Why do read access rights need to be more specific than contribute access rights

Question

Why do read access rights need to be more specific than contribute access rights

Søren Bech Christensen 0

Using service principals, I am trying to define two roles in my Azure Resource Group, one for the moderator:

az role assignment create --assignee <moderator app id> --role "Storage Blob Data Owner" --scope /subscriptions/<mysub>/resourceGroups/<myresourcegroup>

and one for the reader:

az role assignment create --assignee <readerapp id> --role "Storage Blob Data Reader" --scope /subscriptions/<mysub>/resourceGroups/<myresourcegroup>

The moderator can upload files to the container using:

azcopy copy <local path> "https://<storage account>.blob.core.windows.net/<container>" --recursive=true

But when reader tries to get the content from the container wtih:

azcopy copy "https://<storage account>.blob.core.windows.net/<container>" "<local path>" --recursive=true --overwrite ifSourceNewer

…the command fails with

failed to perform copy command due to error: cannot start job due to error: cannot list files due to reason -> github.com/Azure/azure-storage-blob-go/azblob.newStorageError, C:/Users/VssAdministrator/go/pkg/mod/github.com/!azure/azure-storage-blob-go@v0.15.0/azblob/zc_storage_error.go:42

When assigning read acces on container level (as opposed to the resource group) with

az role assignment create --assignee <reader app id> --role "Storage Blob Data Reader" --scope /subscriptions/<mysub>/resourceGroups/<myresourcegroup>/providers/Microsoft.Storage/storageAccounts/<storage account>/blobServices/default/containers/<container>

…the reader role is able to azcopy the contents of the container.

Why are read access rights more restrictive than write access rights?

1 answer

Your answer

Answer 1

James Hamil 27,221 Microsoft Employee Moderator

Hi @Søren Bech Christensen , when it comes to access rights, it is always best practice to grant only the narrowest possible scope. This is because the more access rights a user has, the more damage they can do if their account is compromised.

For example, if a user has read access to a resource, they can only view the resource and its properties. However, if a user has contribute access, they can make changes to the resource, which could potentially cause damage.

Regarding your question, read access rights need to be more specific than contribute access rights because read access is generally less risky than contribute access. If a user has read access to a resource, they can only view the resource and its properties. However, if a user has contribute access, they can make changes to the resource, which could potentially cause damage.

Regarding your second question, to create a role assignment in Azure Resource Group using Azure CLI, you can use the following command:

az role assignment create --assignee <service-principal-object-id> --role <role-name> --resource-group <resource-group-name>

Here, you need to replace <service-principal-object-id> with the object ID of the service principal, <role-name> with the name of the role you want to assign, and <resource-group-name> with the name of the resource group to which you want to assign the role.

Please let me know if you have any questions and I can help you further.

If this answer helps you please mark "Accept Answer" so other users can reference it.

Thank you,

James

Søren Bech Christensen 0 Reputation points

2023-10-04T05:44:02.9933333+00:00

This does not answer my question: Why are read access rights more restrictive than write access rights?
James Hamil 27,221 Reputation points Microsoft Employee Moderator

2023-10-10T21:08:35.69+00:00

Hi @Søren Bech Christensen , sorry about that! When you create a resource in Azure, it inherits the permissions of the resource group it belongs to. However, if you want to grant access to a specific user or service principal to access that resource, you need to explicitly grant them access to the resource. This is because the resource group permissions are inherited by all resources in the group, but you may not want all users or service principals to have access to all resources in the group. Therefore, you need to grant access to the specific resource to the users or service principals that need it.

Does this help/make sense? Let me know and I can help you further.

Best,

James
Søren Bech Christensen 0 Reputation points

2023-10-11T06:04:06.3066667+00:00

Hi @James Hamil In all respect, you should read what I am writing, not what you think I would be asking.

I have two service principals, one for writing and one for reading. The one for reading seemingly behaves like you argue:

However, if you want to grant access to a specific user or service principal to access that resource, you need to explicitly grant them access to the resource.

But that is NOT the case for the service principal with write access rights - they are defined at resource group level.

So again (read the text in bold upper case):
WHY IS READ ACCESS RIGTHS MORE RESTRICTIVE THAN WRITE ACCESS RIGHTS?

That ^^^ right there ^^^ is my question.

Share via

Why do read access rights need to be more specific than contribute access rights

1 answer

Your answer