SAS
Shared access signature
Shared access signature, an Azure Storage token appended to a resource URL that grants whatever resources, permissions and time window it encodes to anyone who holds it. Account and service SAS are signed with the storage account key and a user delegation SAS with a Microsoft Entra key; a service SAS tied to a stored access policy can be revoked by deleting the policy, but an account SAS only by rotating the key.
- Also called
- SAS token
Covered in
Case study: Microsoft AI researchers' over-permissive SAS token (2023)
How an over-permissive Azure Storage SAS token in a public repository for AI models exposed internal Microsoft data in 2023, and how to scope, scan for and revoke signed URLs.
Apply a security baseline across AWS, Azure and Google Cloud
Give workloads platform identities instead of keys, guard the instance metadata endpoint, block public storage, keep audit logs past the default retention, close inbound admin ports and use the native secret store, with tested Terraform for AWS, Azure and Google Cloud.