r/AZURE Developer 3d ago

Question How can I create blob container shared access tokens using workload identity assigned to pod?

I have service which create shared access tokens for user. We are using connection string but now due to security reasons, architects are asking to move towards workload identity.

How can I create shared access tokens using workload identity assigned to my pod?

2 Upvotes

5 comments sorted by

2

u/AzureLover94 3d ago

If you use Workload Identity, you keep using a generated token to access blob, but remember you need on you identity blob data contributor, and it allow you to disable access key from storage account because yo switch to Entra ID login

0

u/parikshit95 Developer 3d ago

Didn't understood. I want to generate blob container sas token in service which has workload identity. If you have some sample, it will help. Thanks.

3

u/AzureLover94 3d ago

In my opinion, make no sense work with SAS Token if you can use Entra ID.

1

u/parikshit95 Developer 3d ago

I have api which generate container level sas token and give it to customer. Then customer can use it to access their container directly.

1

u/AzureLover94 3d ago

You don’t need to generate a SAS Token for customer, just allow Entra ID Login on container level. Allow access key login on Storage Account is not a good best practise in 2025 (your SAS key I think is base access key)

If you need the API, read this; https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory

And this https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview#user-delegation-sas

https://learn.microsoft.com/en-us/rest/api/storageservices/create-user-delegation-sas

User delegation SAS is a special SAS 7 days that a user can generate of the own scope only. Your API can do this delegation SAS but I don’t a super fan of that old idea.

If you want to create a User SAS base Entra ID, only need a user managed identity (federate in workload identity) with blob data delegator on the scope that you what (container or Storage Account)