ADLS Gen2 -- ACL on a folder level

Question

I have a question regarding permissions for ADLS Gen2

short description: I have a Gen2 storage account and created a container.

Folder Structure looks something like this

StorageAccount1
  --->Container1
       --->Folder1
          --->Files 1....n

Also i have a service principal from a customer.. Now i have to provide the customer write only permission to only Folder1 (should not be able to delete files inside Folder1)

I have assigned the service principle below permissions in the Access control list

Container1 --> Execute    
Folder1 --> Write , Execute

with this the customer can now put data into this Folder1.. but how do i prevent him from deleting any files inside it? ( i dont wanna use SAS ) Or is there any other way other than ACL?

Please help :)

ACL for ADLSgen2

user_15997509 · Answer

Please check if below can be worked.

ACLs are the way to control access to be applied on the file and folder level unlike others which are for container level.
Best practice is to always restrict access using (Azure RBAC) on the Storage Account/Container level has several Azure built-in roles that you can assign to users, groups, service principals, and managed identities and then combine with ACLs with more restrictive control on the file and folder level.

Ex: Storage Blob Data Contributor has read/write/delete permission .Assign an Azure role

If the built-in roles don't meet the specific needs of your organization, you can create your own Azure custom roles.

Reference

To assign roles, you must be assigned a role that has role assignments write permission, such as Owner or User Access Administrator at the scope you are trying to assign the role.

To create a custom role with customized permissions.

Create a new file C:\CustomRoles\customrole1.json like example below. The ID should be set to null on initial role creation as a new ID is generated automatically.

{
       "Name": "Restrict user from  delete operation on Storage",
       "ID": null,
       "IsCustom": true,
       "Description": "This role will restrict the user from delete operation on the storage account. However, customer will be able to see the storage account, container, blob.",

  "Actions": [
    "Microsoft.Storage/storageAccounts/read",
    "Microsoft.Storage/storageAccounts/blobServices/containers/read",
    "Microsoft.Storage/storageAccounts/blobServices/generateUserDelegationKey/action"
  ],

  "NotActions": [
    "Microsoft.Storage/storageAccounts/blobServices/containers/delete"
  ],

  "DataActions": [
"Microsoft.Storage/storageAccounts/blobServices/containers/blobs/read",
        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/write",
        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/move/action",
        "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/add/action"
  ],

  "NotDataActions": [   
    "Microsoft.Storage/storageAccounts/blobServices/containers/blobs/delete",
  ],


       "AssignableScopes": [

              "/subscriptions/dxxxx7-xxxx"
       ]
}

Using the above role definition, by running the below powershell script to create a custom role:

New-AzRoleDefinition -InputFile "C:\CustomRoles\customrole1.json"

see below References: for details.

Also try to enable soft delete to restore delete actions if the role has delete permissions .

Though mentioned to not use .Just in case .Shared access signature (SAS) can be used to restrict access to blob container or an individual blob. Folder in blob storage is virtual and not a real folder. You may refer to the suggestion mentioned in this article

References

ADLS Gen2 --> ACL on a folder level

1 Answers