3.1. Implement Security for Storage Accounts

💡 First Principle: A storage account is reachable through two independent paths — the network path (can a request even arrive) and the identity path (does the caller have permission to act once it arrives) — and locking down only one of them leaves the account exposed through the other.

Storage misconfigurations are a recurring real-world breach pattern precisely because it's easy to fix the path you're thinking about while leaving the other wide open — a firewall-restricted account still exposed by an overly permissive SAS token, or an account with tight access policies still reachable because the firewall allows "all networks."

Mental model: treat storage security as a checklist with two independent halves that both need a "yes": is the network path closed to everyone except intended callers, and is every credential capable of reaching the account (keys, SAS tokens, RBAC roles) scoped as narrowly as the task requires?

⚠️ Common Misconception: Storage account firewall rules alone do not fully secure an account. Network restrictions control where requests can come from, but they don't replace identity-based access control — an account can still be over-permissioned through shared key access or an overly broad SAS token even when its network path is locked down tight.