Someone minted an account SAS with read, write, delete, and list on blob, file, and queue for one year and allowed HTTP. What should the security engineer issue instead?
Select an answer to reveal the explanation.
Short Explanation
That year-long, all-service, HTTP-OK account SAS is a skeleton key mailed on a postcard. Cut a tiny one: one container, read, short clock, HTTPS only.
Full Explanation
SAS hardening limits resource scope, permissions, validity period, and permitted protocol. An account SAS spanning multiple services with broad verbs and long lifetime maximizes abuse if leaked. Prefer container-scoped, read-only, short-lived, HTTPS-only signatures—and prefer user-delegation SAS when Entra is available. Substituting the raw account key increases standing risk rather than reducing it.