Azure Storage Firewall and Virtual Networks - how to prevent unauthorized access

Question

In Azure Storage there's a section called Firewalls and Virtual Networks. May I know if I can use it for the following usecase?

1. I have a video uploaded to the blob, and I need only a set of selected users who has logged in to the application view my video.

2. My WebAPI application is hosted as a Azure WebApp. Can I use the IP address where the WebApp is hosted to create a rule in the Firewalls and Virtual.network section below to only allow access to Storage if the user request the URL via the WebApp.(Let's say /viewVid/myvideo.mp4 )

3. In case if the User copies the URL of the Video (by inspecting the HTML code), and paste it on the browser will the user be able to view the video as the request is not coming via the WebApp?

Note: Overall objective is to prevent a User from copying a URL (by inspecting the HTML code) and downloading or viewing the video.

Answer 1

Firewalls and VNet NSG's will are.network level restrictions so they will not give you the user-level restrictions you are looking for. You can use them to limit your surface area but to implement what you are asking for, you need to implement authentication.

Azure Blob Storage supports Shared Key, Shared Access Signatures (SAS), Azure Active Directory (AAD), Active Directory Directory Services (ADDS) and Anonymous public access. The most secure way is to implement AAD with user delegation. If you are not able to store the users for this application in AAD then you should look at SAS. SAS token can be time-bound and restricted to certain IP addresses.

Also, you should take a look at Azure Media Player. Microsoft Azure Media Services (AMS) is an extensible cloud-based platform that enables developers to build scalable media management and delivery applications. Media Services is based on REST APIs that enable you to securely upload, store, encode, and package video or audio content for both on-demand and live streaming delivery to various clients (for example, TV, PC, and mobile devices).

Links https://learn.microsoft.com/en-us/azure/storage/common/authorize-data-access https://learn.microsoft.com/en-us/azure/storage/common/storage-sas-overview https://learn.microsoft.com/en-us/azure/media-services/previous/media-services-content-protection-overview

Answer 2

I belieave that you can use app service .net integration feature for your project to restricted.network access to storage account.