Lab — Issue a signature you can actually revoke
AZ-104 › Unit 2 › Lab
Lab — Issue a signature you can actually revoke
Lab brief
- AZ104-U2.T1
- 25 minutes
- A Standard_LRS storage account, a container, a stored access policy
- required
- Core
The claim to make physical: a signature you issued without a stored access policy cannot be called back. You will issue one of each and try to revoke both.
Before you start
A subscription, and az login with an identity holding a data-plane role on the storage account — a user delegation SAS is authorized with your Entra credentials, not with the account key. One small LRS account for a few minutes costs pennies; the teardown removes it.
Walkthrough
Issue a signature you can actually revoke
1. Create the account and a container
Create a Standard_LRS account in a resource group you will delete afterwards, then a container in it. Keep it small. This lab, the lifecycle lab and the governance lab's storage account are the only places in the set that touch a billable resource at all.
Did it teach you what it was meant to?
A partner's contract ends early and their service SAS has three weeks left. It was not issued against a stored access policy. What are your options?
Why does step 2 require --auth-mode login where step 3 does not?
What goes wrong
Tear it down
Run this whether or not the lab worked. Everything above was chosen to cost approximately nothing, and leaving it in place is how approximately nothing becomes something.
Teardown
Delete the resource group
az group delete --name bb-lab-storage. This is the one lab that leaves a billable resource behind if you skip the teardown, so do not skip it.
Where these figures come from
Every figure above was read from the raw documentation below on the day this sheet was written. The sha1 is git hash-object over the bytes as fetched, so a doc that changes underneath this sheet can be detected rather than assumed.
| Document | sha1 |
|---|---|
| Create a user delegation SAS with Azure CLI | 477b8225fd48 |
| Grant limited access to Azure Storage resources using SAS | 09e006bc7e1b |
| Create a stored access policy | b3ae20db97dd |
| Manage storage account access keys | 950acf9dc800 |
| Manage Azure resource groups by using Azure CLI | a3840d837a3d |