azure - 用户委托(delegate) key 与帐户 key - 安全性？

Question

在 Microsoft 的用户委托(delegate) key 文档中，它说:

A SAS token for access to a container, directory, or blob may besecured by using either Azure AD credentials or an account key. A SASsecured with Azure AD credentials is called a user delegation SAS.Microsoft recommends that you use Azure AD credentials when possibleas a security best practice, rather than using the account key, whichcan be more easily compromised. When your application design requiresshared access signatures, use Azure AD credentials to create a userdelegation SAS for superior security.

为什么这种方法能够提供“卓越的安全性”？我想 SAS token 都是安全的？那么为什么一种方法比另一种方法更安全呢？如果您使用存储访问策略，当帐户 key 出现问题时，您还可以撤销 SAS token 。

Answer 1

用户委托(delegate) SAS token 更安全，因为它不依赖于仅包含在 SAS token 中的权限。它还考虑创建此 SAS token 的用户的 RBAC 权限。使用共享访问 key 创建的 SAS token 仅考虑 SAS token 中包含的权限。

例如，假设创建用户委托(delegate) SAS 的用户仅对 Blob 容器具有读取权限(即，他们只能列出或下载 Blob 容器中的 Blob)。现在假设用户创建一个具有写入权限的 SAS token 。当使用此 SAS token 上传 Blob 时，操作将失败，因为用户没有该 Blob 容器的写入权限，而如果使用共享访问创建 SAS token ，则上传操作将会成功关键。

有关这方面的更多信息，请访问 here (强调我的):

When a client accesses a Blob storage resource with a user delegationSAS, the request to Azure Storage is authorized with the Azure ADcredentials that were used to create the SAS. The role-based accesscontrol (RBAC) permissions granted for that Azure AD account, togetherwith the permissions explicitly granted on the SAS, determine theclient's access to the resource. This approach provides an additionallevel of security and avoids the need to store your account access keywith your application code. For these reasons, creating a SAS usingAzure AD credentials is a security best practice.

The permissions granted to a client who possesses the SAS are theintersection of the permissions granted to the security principal thatrequested the user delegation key and the permissions granted to theresource on the SAS token using the signedPermissions (sp) field. If apermission granted to the security principal via RBAC is not alsogranted on the SAS token, then that permission is not granted to theclient who attempts to use the SAS to access the resource. Whencreating a user delegation SAS, make sure that the permissions grantedvia RBAC and the permissions granted via the SAS token both align tothe level of access required by the client.