WEBVTT
Kind: captions
Language: en

1
00:00:00.000 --> 00:00:07.035
So far, we've built a VM for our web app and connected it to a virtual network. Now,

2
00:00:07.035 --> 00:00:15.410
the users' uploaded photos need a home. In this final lesson, we'll store them in Azure Blob Storage

3
00:00:15.410 --> 00:00:20.100
and see how the app uploads and retrieves them securely.

4
00:00:20.500 --> 00:00:27.260
The app could save photos on its own disks, but then the files are tied to that one VM,

5
00:00:27.260 --> 00:00:34.875
and they're harder to share, scale and back up. Blob Storage is Microsoft's object storage service

6
00:00:34.875 --> 00:00:42.645
for the cloud. It's optimized for storing massive amounts of unstructured data, which apps can reach

7
00:00:42.645 --> 00:00:43.500
over HTTPS.

8
00:00:43.900 --> 00:00:51.339
Unstructured data is data that doesn't follow a particular data model, the way rows in a database

9
00:00:51.339 --> 00:00:58.856
table do. Think documents, images, video and audio, log files and backups. That's exactly the kind

10
00:00:58.856 --> 00:01:02.000
of data Blob Storage is designed to hold.

11
00:01:02.400 --> 00:01:08.840
Blob Storage is organized in three levels. At the top is the storage account. It gives your data

12
00:01:08.840 --> 00:01:16.018
a unique namespace in Azure. The account name must be unique across Azure, three to twenty-four characters,

13
00:01:16.018 --> 00:01:23.800
lowercase letters and numbers only, and it becomes part of every address, like stphotosdemo01.blob.core.windows.net.

14
00:01:24.200 --> 00:01:31.700
Inside the account, you create containers. A container organizes a set of blobs, similar to a folder

15
00:01:31.700 --> 00:01:39.050
in a file system. Our example has two: uploads, for user photos, and backups, for the app's backup

16
00:01:39.050 --> 00:01:45.200
files. Container names are lowercase too, because they become part of the address.

17
00:01:45.600 --> 00:01:51.091
Inside containers are blobs: the files themselves. Each blob has its own address,

18
00:01:51.091 --> 00:01:58.006
built from the account endpoint, the container name and the blob name. Blob names can include slashes,

19
00:01:58.006 --> 00:02:03.700
like 2026/10/team.png, to create a folder-like structure called a virtual directory.

20
00:02:04.100 --> 00:02:12.980
Now, an upload. A user sends a photo to the web app, and the app uploads it to the uploads container

21
00:02:12.980 --> 00:02:20.262
over HTTPS, where it's stored as a new blob. In Azure terms, this is a block blob,

22
00:02:20.262 --> 00:02:26.300
the blob type for text and binary data such as images and documents.

23
00:02:26.700 --> 00:02:34.388
Later, someone wants to see the photo. The app requests the blob by its address, receives the data,

24
00:02:34.388 --> 00:02:41.376
and returns the image to the user's browser. Upload and retrieve: that's the core pattern.

25
00:02:41.376 --> 00:02:47.200
But we skipped an important question. Why was the app allowed to do either?

26
00:02:47.600 --> 00:02:55.100
Every request to Blob Storage must be authorized, unless anonymous read access has been deliberately

27
00:02:55.100 --> 00:03:01.700
turned on, and by default it isn't allowed. A good fit for our VM is a managed identity:

28
00:03:01.700 --> 00:03:09.650
an identity in Microsoft Entra ID for the VM, granted an Azure role such as Storage Blob Data Contributor.

29
00:03:09.650 --> 00:03:13.100
A request without valid credentials is denied.

30
00:03:13.500 --> 00:03:20.703
Authorization isn't the only gate. The storage account's network settings must also let the request

31
00:03:20.703 --> 00:03:27.905
in. You can limit access to selected networks, or use a private endpoint, so the VM reaches storage

32
00:03:27.905 --> 00:03:34.308
through its virtual network. So the VM can use Blob Storage only when both are in place:

33
00:03:34.308 --> 00:03:37.800
network connectivity, and the right permissions.

34
00:03:38.200 --> 00:03:45.400
Let's put it all together. The web app runs on an Azure virtual machine. The VM connects through

35
00:03:45.400 --> 00:03:52.150
a network interface to a subnet in a virtual network, where security rules filter traffic.

36
00:03:52.150 --> 00:03:59.875
And the photos are stored as blobs, in containers, in a storage account, reached with the right network

37
00:03:59.875 --> 00:04:01.600
access and permissions.