Overview

When connecting your Azure Blob Storage containers to Cloney for data migration, it's essential to follow the principle of least privilege. This guide walks you through creating access credentials with only the permissions necessary for Cloney to read from or write to your storage containers.

Security Best Practice

Use SAS tokens with limited permissions and expiration dates. Avoid using full access keys when possible.

Prerequisites

  • An Azure account with Owner or Contributor access to the storage account
  • An Azure Storage Account with Blob containers
  • The name of the container(s) you want to connect
  • Knowledge of whether you need read-only (source) or write (destination) access

Option 1: Using Access Keys (Simple)

The simplest method is using storage account access keys:

  1. Sign in to the Azure Portal
  2. Navigate to your Storage Account
  3. In the left menu, under Security + networking, click Access keys
  4. Click Show next to key1 or key2
  5. Copy the Storage account name and Key
Security Note

Access keys provide full access to the entire storage account. For better security, use SAS tokens (Option 2) with limited permissions.

Option 2: Using SAS Tokens (Recommended)

Shared Access Signatures (SAS) provide granular, time-limited access:

  1. In the Azure Portal, navigate to your Storage Account
  2. Go to Containers and select your target container
  3. Click Shared access tokens in the left menu
  4. Configure the SAS token settings (see below for recommended permissions)
  5. Set an appropriate Expiry date
  6. Click Generate SAS token and URL
  7. Copy the Blob SAS token

SAS Token Permissions for Source (Read)

For source containers (reading data), enable these permissions:

PermissionRequiredPurpose
ReadYesRead blob content
ListYesList blobs in container
WriteNoNot needed for source
DeleteNoNot needed for source
CreateNoNot needed for source

SAS Token Permissions for Destination (Write)

For destination containers (writing data), enable these permissions:

PermissionRequiredPurpose
ReadYesVerify uploaded data
ListYesList existing blobs
WriteYesUpload blob content
DeleteOptionalRequired for overwrite operations
CreateYesCreate new blobs

Option 3: Using Azure RBAC (Enterprise)

For enterprise scenarios, use Azure RBAC with a service principal:

  1. Create an Azure AD application registration
  2. Create a service principal for the application
  3. Assign the appropriate role to the service principal:
    • Source: Storage Blob Data Reader
    • Destination: Storage Blob Data Contributor
  4. Generate a client secret for the service principal
Azure CLI - Assign Role
# For source (read-only)
az role assignment create \
  --assignee <service-principal-id> \
  --role "Storage Blob Data Reader" \
  --scope /subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<account>/blobServices/default/containers/<container>

# For destination (write)
az role assignment create \
  --assignee <service-principal-id> \
  --role "Storage Blob Data Contributor" \
  --scope /subscriptions/<sub-id>/resourceGroups/<rg>/providers/Microsoft.Storage/storageAccounts/<account>/blobServices/default/containers/<container>

Using Credentials in Cloney

When configuring Azure in Cloney, you'll need:

  • Storage Account Name: Your Azure storage account name
  • Access Key or SAS Token: Either the full access key or a SAS token
  • Container Name: The name of your blob container
Ready to Connect

You can now use these credentials in Cloney to connect your Azure Blob Storage container securely.