How to stop inherited management and subscription groups from accessing storage account keys.

Sandhya Reddy Veera 21 Reputation points
2023-01-29T09:18:17.43+00:00

Hi,

I have a Gen2 storage account to store confidential data. This storage account inherits Management and subscription level

groups in contributor and owner roles. How can we avoid access to the storage account keys for these inherited groups.

Thanks.

Azure Data Lake Storage
Azure Data Lake Storage
An Azure service that provides an enterprise-wide hyper-scale repository for big data analytic workloads and is integrated with Azure Blob Storage.
1,338 questions
Azure Storage Accounts
Azure Storage Accounts
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
2,670 questions
0 comments
Accepted answer
  1. Luke Murray 10,526 Reputation points MVP
    2023-01-29T10:58:54.0933333+00:00

    I am not aware of away to prevent the IAM/RBAC roles from being excluded at specific resource levels.

    You would need to move the Subscription holding the storage account to a new management group, excluding the permissions.

    Or

    Adjust the permissions of that management group, to prevent storage account read access.

    FYI: I looked into Deny Assignments as well (https://learn.microsoft.com/en-us/azure/role-based-access-control/deny-assignments) but this is for Blueprint created resources, not entirely for your usecase.

    "You can't directly create your own deny assignments."

    0 comments

0 additional answers

Sort by: Most helpful
Most helpful Newest Oldest