Azure BLOB Shared Access Signature at the BLOB level, not container

Question

I've done a ton of searching and looking at examples but cannot find what I think is possible. I want to give read access on a blob-by-blob basis, and NOT open the entire container to be readable. All the examples I found show how to create a full authenticated URL for a blob, which I got working. What I'm finding is that I can take that SAS key and append that to any other blobs in the same container and they will be readable.

Can I create a SAS key that is only valid for a single BLOB? If so, an example/link would be appreciated!

Answer 1

You can certainly set shared access signature at Blob level. If you're using .Net Storage Client library, do take a look at GetSharedAccessSignature function on a blob. I wrote a blog post on Shared Access Signature some time back where you will find some code for creating SAS for blob: http://gauravmantri.com/2013/02/13/revisiting-windows-azure-shared-access-signature/.