CloudMed: Azure Blob Storage for Medical VR Videos

Secure, scalable cloud storage for 250+ medical VR video files using Azure Blob Storage. Includes Terraform IaC to provision storage and a TypeScript/Express API that issues time-limited SAS URLs for upload and playback, eliminating reliance on internal headset storage.

Architecture

• Azure Storage Account with a private Blob container (videos by default)
• SAS API (Express/TypeScript) to mint short-lived upload and read URLs
• Private by default: No public container access; only SAS-scoped access

Prerequisites

• Node.js 18+
• Terraform 1.6+
• Azure subscription and az login

Quick Start

1. Infrastructure (Terraform)

cd infra/terraform
terraform init
terraform apply -auto-approve \
  -var="resource_group_name=cloudmed-rg" \
  -var="location=westeurope" \
  -var="storage_account_name=cloudmedstorxyz" \
  -var="container_name=videos"

After apply, note the outputs. You will need the storage account name and container name for the API.

2. API Setup (SAS server)

cd api
# Create .env with your configuration
cat > .env << 'EOF'
PORT=4000
STORAGE_ACCOUNT_NAME=youraccount
CONTAINER_NAME=videos
SAS_EXPIRY_MINUTES=15
ALLOWED_ORIGINS=*
# Optional: AZURE_STORAGE_CONNECTION_STRING=...
# Optional: AZURE_STORAGE_ACCOUNT_KEY=...
EOF

npm install
npm run dev

The server runs on http://localhost:4000 by default.

API Endpoints

• POST /sas/upload?blobName={file.mp4} → returns a SAS URL to upload a blob
• GET /sas/read?blobName={file.mp4} → returns a SAS URL to stream/download

Both endpoints return JSON with a url you can use directly from headsets.

Example VR Device Usage

Upload from device (or companion app):

curl -X PUT "{uploadSasUrl}" \
  -H "x-ms-blob-type: BlockBlob" \
  --data-binary @local_video.mp4

Stream from device player using the read SAS URL directly as the media source.

Security Defaults

• Storage account public access: disabled
• Container access: private
• SAS duration: 15 minutes (configurable via env)
• HTTPS only

Configuration

Environment (api/.env):

PORT=4000
STORAGE_ACCOUNT_NAME=youraccount
CONTAINER_NAME=videos
SAS_EXPIRY_MINUTES=15
ALLOWED_ORIGINS=*

Optional Hardening

• Private endpoint for Storage Account, limit access from API only
• Customer-managed keys (CMK) via Key Vault
• CORS tighten to specific domains/devices
• Lifecycle policies (tier to Cool/Archive after N days)

Clean Up

cd infra/terraform
terraform destroy -auto-approve