Amazon S3 vs Azure Blob Storage

Amazon S3

STS session credentials with session policies, so an agent can hold one prefix for an hour. Egress to the internet is billed per GB after 100 GB a month.

Azure Blob Storage

Microsoft Entra ID roles can be scoped to one container, and a user delegation signature hands out a link that expires within seven days. Account keys with full access stay enabled until the owner turns them off, request logs are off until configured, and an Azure account needs a person, a phone number and a payment card.

Amazon S3

1. Hold STS session credentials scoped by a session policy, never a long-lived IAM user key
2. Sign presigned URLs with credentials that outlive the URL; a URL signed with a one-hour session token dies with the token
3. Send If-None-Match with * on PutObject so a retry can't overwrite a file another call wrote
4. Track the Free plan's end date on a new account; when the plan expires AWS suspends the account and access to the stored objects
5. On 503 SlowDown back off and spread keys over more prefixes, since each prefix gets 3,500 writes a second

Azure Blob Storage

1. Request an Entra ID token for https://storage.azure.com/ and send it as a Bearer header with x-ms-version and x-ms-date. Put Blob also needs x-ms-blob-type: BlockBlob
2. Ask for a Storage Blob Data role on the one container. Role changes can take up to 10 minutes to apply
3. To share a file, call Get User Delegation Key, then sign a SAS with sp=r, spr=https and a short expiry. Treat the URL as a secret
4. Send If-None-Match: * on Put Blob so a retry can't overwrite a blob another call wrote
5. On 503 ServerBusy back off exponentially. After 500 OperationTimedOut check the blob's state before retrying, since the write may have succeeded