How to restrict a group of users to able to read/enter the container and the folder inside it?

Question

We have a azure storage where we have multiple containers created. We have two groups Dev and Test. I want to implement this scenario: One of the container is 'data_zone'. Inside this container we have two folders, Dev and QA. Now I want to implement such a rule that the Dev group of users should only get the access to this Dev folder. They should not either enter or view the contents of the QA folder. Likewise same for the QA group to be followed. I have tried the below things to achieve this but it's somehow not working:

• Gave RBAC role of 'Reader' and 'Storage BLOB reader' to these two groups (i.e DEV group and QA group)
• In the ACL options, I added a principal and attached the group 'DEV' and gave no access (i.e neither READ, nor LIST and nor EXECUTE) in order to restrict this group to enter the QA folder. Same operation I have done for the QA group with opposite to the previous one.

Now the problem after this is, the DEV group users are still able to view/list the folders like DEV and QA when they enter the container. After being able to view, they can successfully enter the QA folder as well, and they are able to read the text file (one of the objects uploaded). It's jsut that they are not able to edit it. They are not able to upload any blob or download any. But we want to achieve the below conditions: Group DEV must not be able to enter/or view the contents of the QA folder and vice versa for QA group.

I have tried

• RBAC roles
• ACL settings

Can you all know what is to be done to achieve this level of granularity of the access?

One of the container is 'data_zone'. Inside this container we have two folders, Dev and QA. Now I want to implement such a rule that the Dev group of users should only get the access to this Dev folder. They should not either enter or view the contents of the QA folder. Likewise same for the QA group to be followed. I have tried the below things to achieve this but it's somehow not working:

• Gave RBAC role of 'Reader' and 'Storage BLOB reader' to these two groups (i.e DEV group and QA group)
• In the ACL options, I added a principal and attached the group 'DEV' and gave no access (i.e neither READ, nor LIST and nor EXECUTE) in order to restrict this group to enter the QA folder. Same operation I have done for the QA group with opposite to the previous one.

Now the problem after this is, the DEV group users are still able to view/list the folders like DEV and QA when they enter the container. After being able to view, they can successfully enter the QA folder as well, and they are able to read the text file (one of the objects uploaded). It's jsut that they are not able to edit it. They are not able to upload any blob or download any. But we want to achieve the below conditions: Group DEV must not be able to enter/or view the contents of the QA folder and vice versa for QA group.

I have tried

• RBAC roles
• ACL settings

Answer 1

On top of the Storage Blob Data Reader data plane role you can provide a role assignment condition. If you specify the RBAC controls using the portal it will ask it right after selecting the blob reader role. Using those conditions you can apply a rule to allow access to a specific path with which you can include the specific folders for DEV and QA.

Below is an example from the Microsoft documentation:

This condition allows read access and also list access to storage containers named blobs-example-container with a blob path of readonly/*. Condition #1 applies to read actions excluding list blobs. Condition #2 applies to list blobs. This condition is useful for sharing specific parts of storage containers for read or list access with other users in the subscription.

(
 (
  !(ActionMatches{'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'} AND NOT SubOperationMatches{'Blob.List'})
 )
 OR 
 (
  @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringEquals 'blobs-example-container'
  AND
  @Resource[Microsoft.Storage/storageAccounts/blobServices/containers/blobs:path] StringStartsWith 'readonly/'
 )
)
AND
(
 (
  !(ActionMatches{'Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read'} AND SubOperationMatches{'Blob.List'})
 )
 OR 
 (
  @Resource[Microsoft.Storage/storageAccounts/blobServices/containers:name] StringEquals 'blobs-example-container'
  AND
  @Request[Microsoft.Storage/storageAccounts/blobServices/containers/blobs:prefix] StringStartsWith 'readonly/'
 )
)