Generate Azure Blob Storage configurations with lifecycle management, access tiers, security policies, and data lake integration. Use when the user wants to set up or configure Azure storage accounts and blob containers.
You are an Azure Blob Storage expert. Generate production-ready storage account and blob container configurations.
Determine from user input or $ARGUMENTS:
| Account Type | Use Case | Performance |
|---|---|---|
| General-purpose v2 | Most scenarios (recommended default) | Standard or Premium |
| Premium block blobs | Low-latency, high transaction rates | Premium SSD |
| Premium page blobs | Unmanaged VM disks | Premium SSD |
| Premium file shares | Enterprise file shares | Premium SSD |
Redundancy options:
Bicep:
param location string = resourceGroup().location
param storageAccountName string
resource storageAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
name: storageAccountName
location: location
sku: {
name: 'Standard_ZRS'
}
kind: 'StorageV2'
properties: {
accessTier: 'Hot'
minimumTlsVersion: 'TLS1_2'
supportsHttpsTrafficOnly: true
allowBlobPublicAccess: false
allowSharedKeyAccess: false
networkAcls: {
defaultAction: 'Deny'
bypass: 'AzureServices'
virtualNetworkRules: []
ipRules: []
}
encryption: {
services: {
blob: {
enabled: true
keyType: 'Account'
}
}
keySource: 'Microsoft.Storage'
}
}
}
resource blobServices 'Microsoft.Storage/storageAccounts/blobServices@2023-01-01' = {
parent: storageAccount
name: 'default'
properties: {
deleteRetentionPolicy: {
enabled: true
days: 30
}
containerDeleteRetentionPolicy: {
enabled: true
days: 30
}
isVersioningEnabled: true
changeFeed: {
enabled: true
retentionInDays: 90
}
}
}
Terraform:
resource "azurerm_storage_account" "main" {
name = var.storage_account_name
resource_group_name = azurerm_resource_group.main.name
location = azurerm_resource_group.main.location
account_tier = "Standard"
account_replication_type = "ZRS"
account_kind = "StorageV2"
access_tier = "Hot"
min_tls_version = "TLS1_2"
allow_nested_items_to_be_public = false
shared_access_key_enabled = false
network_rules {
default_action = "Deny"
bypass = ["AzureServices"]
}
blob_properties {
versioning_enabled = true
change_feed_enabled = true
change_feed_retention_in_days = 90
delete_retention_policy {
days = 30
}
container_delete_retention_policy {
days = 30
}
}
tags = var.tags
}
Access tiers (per-blob or default):
Lifecycle management policy (Bicep):
resource lifecyclePolicy 'Microsoft.Storage/storageAccounts/managementPolicies@2023-01-01' = {
parent: storageAccount
name: 'default'
properties: {
policy: {
rules: [
{
name: 'tierToCool'
type: 'Lifecycle'
definition: {
actions: {
baseBlob: {
tierToCool: {
daysAfterModificationGreaterThan: 30
}
tierToCold: {
daysAfterModificationGreaterThan: 90
}
tierToArchive: {
daysAfterModificationGreaterThan: 180
}
delete: {
daysAfterModificationGreaterThan: 365
}
}
snapshot: {
delete: {
daysAfterCreationGreaterThan: 90
}
}
version: {
delete: {
daysAfterCreationGreaterThan: 90
}
}
}
filters: {
blobTypes: ['blockBlob']
prefixMatch: ['logs/', 'backups/']
}
}
}
]
}
}
}
Lifecycle management policy (Terraform):
resource "azurerm_storage_management_policy" "main" {
storage_account_id = azurerm_storage_account.main.id
rule {
name = "tier-and-expire"
enabled = true
filters {
prefix_match = ["logs/", "backups/"]
blob_types = ["blockBlob"]
}
actions {
base_blob {
tier_to_cool_after_days_since_modification_greater_than = 30
tier_to_cold_after_days_since_modification_greater_than = 90
tier_to_archive_after_days_since_modification_greater_than = 180
delete_after_days_since_modification_greater_than = 365
}
snapshot {
delete_after_days_since_creation_greater_than = 90
}
version {
delete_after_days_since_creation = 90
}
}
}
}
For compliance (SEC 17a-4, CFTC, FINRA):
resource container 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-01-01' = {
parent: blobServices
name: 'compliance-data'
properties: {
immutableStorageWithVersioning: {
enabled: true
}
}
}
Enable hierarchical namespace for data lake workloads:
resource dataLakeAccount 'Microsoft.Storage/storageAccounts@2023-01-01' = {
name: storageAccountName
location: location
sku: { name: 'Standard_ZRS' }
kind: 'StorageV2'
properties: {
isHnsEnabled: true
accessTier: 'Hot'
minimumTlsVersion: 'TLS1_2'
supportsHttpsTrafficOnly: true
allowBlobPublicAccess: false
}
}
Stored access policy (reusable, revocable):
az storage container policy create \
--account-name $STORAGE_ACCOUNT \
--container-name mycontainer \
--name read-policy \
--permissions rl \
--start $(date -u +%Y-%m-%dT%H:%MZ) \
--expiry $(date -u -d "+1 year" +%Y-%m-%dT%H:%MZ)
SAS token types:
Generate user delegation SAS:
az storage blob generate-sas \
--account-name $STORAGE_ACCOUNT \
--container-name mycontainer \
--name myblob.txt \
--permissions r \
--expiry $(date -u -d "+1 hour" +%Y-%m-%dT%H:%MZ) \
--as-user \
--auth-mode login
az storage blob service-properties update \
--account-name $STORAGE_ACCOUNT \
--static-website \
--index-document index.html \
--404-document 404.html
CDN integration:
$web containerCORS configuration:
az storage cors add \
--account-name $STORAGE_ACCOUNT \
--services b \
--methods GET HEAD OPTIONS \
--origins "https://example.com" \
--allowed-headers "*" \
--exposed-headers "*" \
--max-age 3600
resource privateEndpoint 'Microsoft.Network/privateEndpoints@2023-04-01' = {
name: '${storageAccountName}-pe'
location: location
properties: {
subnet: {
id: subnetId
}
privateLinkServiceConnections: [
{
name: '${storageAccountName}-plsc'
properties: {
privateLinkServiceId: storageAccount.id
groupIds: ['blob']
}
}
]
}
}
resource storageAccountCmk 'Microsoft.Storage/storageAccounts@2023-01-01' = {
name: storageAccountName
location: location
identity: {
type: 'UserAssigned'
userAssignedIdentities: {
'${managedIdentityId}': {}
}
}
properties: {
encryption: {
keySource: 'Microsoft.Keyvault'
keyvaultproperties: {
keyname: keyName
keyvaulturi: keyVaultUri
keyversion: ''
}
identity: {
userAssignedIdentity: managedIdentityId
}
}
}
}
# Upload directory to blob container
azcopy copy "/local/path/*" "https://${ACCOUNT}.blob.core.windows.net/container/?${SAS}" --recursive
# Sync local to blob (only changed files)
azcopy sync "/local/path" "https://${ACCOUNT}.blob.core.windows.net/container/?${SAS}" --recursive
# Copy between storage accounts
azcopy copy "https://source.blob.core.windows.net/container/?${SAS}" \
"https://dest.blob.core.windows.net/container/?${SAS}" --recursive
# Archive tier bulk move
azcopy copy "https://${ACCOUNT}.blob.core.windows.net/container/archive/*?${SAS}" \
"https://${ACCOUNT}.blob.core.windows.net/container/archive/*?${SAS}" \
--block-blob-tier Archive --recursive
allowSharedKeyAccess: false when possible