Handling non-existent tags in ABAC conditions for Azure Storage Account

Question

Hello, I've recently turned on on-upload malware scanning for a storage account, and I'm looking to use ABAC to restrict read access from an app service for malicious files. I've set up a condition to allow read access only if the tag with key="Malware Scanning scan result" doesn't contain value="Malicious".

This works perfectly for any newly uploaded files that have been scanned, but older files missing that tag are always restricted. I've tested negating the condition, but this only inverts the logic for the new files, and unscanned files are still always restricted.

I've also tested the following conditions to potentially OR with the malicious file condition, but none were able to permit access:

• Value as an empty string
• Attribute as "Blob index tags [Keys]" to check for the absence of the tag with key="Malware Scanning scan result"

What are the options for handling this situation, or are there alternative approaches other than ABAC?

Answer 1

Hi Frank Ma,

Welcome to Microsoft Q&A Forum, thank you for posting your query here!

It sounds like you're doing a great job setting up ABAC for your storage account! I understand the challenge you're facing with older files missing the "Malware Scanning scan result" tag. Here are a few suggestions to handle this situation:

• Create a Default Tag for Unscanned Files: You could add a default tag to all files indicating they haven't been scanned yet. For example, you could use a tag like {"Malware Scanning scan result": "Not Scanned"}. This way, you can modify your condition to allow access if the tag is either "Not Scanned" or doesn't contain "Malicious".

Alternative

Azure Function Logic:

The Azure Function can be triggered on two events:

• File upload (blob creation): The function checks the file’s scan result and takes action accordingly.
• Metadata/tag update: The function triggers after the malware scan result is applied to the blob (by tag or property).

Here's a breakdown of what the Azure Function will do:

• Check File Tag/Metadata: The function will first retrieve the blob’s metadata, specifically looking at the tag "Malware Scanning scan result".

If Malicious (Tag = "Malicious"):

• Move file to quarantine: The Azure Function can move the file to a separate “quarantine” container where read access is restricted. This can be done programmatically by copying the blob to a new container and deleting the original.
  • Deny access: Optionally, the function can alter the access level of the blob (such as removing public access or adjusting permissions).
  • Notify admin: You could also trigger notifications (e.g., email or Slack) to inform security teams or admins.
  If Clean (Tag ≠ "Malicious"):

Handling Access Control:

• You can integrate Azure RBAC or Shared Access Signatures (SAS) to control who can access the blobs:
• If a file is clean, the Function can ensure that appropriate roles (e.g., Storage Blob Data Reader) are assigned to the Storage account
• If a file is malicious, the Function could revoke access by either removing the role assignment or moving the blob to a restricted container where only admins have access.

Hope this helps!

Kindly let us know if the above helps or you need further assistance on this issue.

---

Please do not forget to "Accept Answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.