Azure Storage Accounts

There are two types of Storage Accounts which are General Purpose Storage accounts and Blob Storage Accounts.

• General purpose Storage Accounts have got two tiers

1. Standard (Supports Tables, Queues, Blobs and Azure Virtual Machine Disks)
   1. Blob Storage (Unstructured Object Data)
      1. Block Blobs (Storing documents, media files, backups etc. upto 200GB). Most Cost effective
      2. Append Blobs (logging scenarios)
      3. Page Blobs (supports up to 1TB ideas for Azure VM Disks)
   2. Table Storage (Structured Datasets)
   3. Queue Storage (reliable messaging workflow processing)
   4. File Storage (For Legacy application requires SMB protocol)
      1. Helps in moving an on-premises application into azure which relies on the share file storage
      2. Support standard file systems sematics
      3. URL format: Files are addressable using the following URL format: https://<storage account>.file.core.windows.net/<share>/<directory/directories>/<file>
2. Premium (only supports Azure Virtual Machine Disks)

Note: If you have large amount of data, you can use import or export service provided by Microsoft. Also, AzCopy will be helpful in uploading large amount of data.

• Blob Storage Accounts
  

  Blob Storage Accounts is specialized storage account for storing unstructured data as blob object. If your application requires only Block or Append Blob, then this is recommended. Hence, Blob Storage Accounts are not suitable for hosting Azure Virtual Machines

  Two tiers

  • Hot (Applications required frequent access to the objects)-Lower access cost
  • Cool (Objects are least frequently access)-Lower Storage cost

  Managing Storage
  

  You can use custom domain for access the blob data.

1. Use the CNAME record with your DNS provider [Simpler and quicker]
2. CNAME record and asverify with the option of use indirect CNAME validation. [No downtime in this method]

There are Different ways the storage account can be secured

1. RBAC and Azure Active Directory can be used to restrict access to the storage account itself
2. Azure of Data can be secured using Client-Side Encryption, HTTS and SMB 3.0
3. Storage Service Encryption will automatically encrypt when writing to Azure.
4. Azure Disk Encryption are used for OS and Data Disk
5. Share Access Signature are used to delegate access to the objects in the storage account along with Stored Access policies

Shared Access Signature, possible ways of controlling access

1. Allowed Services
2. Allowed resource types
3. Specified duration
4. Specific Protocol
5. Certain IP address
6. Type of access (read, write, update, delete, add, list, create, process)

Note: Storage account key is providing access to the entire account but SAS will help to give access in more granular manner also very limited amount of the time. Regenerating storage Keys means you need to update the SAS tokens.

Different type of Access policy in Blob Service

1. Private (Accessible to the Owner)
2. Blob (Public access to the blob)
3. Container (read and list access to the entire container)

Monitoring

Default log retention in days 7 and can be configured up to 365days

Logs are available under $logs blob Containers for all blob, queue and table.