azure - 如何撤销Azure SDK中的共享访问签名

Question

我找不到任何用于撤销在 blob 上创建的共享访问签名访问权限的代码示例，任何人都可以向我提供用于删除之前创建的共享访问签名访问权限的链接或引用。

Answer 1

即使共享访问签名 (SAS) 基于存储访问策略 (SAP)，您也只能撤销 SAP，而不能撤销单个 SAS。

Azure 存储安全指南有很好的详细信息: https://learn.microsoft.com/en-us/rest/api/storageservices/create-service-sas#revoke-a-sas

SAS 不基于 SAP - 无法撤销:

If you are using ad hoc URIs, you have three options. You can issue SAS tokens with short expiration policies and wait for the SAS to expire. You can rename or delete the resource (assuming the token was scoped to a single object). You can change the storage account keys. This last option can have a significant impact, depending on how many services are using that storage account, and probably isn't something you want to do without some planning.

基于 SAP 的 SAS - 可以通过撤销 SAP 来撤销:

If you are using a SAS derived from a Stored Access Policy, you can remove access by revoking the Stored Access Policy – you can just change it so it has already expired, or you can remove it altogether. This takes effect immediately, and invalidates every SAS created using that Stored Access Policy. Updating or removing the Stored Access Policy may impact people accessing that specific container, file share, table, or queue via SAS, but if the clients are written so they request a new SAS when the old one becomes invalid, this will work fine.

最佳实践:

Because using a SAS derived from a Stored Access Policy gives you the ability to revoke that SAS immediately, it is the recommended best practice to always use Stored Access Policies when possible.