Creation of Private Storage for Internal Comapny Document with Restricted Access on Azure .
Published: 2024-05-28 07:58:07

The company requires secure storage for its offices and departments to ensure that private content is not shared without consent. This storage must have high availability to withstand regional outages and will also be used for backing up the public website.

Our goals are as follows:

- Create a storage account for the company's private documents.
- Configure redundancy for the storage account.
- Set up a shared access signature to provide partners with restricted access to specific files.
- Back up the public website storage.
- Implement lifecycle management to move content to the cool tier.

Let us Start: 
Create a storage account for the internal private company documents.
In the portal, search for and select Storage accounts.
Select + Create.
![search for and select Storage accounts](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5sxnxcimflmg1quvj3bc.png)
![Select + Create](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6lwtzozz32ncj7scwyxk.png)

Select the Resource group created in the previous lab.
![Select the Resource group ](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4upof0fvuq4aqey75ork.png)

Set the Storage account name to private. Add an identifier to the name to ensure the name is unique.
![Storage account name to private](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qr78fspj67dnyq08mr6m.png)

Select Review, and then Create the storage account.
![Select Review](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4lcow5btcjk8prl4chw3.png)
![Create the storage account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ylk3xd9k1vstrwj2c3dj.png)

Wait for the storage account to deploy, and then select Go to resource.
![Go to resource](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nx7mokwemoaio1unqifg.png)

This storage requires high availability if there’s a regional outage. Read access in the secondary region is not required. Configure the appropriate level of redundancy.

In the storage account, in the Data management section, select the Redundancy blade.
![select the Redundancy blade](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/a3uls63af2n6uct7wmpj.png)

Ensure Geo-redundant storage (GRS) is selected.
![Geo-redundant storage (GRS)](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/whirosg4mcwy9eklnrt1.png)

Refresh the page.
Review the primary and secondary location information.
Save your changes.
![Save your changes](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0a1tpw0um0524fii1by4.png)



Create a storage container, upload a file, and restrict access to the file.
Create a private storage container for the corporate data.

In the storage account, in the Data storage section, select the Containers blade.
![select the Containers blade](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7xemyxpepjgtvhkc0wso.png)

Select + Container.
![Select + Container](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1sau64450129jf07k5zr.png)

Ensure the Name of the container is private.
Ensure the Public access level is Private (no anonymous access).
![Name of the container](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i29nj9cnp1nf49997qef.png)

As you have time, review the Advanced settings, but take the defaults.
Select Create.
![Select Create](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/o43pyn6otnmkg9562jbi.png)

For testing, upload a file to the private container. he type of file doesn’t matter. A small image or text file is a good choice. Test to ensure the file isn’t publically accessible.

Select the container.
Select Upload.
![Select Upload](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2e1g28okftu20pzven9x.png)


Browse to files and select a file.
Upload the file.
![Upload the file](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fxzetd2ya2889wd1mma1.png)

Select the uploaded file.
On the Overview tab, copy the URL.
![copy the URL.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vnvck28lau56zwc4xzjg.png)

Paste the URL into a new browser tab.
Verify the file doesn’t display and you receive an error.
![Verify the file doesn’t display](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dvrd7lauxvxigo4sxhyb.png)

An external partner requires read and write access to the file for at least the next 24 hours. Configure and test a shared access signature (SAS). 

Select your uploaded blob file and move to the Generate SAS tab.
![Read permissions.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gx44lrxbhcjfrgpe9y76.png)

In the Permissions drop-down, ensure the partner has only Read permissions.
![Read permissions.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nzftvolgzf77ob2qfho6.png)

Verify the Start and expiry date/time is for the next 24 hours.
Select Generate SAS token and URL.
![expiry date/time](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t6uk3hduc3li321xg9x4.png)

Copy the Blob SAS URL to a new browser tab.
![Copy the Blob SAS URL](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ni6ms76t7cqzpzkxleaf.png)
Verify you can access the file. If you have uploaded an image file it will display in the browser. Other file types will be downloaded.

Configure storage access tiers and content replication.
To save on costs, after 30 days, move blobs from the hot tier to the cool tier. 

Return to the storage account.
In the Overview section, notice the Default access tier is set to Hot.
![access tier is set to Hot.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t5f7lgf5a20utl5bdf7b.png)

In the Data management section, select the Lifecycle management blade.
![Lifecycle management blade](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mek78y52lk3t2tcuza78.png)

Select Add rule.
![Add rule](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sb9l6edekqby38w25wlu.png)


Set the Rule name to movetocool.
![movetocool](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/m4s8b4p8n7zgfzhq75pf.png)

Set the Rule scope to Apply rule to all blobs in the storage account.
![Set the Rule scope to Apply](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/auw6z7xqssboaqn74bpo.png)

Select Next.
![Select Next](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3t2eqppjmcyerffl8cqv.png)

Ensure Last modified is selected.
![Last modified is selected](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hielko491eiv7g79rwwb.png)

Set More than (days ago) to 30.
In the Then drop-down select Move to cool storage.
![Move to cool storage](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mmhx3x7y7ao16xsi4024.png)

As you have time, review other lifecycle options in the drop-down.
Add the rule.
![Add the rule.](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/igx90v7uco5j24hyh3f6.png)


The public website files need to be backed up to another storage account.

In your storage account, create a new container called backup. Use the default values. _Refer back to the container we created earlier if you need detailed instructions._
![Backup container](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/evd9dwhep09p00ntvl5s.png)

Navigate to your publicwebsite storage account. This storage account was created in the previous articles
![publicwebsite storage account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wjhzca8pf3emd7sgsmub.png)

In the Data management section, select the Object replication blade.
![Object replication blade](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/y1b1zkgd9a3fujclaxbk.png)

Select Create replication rules.
![ Create replication rules](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nh0qf7l8ycjrky2h5as6.png)


Set the Destination storage account to the private storage account.
![Destination storage account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1yx9sarfx818cah8j99l.png)

Set the Source container to public and the Destination container to backup.
![Set the Source container](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/67whfbo532bnqk10jvoc.png)

Create the replication rule.
![replication rule](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sffjr13hhgcrwsgwau9w.png)


Optionally, as you have time, upload a file to the public container. Return to the private storage account and refresh the backup container. Within a few minutes your public website file will appear in the backup folder.
As seen below: 

File uploaded to public container 
![File uploaded ](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dsbkpq2vr78cxag8jcnf.png)

File backed up seen in backup container 
![backed up seen ](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/w0rdpso2fz0d8ng4gjrl.png)