Azure Storage Account

Overview

The EQTY Governance Platform requires Azure Blob Storage for storing platform data.

Required containers:

Governance artifacts container - Stores governance-related documents and artifacts
Integrity store container - Stores cryptographic proofs and audit trails

This guide covers:

Creating a storage account and containers (Azure CLI or Portal)
Retrieving access credentials
Configuring the Helm chart for Azure Blob Storage

Prerequisites

Azure subscription with permissions to create storage accounts
Azure CLI installed and configured (for CLI method)
Resource group created (or permission to create one)

Helm Configuration

Add the following to the values.yaml and secrets.yaml files. Placeholders will be filled in throughout the steps below.

values.yaml:


    
     
      governance-service
      :
     
    
    
     
       
      config
      :
     
    
    
     
       
      storageProvider
      : 
      azure_blob
     
    
    
     
       
      azureStorageAccountName
      : 
      "
      
       
      "
       
      # Filled in after step 2
     
    
    
     
       
      azureStorageContainerName
      : 
      "
      governance-artifacts
      "
     
    
    
      
     
    
    
     
      integrity-service
      :
     
    
    
     
       
      config
      :
     
    
    
     
       
      integrityAppBlobStoreType
      : 
      azure_blob
     
    
    
     
       
      integrityAppBlobStoreAccount
      : 
      "
      
       
      "
       
      # Filled in after step 2
     
    
    
     
       
      integrityAppBlobStoreContainer
      : 
      "
      integrity-store
      "

secrets.yaml:


    
     
      global
      :
     
    
    
     
       
      secrets
      :
     
    
    
     
       
      create
      : 
      true
     
    
    
     
       
      storage
      :
     
    
    
     
       
      azure_blob
      :
     
    
    
     
       
      secretName
      : 
      platform-azure-blob
     
    
    
     
       
      values
      :
     
    
    
     
       
      accountKey
      : 
      "
      
       
      "
       
      # Filled in after step 2
     
    
    
     
       
      connectionString
      : 
      "
      
       
      "
       
      # Filled in after step 2

Quick Start (CLI Method - Recommended)

Set the following variables — they will be used throughout this guide:


    
     
      RESOURCE_GROUP
      =
      "
      governance-rg
      "
     
    
    
     
      STORAGE_ACCOUNT
      =
      "
      governancestorage
      "
       
      # Must be globally unique, lowercase, 3-24 chars
     
    
    
     
      LOCATION
      =
      "
      eastus
      "

Update values.yaml with the chosen storage account name.

values.yaml -> governance-service.config:


    
     
      azureStorageAccountName
      : 
      "
      
       
      "

values.yaml -> integrity-service.config:


    
     
      integrityAppBlobStoreAccount
      : 
      "
      
       
      "

1. Create Resource Group (if needed)


    
     
      az
       
      group
       
      create
       
      \
     
    
    
     
       
      --name
       
      $RESOURCE_GROUP
       
      \
     
    
    
     
       
      --location
       
      $LOCATION

2. Create Storage Account


    
     
      az
       
      storage
       
      account
       
      create
       
      \
     
    
    
     
       
      --name
       
      $STORAGE_ACCOUNT
       
      \
     
    
    
     
       
      --resource-group
       
      $RESOURCE_GROUP
       
      \
     
    
    
     
       
      --location
       
      $LOCATION
       
      \
     
    
    
     
       
      --sku
       
      Standard_LRS
       
      \
     
    
    
     
       
      --kind
       
      StorageV2
       
      \
     
    
    
     
       
      --access-tier
       
      Hot
       
      \
     
    
    
     
       
      --https-only
       
      true
       
      \
     
    
    
     
       
      --min-tls-version
       
      TLS1_2

Retrieve the storage account key:


    
     
      az
       
      storage
       
      account
       
      keys
       
      list
       
      \
     
    
    
     
       
      --resource-group
       
      $RESOURCE_GROUP
       
      \
     
    
    
     
       
      --account-name
       
      $STORAGE_ACCOUNT
       
      \
     
    
    
     
       
      --query
       
      '
      [0].value
      '
       
      \
     
    
    
     
       
      --output
       
      tsv

Store the key in a variable (paste the value from the output above):


    
     
      ACCOUNT_KEY
      =
      "
      
       
      "

Update secrets.yaml with the account key.

secrets.yaml -> global.secrets.storage.azure_blob.values:

Retrieve the connection string:


