liveBook · Manning

Account access key

As explained in Azure Security

A storage account key is a long-lived Azure Storage credential that provides broad access to the resources and data in a storage account.

An account access key is a long-lived Azure Storage credential with broad access to resources and data. Treat it like an administrator password: anyone who obtains it can access storage data, even when control-plane permissions are otherwise limited. section 5.1.2

Azure Storage supports account keys for data-plane authorization across blobs, files, queues, and tables. Microsoft Entra ID with Azure RBAC is the recommended alternative, while shared access signatures provide more constrained access. section 5.1.3

Authorize a container operation with an account key by supplying:

  • The storage account name with --account-name. section 5.1.3
  • The target container name with --name. section 5.1.3
  • The credential with --account-key and explicitly select --auth-mode key. section 5.1.3

Create a container with a storage account key

az storage container create --account-name storage012 --name mycontainer --account-key <storage-account-key> --auth-mode key section 5.1.3

Listing 5.8 Authorizing data plane operations using a storage account key
az storage container create                  #1
--account-name storage012                  #2
--name mycontainer                         #3
--account-key 2015-02-21&st=2015-07...     #4
--auth-mode key                            #5
#1 The Azure CLI command to create the Azure Storage container
#2 The Azure Storage account name
#3 The container name
#4 The storage account key
#5 You need to use the key parameter for authorization via the storage account key.

Inspect the complete Azure CLI example and the meaning of each account-key parameter. section 5.1.3

How Azure Security covers it

How deep it goes
Defines broad access, contrasts alternatives, and demonstrates Azure CLI parameters without detailing key rotation or storage mechanics.
Examples
Demonstrates creating a storage container with az storage container create, --account-key, and --auth-mode key.
What it assumes
Assumes familiarity with Azure Storage accounts and containers while distinguishing control-plane permissions from data-plane access.
What you can do after
Operate Azure Storage through Azure CLI by authorizing a container-creation command with an account key.
How it connects
Connects account access keys with Azure RBAC, Microsoft Entra ID, shared access signatures, and data-plane operations.
Cover of Azure Security
liveBookmanning.com
Read Azure Security on liveBook Get the book at manning.com

Related concepts

This explainer was generated by Manning's knowledge graph from the text of Azure Security. The section links point to the parts of the book it draws on.