Secure File Sharing with Azure Storage and Encryption
Tags: azure, microsoft, cloud, devops
Published: 2024-07-05 22:15:28

This blog post will guide you through creating secure shared storage for your application in Microsoft Azure. We'll cover storage account creation, access control with managed identities, and data encryption using Azure Key Vault.

**Creating a Secure Storage Account**

1. **Search** for "Storage Account" in Azure and create one with your desired name and resource group.

    ![Searching for Storage Account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0ifg9o2i3z85k7o126w1.jpg)
![Going to Encryption](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d4dnrsgn5bg6pgc1v3fv.jpg)
2. **Enable Infrastructure Encryption** for added security at rest.
    ![Enabling the Encryption](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l3tcxw7c8a94snklbhdp.jpg)

**Adding Managed Identity for Access Control**

1. Search for "Managed Identities" and create one within your resource group.
    ![Creating managed identity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/etkpf65thuhs4k799tmj.jpg)
    ![Configuring the Managed Identity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cngestpn531b2iec6fdr.jpg)
2. Go to your storage account's **Access Control (IAM)** settings.
    ![Locating the IAM Access Control](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b0eavqyjqpv62d5jeuur.jpg)
3. Assign the **Storage Blob Data Reader** role to the managed identity you created.
    ![Adding a role assignment](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1vdztjccf3k1525wp5fa.jpg)
    ![Search for storage blob data reader](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nb13ljk4figh4a7odfyi.jpg)
    ![Assignning to Managed identity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lq091m2auurmfncoplrh.jpg)
    ![Searching for the managed identity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jjq1e3dnqtf8ophld71v.jpg)

**Securing Storage with Key Vault and Key**

1. Ensure you have **Key Vault Administrator** permissions. Assign this role to your user account.
    ![Navigating back to the storage account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mevfuffhm38c5fr8odyk.jpg)
    ![Locating IAM Control again](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qwbutvx0y8jf75whmswj.jpg)
    ![Adding role assignment](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1nbpq19ivmcecmadziqa.jpg)
    ![Adding key vault admin role](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/89xuticf2bsk5kjp76gm.jpg)
    ![Adding role assignment to your user](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ywz9xarv0v21vvvlhidp.jpg)

2. Search for "Key Vaults" and create one with a name and resource group.
    ![Creating Key Vault](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vybw1zvfrfmtkzss0abn.jpg)
    ![Configuring Key Vault](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dzxo7vuougnyklz2klvs.jpg)
    ![Changing the Access Configuration](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b27cvwmseaos84mf4l1g.jpg)
3. Enable **Soft delete** and **Purge protection** for additional security.
    ![Checking soft-delete and purge protection enabled](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3u8pcd94hj7z5m9ld8eg.jpg)

4. Generate a new key within the Key Vault.

    ![Generating the key](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4po9vcl3q61f32fkjg4w.jpg)
    ![Creating the key](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hvs5ruqd2zmjir4w3loc.jpg)

**Configuring Storage Account to Use Key Vault Key**

1. In your resource group's IAM settings, assign the **Key Vault Crypto Service Encryption User** role to your managed identity.
    ![Searching for the key vault crypto role](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mi3pcc3yh8u9wz6yhfic.jpg)
    ![Assigning the role to your identity](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/jqru1avomolagb3fptvn.jpg)
2. Go to your storage account's **Encryption** settings and configure it to use the customer-managed key from your Key Vault.
    ![Locating Encryption in the Storage Account](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nglte16hgua95agvlo4i.jpg)
    ![Configuring the Encryption](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5jydqdv9vs2g4b0adpz2.jpg)
3. Select the managed identity you created to give it access to the key.
    ![Selecting the key](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/7zr01l5ynrda5w4qajul.jpg)

**Setting Retention Policy and Encryption Scope**

1. Create a container named "hold" within your storage account.
    ![Locating Container](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/bsy44qy79h991ucpl1r6.jpg)
2. Upload a file to the container.
    ![Uploading a file to the container](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/rzgzavathkgp0td7amss.jpg)
3. Set a **time-based retention policy** on the container to prevent accidental deletion for a specified period (e.g., 5 days).
    ![Locating Access Policy of the Container](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gx2ozqx2co2ha94of00w.jpg)
    ![Creatign an imutable policy](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8npyhr9p1hmtj9dqjzvv.jpg)
4. Create an **encryption scope** within your storage account for additional infrastructure-level encryption.
    ![Creating the encryption scope](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fo73kkmkoj7k9oh2trx8.jpg)


**Conclusion**

By following these steps, you've created a secure shared storage solution in Azure. You've leveraged managed identities for access control, secured data with Azure Key Vault, and implemented retention policies and encryption scopes for enhanced protection. Remember to clean up your resources after following this guide in a non-production environment.