Skip to main content

(Azure) Difference between Shared Access Signature and Shared Access Policy

In this post we will discuss about Shared Access Signature and Shared Access Policy, focusing on what are the different between them.

Let's start with Shared Access Signature (SAS). It provides delectated access to a specific Azure resource. We can specify the resources that we want to allow access, how long we allow access (start and end time) and what kind of operations can be done.
The SAS key is like a token, that can be used by a 3rd party to access a specific resource. In general, the SAS key is included in the URL that is used to access the resource.
A SAS token can be generated very easily and will be available until the expiration time. What happens when we realize that the token is in hands of an unauthorized person or system. Unfortunately we cannot revoce the token. What we can do in this case is to revoke all the SAS tokens that were created with a specific account key. By regenerating the primary account key of a Azure Storage for example we will invalidate all the SAS tokens that were generated with that specific account key.

Shared Access Policy (SAP) define a specific policy rule that can be used to generate SAS keys. All the access constrains that are define by a SAP will be inherit by the SAS key (resource, expiration time, start time and permissions).

In this way we can define a specific SAP that allow us read only access to a file and generate multiple SAS keys for different clients, based on that SAP. If we need to revoke the SAS key, we can remove the SAP with the given name and generate a new one (with a new name). In this way all SAS key that were generated for that SAP will be invalid.

When you are using SAP you are allowed to change the access tuple (expiration time, permission and so on). This can be done directly to SAP. But when we are using SAS, we are not allowed to edit the SAS key. The only thing that we can do is to revoke it (change the account key).

SAS and SAP Comparison
- -SAS-
Can be revoked separately
Can be changed
Number of keys per resource is limited
Yes, but we can generate for a SAP as many SAS we need
When generated, triggers an HTTP/S request to Azure

In conclusion, we can say that Shared Access Signature and Shared Access Policy are very similar, but in the same time there are some attributes that are specific to SAS or SAP. Based on our needs we can decided to use one or another.


Popular posts from this blog

ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded

Today blog post will be started with the following error when running DB tests on the CI machine:
threw exception: System.InvalidOperationException: The Entity Framework provider type 'System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer' registered in the application config file for the ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded. Make sure that the assembly-qualified name is used and that the assembly is available to the running application. See for more information. at System.Data.Entity.Infrastructure.DependencyResolution.ProviderServicesFactory.GetInstance(String providerTypeName, String providerInvariantName) This error happened only on the Continuous Integration machine. On the devs machines, everything has fine. The classic problem – on my machine it’s working. The CI has the following configuration:

TeamCity.NET 4.51EF 6.0.2VS2013
It seems that there …

Entity Framework (EF) TransactionScope vs Database.BeginTransaction

In today blog post we will talk a little about a new feature that is available on EF6+ related to Transactions.
Until now, when we had to use transaction we used ‘TransactionScope’. It works great and I would say that is something that is now in our blood.
using (var scope = new TransactionScope(TransactionScopeOption.Required)) { using (SqlConnection conn = new SqlConnection("...")) { conn.Open(); SqlCommand sqlCommand = new SqlCommand(); sqlCommand.Connection = conn; sqlCommand.CommandText = ... sqlCommand.ExecuteNonQuery(); ... } scope.Complete(); } Starting with EF6.0 we have a new way to work with transactions. The new approach is based on Database.BeginTransaction(), Database.Rollback(), Database.Commit(). Yes, no more TransactionScope.
In the followi…

GET call of REST API that contains '/'-slash character in the value of a parameter

Let’s assume that we have the following scenario: I have a public HTTP endpoint and I need to post some content using GET command. One of the parameters contains special characters like “\” and “/”. If the endpoint is an ApiController than you may have problems if you encode the parameter using the http encoder.
using (var httpClient = new HttpClient()) { httpClient.BaseAddress = baseUrl; Task<HttpResponseMessage> response = httpClient.GetAsync(string.Format("api/foo/{0}", "qwert/qwerqwer"))); response.Wait(); response.Result.EnsureSuccessStatusCode(); } One possible solution would be to encode the query parameter using UrlTokenEncode method of HttpServerUtility class and GetBytes method ofUTF8. In this way you would get the array of bytes of the parameter and encode them as a url token.
The following code show to you how you could write the encode and decode methods.