Cloud Storage: Containers, Access Tiers, SAS and Managed Identity in Blob Storage for Book Covers
Book covers belong in a private Blob Storage container and should reach the browser through a short-lived SAS signed with a user delegation key obtained by a managed identity, not with the account key. We cover choosing redundancy, access tiers and lifecycle policies, a cover upload endpoint that checks magic bytes, real SAS tests against Azurite in OAuth mode, the Storage Blob Delegator role and the S3 equivalents.
15 Nov 2026
·
19 min
·
11
