晦涩的Azure存储帐户名

Question

Is there any merit in creating an obscure azure storage account name by using the max number of random chars/nums that is allowed when creating one from the portal?

I know that they are still going to be publicly visible and accessible with the keys but is there any benefit in this? Admin is going to be trickier from the portal having accounts with randomly generated names naturally. Is there such a malicious practice of "scanning" storage account names to find ones that exist to potential abuse or is there mechanisms to prevent that? I am aware that obfuscation does not equal security and only means to delay and not prevent but I can't see any other way to secure a storage account to a specific IP address/range presently.

Is this something you would/wouldn't recommend to do in practice? Am I just being overly cautious and in fact the access keys on their own are indeed a good level of security.

Answer 1

I am no security expert, but IMHO, you are being over cautious... with the name, that is..

Having said that, it is always a good security policy to rotate the access keys at a given frequency. The very reason why these services support primary and secondary access keys is to enable the scenario for key rotation ... and think of it as similar to systems enforcing a user to change their password every X days.

The frequency could be anything you prefer, or your in house security experts suggests as acceptable.

Although initially needs effort investment, automating the key rotation process is obviously best.