expiry baked into the URI; the contractor left and the URI still works. How should the security engineer make future service SAS revocable?
Select an answer to reveal the explanation.
Short Explanation
An emailed SAS with the expiry tattooed on it is a lost wristband you can’t void. Glue service SAS to a stored access policy—change or delete the policy and the wristband dies.
Full Explanation
Service SAS tokens can reference a container (or share) stored access policy that centralizes start time, expiry, and permissions. Changing or deleting that policy revokes outstanding signatures that use it. Ad-hoc SAS with only URI-embedded expiry cannot be shortened without rotating signing keys. User-delegation SAS do not use stored access policies; revocation patterns differ. Waiting out a long baked-in expiry leaves an unnecessary window open.