Share via

can "storage account contributor" role Read, write, and delete Azure Storage containers and blobs ?

Shridhar Srinivasan 215 Reputation points
2023-08-08T11:04:38.0566667+00:00

can "storage account contributor" role Read, write, and delete Azure Storage containers and blobs ?

Or

will "Storage Blob Data Contributor" be needed to Read, write, and delete Azure Storage containers and blobs ?

Azure Storage Accounts
Azure Storage Accounts
Globally unique resources that provide access to data management services and serve as the parent namespace for the services.
2,944 questions
Azure Blob Storage
Azure Blob Storage
An Azure service that stores unstructured data in the cloud as blobs.
2,639 questions
Azure Role-based access control
Azure Role-based access control
An Azure service that provides fine-grained access management for Azure resources, enabling you to grant users only the rights they need to perform their jobs.
725 questions
Accepted answer
  1. Ivan Tang 75 Reputation points
    2023-08-08T11:50:59.7866667+00:00

    I’ve tested and can confirm user with the role “Storage Account Contributor” can delete containers and blobs if for the specific storage account.

    It will be easy to test from your end. Just add a new user, grant the user the role from Access Control page in your storage account. Then login as the new user and try deleting containers/blobs.

    It’s best to adopt an “as-needed” approach to granting roles. If you don’t need user to manage the specific storage account, don’t user Storage Account Contributor.

1 additional answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Edvin Močibob 0 Reputation points
    2024-07-27T12:24:37.63+00:00

    I did some testing, and Storage Account Contributor can access blobs if access keys are enabled and you're accessing blobs via the Azure Portal. If access keys are disabled, i.e. only RBAC is allowed, Storage Account Contributor can not access blobs.

    Official description for the role: "Permits management of storage accounts. Provides access to the account key, which can be used to access data via Shared Key authorization."

    0 comments