Today we're gonna do a tutorial on how you can configure and secure your storage account
optimally inside of Azure so plan for this video this is going to be a tutorial Style video I'm
gonna hop onto my Mac behind me and I'm going to open my Azure portal and get started now for
this tutorial you will need access to Azure and you will need to have logged in and have
a subscription ready because we're actually going to configure a storage account now the reason for
configuring a storage account today is because so many people are doing this wrong when it
comes from a security perspective so I want to show you how to do it properly okay now a long
time later I had to run some errands we can get into configuring the storage account so to recap
you need access to the Azure portal already so the first thing that I'm gonna do is I am going
to open up the Azure portal portal.azure.com and they all say I already have an Azure subscription
now if I click on resources I barely have any I mean I just have some basic of networking
resources right now we need some nsgs Etc I'm going to go and create a and I'm going to type
in a search for storage account and then I am going to create the storage account
okay now here this is where you're going to fill in all your information I'm actually
going to select the RG pass Services resource Group and then the storage account name this
is kind of important you can't just use a random storage account name this is a rookie error you
can't use blob zero one you'll see later it's not actually block zero one I changed it but
otherwise it will fail then the region where you deploy your resources is also really important
I'm deploying in East us which means that it's cheaper and I don't have any data governance or
sovereignty issues you should deploy in a region so that you don't have any data issues and then
from a redundancy perspective I'm actually going to choose a local redundant storage here
because I don't have a need to have Geo redundant storage I'm just using this as a test environment
if you didn't do need this from a corporate and backup perspective if you're running an
Enterprise environment then used to your redundant storage right so then we're going to go next and
we're going to see some of the security features right so the first one there or the first three
on the top is around um that like securing the containers and the data operations so the first
one is the API component so I really want to use SMB version 3 so I'm going to leave that
enabled allowing access to the container I'm gonna disable Public Access because I don't
want to allow public access to the containers the security component here and then I'm Gonna Leave
the fact that I want to use SAS signatures enable and I'm not going to tick the box to have default
authorization for active directory I'm going to use TLS version 1.2 and then from a restricted
copy operations perspective I'm gonna restrict it to only copy inside of my Azure tenant because
I don't want it to be from any storage account I only wanted to be in lockdown into my tenant
then I'm not gonna spend much time on this data like options and the SFTP options for now
um for now I'm just going to leave all these settings as is um there's just one setting so I'm
just going to change this allowing crust in and replication I'm going to turn that off because I
don't have crossed in it so I don't really want to use that then from a network access perspective I
really highly suggest that you always disable Public Access and use a private endpoint
for your past services so from that perspective I'm gonna quickly configure my private endpoint
I'm going to put it into that nhg that you saw earlier and then I am going to use the Azure
default DNS here for that component like I was saying earlier you always want to have a you want
to use private endpoint for your past Services keyboard search accounts Etc wherever possible
or if you really have to allow access from certain networks then do that but the difference is that
a private endpoint really restricts your storage account to your network environment via DNA so it
doesn't use the Microsoft default Network Services and routing services so no one on the default
Microsoft backbone even knows that your storage account exists so that's why private endpoint is
the recommended way however you don't always have to use private endpoint highly recommended but you
can also lock it down to specific networks though it just don't allow public access to your storage
okay um then I'm going to move to the network reading component so for this component I'm
just going to allow the routing traffic to travel over the Microsoft network and basically
notify internet routing if we look at the data protection components here I'm going to leave
most things as default enabling self-delete and enabling soft delete for your blobs and for all
your file shares is is really important and it helps in case someone accidentally deletes your
your configuration then the next component that we are going to move to is the encryption I'm gonna
use the Microsoft manage case for this for my configuration however the best practice security
recommendation in an Enterprise environment is to use customer managed keys because customer
manage Keys means that you own the key which means that you own the encryption of your data Microsoft
managed Keys you don't own the key right because this is a test account and a storage account that
I'll probably delete later I'm just going to leave it with Microsoft manage keys and then
just enabling support for customer manage case I'm going to enable that for all types not just
blobs and files because maybe later I want to use that for tables and queues as well and
then infrastructure encryption I am not going to double encrypt my storage account at this
stage tagging really important in an Enterprise environment however I'm not going to text I'm
going to move straight to review and now at the review stage you can check that everything has
been validated like I said earlier if you look at my storage account name now you'll be able to see
that actually I changed my storage account name because it can't be blob zero one that will not
