How to set access permissions for azure blob path

溫梓渝-統智科技 0

https://learn.microsoft.com/zh-tw/azure/role-based-access-control/conditions-prerequisites

Hello,

How to set access permissions for azure blob path.

Thanks.

顯示具名容器中具有路徑之 Blob 讀取存取權的條件圖表。

User's image

Accepted answer

akinbade abiola 18,725 Reputation points

2024-11-05T07:30:40.8066667+00:00

When specifying conditions for the Microsoft.Storage/storageAccounts/blobServices/containers/blobs:path attribute, the values shouldn't include the container name or a preceding slash (/) character. Use the path characters without any URL encoding.

Verify if this is the case.

https://learn.microsoft.com/en-us/azure/storage/blobs/storage-auth-abac-portal?source=recommendations

You can mark it 'Accept Answer' and 'Upvote' if this helped you

Regards,

Abiola
Please sign in to rate this answer.

1 person found this answer helpful.
溫梓渝-統智科技 0 Reputation points

2024-11-05T07:54:52.9666667+00:00

Keshavulu Dasari 1,830 Reputation points Microsoft Vendor

2024-11-05T17:50:40.7166667+00:00

Hi
To assign an Azure role for access to blob data, you can use the Azure portal, PowerShell, Azure CLI, or an Azure Resource Manager template
Navigate to your storage account: Open the Azure portal and go to your storage account.

Access the Access control (IAM) settings: In the left-hand menu, select Access control (IAM).

Add a role assignment: Click on Add and then Add role assignment.

Select the role: In the Role tab, choose a role that grants the necessary permissions. For accessing blob data, you can select roles like Storage Blob Data Reader or Storage Blob Data Contributor.

Assign the role to a user, group, or service principal: In the Members tab, select the user, group, or service principal you want to assign the role to.

Review and assign: Review your selections and click Review + assign to complete the process.

This will grant the selected user or group the necessary permissions to access blob data in your storage account

For more information:
https://learn.microsoft.com/en-us/azure/storage/blobs/assign-azure-role-data-access?tabs=portal

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you,

Please do not forget to "Accept the answer” and “up-vote” wherever the information provided helps you, this can be beneficial to other community members.

溫梓渝-統智科技 0 Reputation points

2024-11-21T05:14:47.57+00:00

Thanks for your swift response.

storage account => Reader

container => Storage Blob Data Reader + "conditions"

溫梓渝-統智科技 0 Reputation points

2024-11-21T05:16:24.84+00:00

Thanks for your swift response.

storage account => Reader

container => Storage Blob Data Reader + "conditions"
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

3 additional answers

Luis Arias 7,526 Reputation points

2024-11-05T07:25:45.34+00:00
Hello, Azure Attribute-Based Access Control (ABAC) is generally available for Azure Blob Storage and Data Lake Storage Gen2. To check if ABAC is supported in your region, refer to the Azure Products by Region page.

For more details:

ABAC Availability by Region

Azure ABAC Documentation

If the information helped address your question, please Accept the answer.

Luis
Please sign in to rate this answer.

1 person found this answer helpful.
溫梓渝-統智科技 0 Reputation points

2024-11-05T07:45:45.26+00:00

Azure Region：japaneast Thanks.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
溫梓渝-統智科技 0 Reputation points

2024-11-15T02:18:18.28+00:00

"The attribute is not applicable to the selected action. Please select a different set of actions."
Please sign in to rate this answer.
Keshavulu Dasari 1,830 Reputation points Microsoft Vendor

2024-11-15T19:05:31.65+00:00

Hi
To allow read access to storage containers named blobs-example-container with a blob path of readonly/*, but you're encountering an error message stating "The attribute is not applicable to the selected action."
the condition and see if we can identify the issue:
ActionMatches: This function checks if the action matches the specified operation.

SubOperationMatches: This function checks if the sub-operation matches the specified operation.

@Resource: This function checks if the resource matches the specified condition.

From the condition you provided, it seems like there are multiple checks for read and write actions, and some logical operations might be conflicting.

Simplify the Condition: Try to simplify the condition to isolate the issue. Start with a basic condition that only checks for read access and then gradually add more conditions.

Check Action and SubOperation: Ensure that the actions and sub-operations you're using are correct and applicable to the storage container and blob operations.

Resource Matching: Verify that the resource matching conditions are correctly specified and relevant to the storage container and blob paths.
example to allow read access to the specified container and path:

{ "actions": [ "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read" ], "conditions": { "allOf": [ { "field": "Microsoft.Storage/storageAccounts/blobServices/containers/name", "equals": "blobs-example-container" }, { "field": "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/path", "like": "readonly/*" } ] } }

Try adjusting your condition based on this simplified example and see if it resolves the issue, if you are still experiencing issues, please provide more details about the specific error message or the context in which you are using this scenario, I’m happy to assist you further.

Keshavulu Dasari 1,830 Reputation points Microsoft Vendor

2024-11-18T17:46:43.7333333+00:00

Hi,
Checking in to see if the response helped. If you have any questions, let me know in the "comments" and I would be happy to help you.

Keshavulu Dasari 1,830 Reputation points Microsoft Vendor

2024-11-19T19:26:42.81+00:00

Hi,
In managing access to blob data in a storage system. The image you provided shows a hierarchical structure of access permissions for different containers and files.

To give you a quick overview:

Storage Account: The top level, containing multiple containers.

Containers: For example, "blobs-example-container" and "project-container."

Files/Folders: Each with specific access permissions, such as read-only or restricted access.

If you have any other questions or are still running into more issues, let me know in the "comments" and I would be happy to help you,
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
溫梓渝-統智科技 0 Reputation points

2024-11-19T10:50:32.6666667+00:00

Thanks for your swift response.

storage account => Reader

container => Storage Blob Data Reader + "conditions"
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

How to set access permissions for azure blob path

3 additional answers

Your answer