highFoundationSymptom-first#blob#storage#sas#authentication#403

Blob storage 403 Forbidden — Shared Key or SAS token expired

HTTP 403 Forbidden when accessing a blob URL

Likely source:connectivitysecurity

Focused incident mode — strips away everything but this runbook.

Symptoms

  • HTTP 403 Forbidden when accessing a blob URL
  • az storage blob list returns AuthorizationFailure or AuthenticationFailed
  • SAS token in the URL has expired and returns Server failed to authenticate

Evidence to grab

Collect these artifacts before you change anything — they prove (or rule out) each cause.

  • Storage account key status

    az storage account keys list --account-name <STORAGE-ACCOUNT> --query "[0].value" -o tsv

  • SAS token expiry

    Decode the Base64 SAS token and check the se (expiry) field

Diagnostic flow

Run the steps in order, marking each claim confirmed or refuted. The evidence you gather feeds the ranked causes below.

Guided decision tree is ready.

Steps with commands, expected output, and pass/fail branches.

Ranked root causes

Evidence checklist

  • HTTP 403 with Server failed to authenticate the request
  • SAS token se= field is in the past

Confirm before fixing

echo '<SAS-TOKEN>' | grep -oP 'se=[^&]+' | head -1
READ

Extract the expiry from the SAS token

Fix

az storage blob generate-sas --account-name <STORAGE-ACCOUNT> --account-key <KEY> --container-name <CONTAINER> --blob-name <BLOB> --permissions r --expiry <YYYY-MM-DD> -o tsv
CHANGE

Generate a fresh SAS token

Expected: A new SAS token string

Resolution runbook

Apply from top to bottom after the cause is confirmed. Review every command before running it — risk tags are shown on each.

1
az storage blob list --account-name <STORAGE-ACCOUNT> --account-key <KEY> --container-name <CONTAINER> --query "[].name" -o tsv | head -3
READ

Test Shared Key access

2
az storage account keys list --account-name <STORAGE-ACCOUNT> --query "[0].value" -o tsv
READ

Get the current primary key

3
az storage blob generate-sas --account-name <STORAGE-ACCOUNT> --account-key <KEY> --container-name <CONTAINER> --blob-name <BLOB> --permissions r --expiry <YYYY-MM-DD> -o tsv
CHANGE

Generate a fresh SAS token

Prevention

  • Rotate storage account keys on a 90-day cycle and update all clients.
  • Use Azure AD RBAC (Storage Blob Data Reader/Contributor) instead of Shared Keys.
  • Set SAS token expiry to a short window and use User Delegation SAS for short-lived access.
  • Enable Storage Insights to monitor key usage and rotation.

Commands marked READ CHANGE DESTRUCTIVE — never run DESTRUCTIVE commands against production data you cannot restore. Copy → verify → execute.