Restricting Access to Specific Folders in Azure Storage Using ABAC

Question

How can I restrict access to a specific folder within a container in Azure Storage to a few specific users while ensuring other users with RBAC access cannot access that specific folder but can still access the rest of the container?

 "PS - Based on common issues that we have seen from customers and other sources, we are posting these questions to help the Azure community."

Answer 1

Greetings!

To achieve the goal of restricting access to a specific folder in an Azure Storage container to a few specific users while allowing others with RBAC to access the rest of the container, you need to use Azure Attribute-Based Access Control (ABAC). RBAC alone cannot meet this requirement as it takes precedence and does not allow for fine-grained access control at the folder level within a container.

Here's how you can implement this solution:

1. Add a specific blob tag to the container or folder that you want to limit access to.
2. Set a group to have permissions to access blob containers with the specific tag.
3. Assign the Storage Blob Data Reader role to the group, specifying the tag in the role definition.

Only members of this group with the specified tag in their role will have access to view the blob data in the tagged folder. This ensures that users without this specific tag cannot access the restricted folder while still being able to access other parts of the container.

For a detailed step-by-step guide, you can refer to the following resources:

• Azure Attribute-Based Access Control (ABAC)
• What is Azure attribute-based access control (Azure ABAC)? | Microsoft Learn

Check out this video for a practical demonstration:

• Azure ABAC Implementation Video

Hope this helps. If you have any follow-up questions, please let me know. I would be happy to help.

Please do not forget to "up-vote" wherever the information provided helps you, as this can be beneficial to other community members.