A partner app needs read access to one blob container for 8 hours, revocable instantly without rotating account keys. What is the best approach?
A.Share the account access key with an 8-hour expiry note
Account keys grant full account access — massive over-privilege, and 'revoking' means rotating keys for everyone.
B.Service SAS tied to a stored access policy
Stored access policy = instant revocation. Correct.
C.Account SAS on the whole storage account
Account SAS covers all services/containers — wider than needed.
D.Anonymous read access on the container
Anonymous is public — no scoping, no expiry control, no revocation.
Why this answer
A service SAS scoped to the container + a stored access policy is the only option that's both narrowly scoped AND instantly revocable — delete/modify the policy and the SAS dies. Account keys are too broad and require rotation; account SAS is too broad; anonymous access can't expire or be scoped per-partner.
Correct answer: B · Last reviewed 2026-02-14
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Storage Implementation practice session.
Practice Storage Implementation