Rotating Blob Storage Keys for Azure Synapse Analytics
Question
Martin is a Cloud Security Engineer of Whizlabs Inc.
As the best practice, he implemented the option to change the access key of the Blob storage regularly.
Consequently, the storage keys of Blob storage (Polybase) are also required to rotate, which is the underlying storage of the dedicated SQL pool of Azure Synapse analytics.
For each storage account, whose key is required to change, he issued the following ALTER DATABASE SCOPED CREDENTIAL t-sql command for rotating key from key1 to key2
ALTER DATABASE SCOPED CREDENTIAL credential_name WITH IDENTITY = ‘identity_name', SECRET ='key2' Does the step match the requirement for this scenario?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B.Correct Answer: A.
Option A is correct because the following command is required to execute for rotating storage account keys from Key1 to Key2.
ALTER DATABASE SCOPED CREDENTIAL credential_name WITH IDENTITY = ‘identity_name', SECRET ='key2'
The given ALTER DATABASE SCOPED CREDENTIAL T-SQL command is used to update the credential for a specific database scoped credential name with a new identity and secret. It is used to manage the credentials for Azure Synapse Analytics dedicated SQL pools.
In the scenario described, Martin is implementing the best practice of rotating access keys of the Blob storage regularly. As the Blob storage is used as the underlying storage of Azure Synapse Analytics dedicated SQL pools, it is necessary to rotate the storage keys of Blob storage as well. This is because the storage keys are used to access data in Blob storage, and rotating them regularly helps to mitigate the risk of unauthorized access to the data.
To rotate the storage keys, Martin is issuing the ALTER DATABASE SCOPED CREDENTIAL T-SQL command with the new key, key2, for the specific database scoped credential name. This command will update the credential with the new identity and secret, and will effectively change the key used to access the Blob storage.
Therefore, the given step does match the requirement for this scenario, and the correct answer is A. Yes.