    
     
      az
       
      storage
       
      account
       
      show-connection-string
       
      \
     
    
    
     
       
      --resource-group
       
      $RESOURCE_GROUP
       
      \
     
    
    
     
       
      --name
       
      $STORAGE_ACCOUNT
       
      \
     
    
    
     
       
      --query
       
      '
      connectionString
      '
       
      \
     
    
    
     
       
      --output
       
      tsv

Update secrets.yaml with the connection string.

secrets.yaml -> global.secrets.storage.azure_blob.values:


    
     
      connectionString
      : 
      "
      
       
      "

3. Create Blob Containers

Create the governance artifacts container:


    
     
      az
       
      storage
       
      container
       
      create
       
      \
     
    
    
     
       
      --name
       
      governance-artifacts
       
      \
     
    
    
     
       
      --account-name
       
      $STORAGE_ACCOUNT
       
      \
     
    
    
     
       
      --account-key
       
      $ACCOUNT_KEY
       
      \
     
    
    
     
       
      --public-access
       
      off

Create the integrity store container:


    
     
      az
       
      storage
       
      container
       
      create
       
      \
     
    
    
     
       
      --name
       
      integrity-store
       
      \
     
    
    
     
       
      --account-name
       
      $STORAGE_ACCOUNT
       
      \
     
    
    
     
       
      --account-key
       
      $ACCOUNT_KEY
       
      \
     
    
    
     
       
      --public-access
       
      off

Verify both containers were created:


    
     
      az
       
      storage
       
      container
       
      list
       
      \
     
    
    
     
       
      --account-name
       
      $STORAGE_ACCOUNT
       
      \
     
    
    
     
       
      --account-key
       
      $ACCOUNT_KEY
       
      \
     
    
    
     
       
      --output
       
      table

Alternative: Web UI Setup

Click to expand Azure Portal instructions

Using the Azure Portal

1. Create Storage Account

Navigate to Azure Portal
Create a storage account
Note the storage account name

Update values.yaml with the storage account name.

values.yaml -> governance-service.config:


     
      
       azureStorageAccountName
       : 
       "
       
        
       "

values.yaml -> integrity-service.config:


     
      
       integrityAppBlobStoreAccount
       : 
       "
       
        
       "

2. Create Containers

In the storage account, navigate to “Containers”
Create two containers: one for governance artifacts and another for the integrity store
Set public access level to “Private (no anonymous access)“

3. Get Access Credentials

Navigate to Security + networking > Access keys
Copy the storage account key and connection string
Update secrets.yaml with the credentials.

secrets.yaml -> global.secrets.storage.azure_blob.values:


     
      
       accountKey
       : 
       "
       
        
       "
      
     
     
      
       connectionString
       : 
       "
       
        
       "

Verification

Test access to the containers.

List blobs in the governance artifacts container (should be empty initially):


    
     
      az
       
      storage
       
      blob
       
      list
       
      \
     
    
    
     
       
      --container-name
       
      governance-artifacts
       
      \
     
    
    
     
       
      --account-name
       
      $STORAGE_ACCOUNT
       
      \
     
    
    
     
       
      --account-key
       
      $ACCOUNT_KEY
       
      \
     
    
    
     
       
      --output
       
      table

List blobs in the integrity store container:


    
     
      az
       
      storage
       
      blob
       
      list
       
      \
     
    
    
     
       
      --container-name
       
      integrity-store
       
      \
     
    
    
     
       
      --account-name
       
      $STORAGE_ACCOUNT
       
      \
     
    
    
     
       
      --account-key
       
      $ACCOUNT_KEY
       
      \
     
    
    
     
       
      --output
       
      table

If the commands succeed without errors, the configuration is correct.

Security Best Practices

HTTPS Only: The storage account is configured with --https-only true — do not disable this setting
Rotate Keys: Regularly rotate storage account keys and update Kubernetes secrets
Least Privilege: Account keys grant full storage access — scope access to specific containers where possible
Enable Versioning: Enable blob versioning to protect against accidental deletion
Audit Logging: Enable Azure Monitor storage diagnostics for access monitoring

Azure Storage Account

Overview

Prerequisites

Helm Configuration

Quick Start (CLI Method - Recommended)

1. Create Resource Group (if needed)

2. Create Storage Account

3. Create Blob Containers

Alternative: Web UI Setup

Using the Azure Portal

1. Create Storage Account

2. Create Containers

3. Get Access Credentials

Verification

Security Best Practices

Official Documentation