Azure Storage Account

Overview

The EQTY Governance Platform requires Azure Blob Storage for storing platform data.

Required containers:

Governance artifacts container - Stores governance-related documents and artifacts
Integrity store container - Stores cryptographic proofs and audit trails

This guide covers:

Creating a storage account and containers (Azure CLI or Portal)
Retrieving access credentials
Configuring the Helm chart for Azure Blob Storage

Prerequisites

Azure subscription with permissions to create storage accounts
Azure CLI installed and configured (for CLI method)
Resource group created (or permission to create one)

Helm Configuration

Add the following to the values.yaml and secrets.yaml files. Placeholders will be filled in throughout the steps below.

values.yaml:

governance-service:
  config:
    storageProvider: azure_blob
    azureStorageAccountName: "<storage-account-name>" # Filled in after step 2
    azureStorageContainerName: "governance-artifacts"

integrity-service:
  config:
    integrityAppBlobStoreType: azure_blob
    integrityAppBlobStoreAccount: "<storage-account-name>" # Filled in after step 2
    integrityAppBlobStoreContainer: "integrity-store"

secrets.yaml:

global:
  secrets:
    create: true
    storage:
      azure_blob:
        secretName: platform-azure-blob
        values:
          accountKey: "<account-key>" # Filled in after step 2
          connectionString: "<connection-string>" # Filled in after step 2

Quick Start (CLI Method - Recommended)

Set the following variables — they will be used throughout this guide:

RESOURCE_GROUP="governance-rg"
STORAGE_ACCOUNT="governancestorage"  # Must be globally unique, lowercase, 3-24 chars
LOCATION="eastus"

Update values.yaml with the chosen storage account name.

values.yaml -> governance-service.config:

azureStorageAccountName: "<storage-account-name>"

values.yaml -> integrity-service.config:

integrityAppBlobStoreAccount: "<storage-account-name>"

1. Create Resource Group (if needed)

az group create \
  --name $RESOURCE_GROUP \
  --location $LOCATION

2. Create Storage Account

az storage account create \
  --name $STORAGE_ACCOUNT \
  --resource-group $RESOURCE_GROUP \
  --location $LOCATION \
  --sku Standard_LRS \
  --kind StorageV2 \
  --access-tier Hot \
  --https-only true \
  --min-tls-version TLS1_2

Retrieve the storage account key:

az storage account keys list \
  --resource-group $RESOURCE_GROUP \
  --account-name $STORAGE_ACCOUNT \
  --query '[0].value' \
  --output tsv

Store the key in a variable (paste the value from the output above):

ACCOUNT_KEY="<account-key>"

Update secrets.yaml with the account key.

secrets.yaml -> global.secrets.storage.azure_blob.values:

accountKey: "<account-key>"

Retrieve the connection string:

az storage account show-connection-string \
  --resource-group $RESOURCE_GROUP \
  --name $STORAGE_ACCOUNT \
  --query 'connectionString' \
  --output tsv

Update secrets.yaml with the connection string.

secrets.yaml -> global.secrets.storage.azure_blob.values:

connectionString: "<connection-string>"

3. Create Blob Containers

Create the governance artifacts container:

az storage container create \
  --name governance-artifacts \
  --account-name $STORAGE_ACCOUNT \
  --account-key $ACCOUNT_KEY \
  --public-access off

Create the integrity store container:

az storage container create \
  --name integrity-store \
  --account-name $STORAGE_ACCOUNT \
  --account-key $ACCOUNT_KEY \
  --public-access off

Verify both containers were created:

az storage container list \
  --account-name $STORAGE_ACCOUNT \
  --account-key $ACCOUNT_KEY \
  --output table

Alternative: Web UI Setup

Click to expand Azure Portal instructions

Using the Azure Portal

1. Create Storage Account

Navigate to Azure Portal
Create a storage account
Note the storage account name

Update values.yaml with the storage account name.

values.yaml -> governance-service.config:

azureStorageAccountName: "<storage-account-name>"

values.yaml -> integrity-service.config:

integrityAppBlobStoreAccount: "<storage-account-name>"

2. Create Containers

In the storage account, navigate to “Containers”
Create two containers: one for governance artifacts and another for the integrity store
Set public access level to “Private (no anonymous access)“

3. Get Access Credentials

Navigate to Security + networking > Access keys
Copy the storage account key and connection string
Update secrets.yaml with the credentials.

secrets.yaml -> global.secrets.storage.azure_blob.values:

accountKey: "<account-key>"
connectionString: "<connection-string>"

Verification

Test access to the containers.

List blobs in the governance artifacts container (should be empty initially):

az storage blob list \
  --container-name governance-artifacts \
  --account-name $STORAGE_ACCOUNT \
  --account-key $ACCOUNT_KEY \
  --output table

List blobs in the integrity store container:

az storage blob list \
  --container-name integrity-store \
  --account-name $STORAGE_ACCOUNT \
  --account-key $ACCOUNT_KEY \
  --output table

If the commands succeed without errors, the configuration is correct.

Security Best Practices

HTTPS Only: The storage account is configured with --https-only true — do not disable this setting
Rotate Keys: Regularly rotate storage account keys and update Kubernetes secrets
Least Privilege: Account keys grant full storage access — scope access to specific containers where possible
Enable Versioning: Enable blob versioning to protect against accidental deletion
Audit Logging: Enable Azure Monitor storage diagnostics for access monitoring

Azure Storage Account

Overview

Prerequisites

Helm Configuration

Quick Start (CLI Method - Recommended)

1. Create Resource Group (if needed)

2. Create Storage Account

3. Create Blob Containers

Alternative: Web UI Setup

Using the Azure Portal

1. Create Storage Account

2. Create Containers

3. Get Access Credentials

Verification

Security Best Practices

Official Documentation