Microsoft Azure Documentation

Manage Access Keys for Azure Storage

Azure Storage account access keys provide full access to your storage account. It's crucial to manage these keys securely to protect your data. This tutorial will guide you through the process of viewing, regenerating, and rotating your storage account access keys.

Why Manage Access Keys?

Access keys are powerful credentials. If compromised, an attacker could gain complete control over your storage account, potentially leading to data loss, corruption, or unauthorized access. Regular key rotation is a best practice for enhancing security.

Viewing Storage Account Access Keys

You can view your storage account access keys in the Azure portal. Follow these steps:

1. Sign in to the Azure portal.
2. Navigate to your storage account.
3. In the left-hand menu, under Security + networking, select Access keys.
4. The portal will display two keys (key1 and key2) and their corresponding connection strings.

Regenerating Access Keys

If you suspect a key has been compromised or as part of a routine security measure, you can regenerate your access keys. Regenerating a key invalidates the old key. Azure provides two keys (key1 and key2) to allow for a seamless transition. You can regenerate one key at a time.

Steps to Regenerate a Key:

1. In the Access keys page for your storage account, select Show keys if they are not already visible.
2. Click the Regenerate button next to the key you want to regenerate (e.g., key1).
3. Confirm the action when prompted.
4. After regenerating key1, update all applications and services that use key1 to use the new key.
5. Once all services are updated, you can repeat the process for key2.

This strategy ensures that your application can continue to access storage using the remaining valid key while you update your configurations.

Using Key Rotation Best Practices

To minimize downtime and risk:

• Regenerate one key at a time.
• Update applications sequentially.
• Test thoroughly after updating each application.
• Consider using Managed Identities or Shared Access Signatures (SAS) for more granular and secure access where full account access is not required.

Example: Accessing Storage with Keys (C#)

Here's a basic example of how you might use an access key in a C# application to connect to Azure Blob Storage:

using Azure.Storage.Blobs;

string accountName = "YOUR_STORAGE_ACCOUNT_NAME";
string key = "YOUR_STORAGE_ACCOUNT_ACCESS_KEY"; // Replace with your actual key

// Construct the connection string
string connectionString = $"DefaultEndpointsProtocol=https;AccountName={accountName};AccountKey={key};EndpointSuffix=core.windows.net";

// Create a BlobServiceClient object
BlobServiceClient blobServiceClient = new BlobServiceClient(connectionString);

// Example: List containers in the storage account
Console.WriteLine("Containers:");
await foreach (var container in blobServiceClient.GetBlobContainersAsync())
{
    Console.WriteLine($"- {container.Name}");
}
                

Alternative Authentication Methods

While access keys are convenient, Azure offers more secure alternatives for authentication:

• Shared Access Signatures (SAS): Provide limited, time-bound, and permission-specific access to resources. See Use Shared Access Signatures (SAS).
• Azure Active Directory (Azure AD) with Managed Identities: For applications running on Azure services (like App Service, VMs, Functions), Managed Identities provide an identity for the application to use when connecting to Azure services that support Azure AD authentication. This eliminates the need to manage credentials altogether.

Conclusion

Managing your Azure Storage account access keys effectively is a cornerstone of robust security. By understanding how to view, regenerate, and rotate these keys, and by exploring more secure authentication alternatives, you can significantly enhance the protection of your data in Azure Storage.