Azure storage accessible by Azure CDN only

Question

Hello All,

Could you please help me to find the solution for Accessing Storage from Azure CDN only.

While making CDN configuration, we provide endpoint host.

As storage is public which can be access directly which prune to DDoS attack, so we need access storage from CDN only, so that in CDN we can configure all security configuration.

Thanks

Satyajit

Answer 1

Azure Storage does not yet natively support HTTPS with custom domains. With Azure CDN, you can access blobs by using your custom domain name over HTTPS. To do so, enable Azure CDN on your blob or web endpoint and then map Azure CDN to a custom domain name. After you're done, Azure simplifies enabling HTTPS for your custom domain via one-click access and complete certificate management.

To enable HTTPS for your custom Blob storage endpoint, do the following:

1. Integrate an Azure storage account with Azure CDN.
2. Map Azure CDN content to a custom domain.
3. Enable HTTPS on an Azure CDN custom domain.

FYR:Azure CDN to access blobs

If you think your question has been answered, click "Mark as Answer" if just helped click "Vote as helpful". This can be beneficial to other community members reading this forum thread.

---

Best regards
Subhash

Answer 2

Hello,

 

Just checking in to see if the above answer helped in solving your problem. Kindly let us know if you have any further questions on this specific topic, we would be more than happy to assist you & please do mark the post which was helpful by clicking on Mark as Answer & Up-Vote to help the community find the right answers.

 

Regards,

Subhash

Answer 3

Is there any update on the issue?

If the suggested answer helped for your issue, do click on "Mark as Answer" and “Vote as Helpful” on the post that helps you, this can be beneficial to other community members.

Answer 4

If you want to restrict blob storage access through blob.core.windows.net url and the content to be accessible only through CDN then you can setup SAS authentication for the container. When a user requests the CDN url with the SAS key, the CDN will request the asset from blob using the SAS url if it is not already cached.

If you wish to keep the SAS token hidden from the end customer completely, you can use a Verizon Premium profile and use a URL rewrite rule to add the SAS token from the CDN side.

Here is a similar thread from SO for your reference.

If you think your question has been answered, click "Mark as Answer" if just helped click "Vote as helpful". This can be beneficial to other community members reading this forum thread.

---

Best regards
Subhash

Answer 5

Hello Satyajit, 

Solution that worked for me is to use SAS authentication for the container. That will resolve first part of the question, and that is to make content not accessible from the storage URL. 

Second part is making CDN work with SAS key in URL. You don't want to have SAS hard-coded and visible, and for that you can use Verizon Premium CDN and use URL rewrite rule to include the key.

Those two articles helped me to write working re-write rule (my solution is very specific, therefore I won't share my url rewrite rule since that will not be replicable to other scenarios).

Unfortunately i can't include the links in the answer but im sure you can find them by names:

StackAzure CDN with Verizon - Rewriting URL to always load index.html"
MSDN forums: "Verizon CDN Premium / SAS Blob Storage Rewrite"

I hope this helps.

Answer 6

Thank You Subhash, I will try this way.

Could we do OAI(origin access identity) in cdn/blob storage, so that blob will accessible through cdn only?

Thanks

Answer 7

Thanks, I will try this way.

Could we do OAI(origin access identity) in cdn/blob storage, so that blob will accessible through cdn only?

Thanks

Answer 8

As far as i know a blob can be accessed though SAS token or you can add a specific user in to the list of managed identity users in-order to access the blob and even in this case the primary key to access is blob is SAS.

If you think your question has been answered, click "Mark as Answer" if just helped click "Vote as helpful". This can be beneficial to other community members reading this forum thread.

---

Best regards
Subhash

Answer 9

Sorry. I was not online.

Thanks for answer.

Does taking advance security will help storage from external threats like DDoS attack , xss etc? If OAI is not available.

Regards

Satyajit