work and now we click create and then we have coffee I moved it along for you guys so now you
can see that the resource deployment is complete and I'm actually going to go to the resources yeah
and then okay now you can see my CQ blob01 has been created you can see that it is inside of
my subscription and we have all of the blob Services we have it in the right
resource Group and then we can see the security components we can see the networking components
we can see the blood sugars and all of the components right
now the first thing that I actually want to check here is that if your recall I disabled
public access to this blob so if I go to the container and I try to access this container
I should not be able to access it because it should have a network restriction better boom
take note if you have created you have a network service that's allowed to access your storage
account you may not be able to access it right makes sense so what you need to do is you either
need to have an IP on that Network range or you need to allow access to your private endpoint DNS
services or you need to go and do a shortcut route like I will do today by adding your
specific IP address into the configuration of what is allowed so for this I'm going to go to
the networking configuration down here and then let's first just look at the configuration as it
is so you can see that we do have Public Access disabled here and when we look at the private
endpoint component you can see that we do have the private storage endpoint configuration there
now I'm going to go back to the networks and I'm going to select a virtual the selected virtual
networks and eyepiece and then I am going to add my own client IP here so that I am able to access
the storage account I'm not going to allow any exceptions at this stage I'm gonna turn that off
and then I think that should be good to go so we can save this configuration now and
then we wait I'll speed it up and then we're done so now we're going to go back to the container and
technically if the demo gods are with us we should be able to access the container
good okay now that we have the network component figured out and we can actually access the blob
let's have a look at some of the access policies that we can actually configure here and from Nexus
policy area like that because you can go very granular onto what can access the container and
what kind of permissions they have and then if we cancel that and we go back to the container The
Next Step we're going to look at is the encryption show if we look at the encryption component on
this main page you'll see what we spoke about earlier around the Microsoft encryption versus
customer managed encryption and the recommendation here is really to go with customer managed
encryption and then you'll see you have a bunch more options available to you here from a customer
managed encryption perspective now if it's as simple as if you are using Microsoft managed Keys
Microsoft owns the key to your data they don't have access it but they can own the key and then
customer manage Keys obviously you own the key so you Microsoft has no kind of keys to be able
to decrypt the the data then if we go to the IAM features we are good here you can assign different
role assignments to be able to access your storage account and you can basically if we just go and
have a look at it adding a role assignment we can basically search for uh storage over here a blob
and then you can see that we have different blog roles owner contributor reader Etc
next we can go and look at the access Keys really quickly I mean the access Keys is just the place
where you'll find your keys to be able to access the storage account and you can basically use
these keys to integrate with different platforms next we're going to go and look at the Shared
access tokens now this is the SAS signatures basically that you can enable you can set
this up really granularly set an expiry date and allow specific IP addresses uh to be able to get
this signature so that you know you know you're sharing it and there's multiple attributes so that
you're sharing it to the party and those party is trusted and they will then be able to push data
to your blob or depending on what permissions is available just going to go in overview the
diagnostic settings now diagnostic settings is a really important security component and I'm going
to look at the settings for the blob itself and if you go and just add diagnostic settings here
you'll be able to basically see some of the the data that you can store you have options on where
you want to store it into log analytics into an archiving storage account if you do that
you need to use a different storage account you can't use this one then we'll go back again I'm
gonna say okay and then the final component that I want to show you is the policy component so
there are a bunch of policies that you can have a look at and I'm gonna folder for
the default security Center policy here and then I'm going to search for storage account
and here basically you can look at a bunch of policies that applies to your storage account
and the configuration of your storage account specifically so for example you can disallow
public access to your blog by policy you can ensure it that customer manage keys are only
used you can make sure that you're restricting the network access there's a lot that you can do
and Azure policy is really really really powerful it's one of the most powerful security components
inside of azure and I would really recommend that you look into the different policies that
there are and what you can achieve with policy if you're looking to start learning and working on
the security side of azure and that was exactly how you can figure a storage account securely if
you enjoyed this tutorial please do let me know down in the comments below I am so excited to
make more of these tutorials so I would really like to know if you did find it helpful and of
course remember to subscribe like do all those good things and if you are looking to in the
near future pass your AZ 500 certification then you should definitely check out this
video where I take you through my experience on AZ 500 catch you next time friends bye