how to override deny assignment so that I can access the databricks managed storage container?

user_1033422 0
Viewed 144

I have a Databricks workspace provisioned in my own azure subscription for my own learning purposes.

I would like to access the containers in the Databricks managed storage account via the Azure Portal UI, however when I attempt to do so:

The client 'my@email' with object id 'myobjectid' has permission to 
perform action 'Microsoft.Storage/storageAccounts/listKeys/action' 
on scope '/my/storage/account'; however, 
the access is denied because of the deny assignment 
with name 'System deny assignment created by 
Azure Databricks /my/workspace' and Id 'myid' at scope '/my/workspace'.

How can I grant all permissions to my azure account owner (me)?

azure-databricks
2 Answers

From Microsoft Document,

When you attempt to access blob data in the Azure portal, the portal first checks whether you have been assigned a role with Microsoft.Storage/storageAccounts/listkeys/action. If you have been assigned a role with this action, then the portal uses the account key for accessing blob data. If you have not been assigned a role with this action, then the portal attempts to access data using your Azure AD account.

From Microsoft Document,

You need to have Microsoft.Authorization/roleAssignments/write access to assign Azure roles,

To give owner permission to user go to:

Subscriptions >> Access control (IAM) >> Add >> Add role assignment >> Owner >> Click on Next >> Select members >> select the user >> Save >> Next >> Review + assign

enter image description here

user_180436990

You can't do this on the managed resource group created by Azure Databricks even if you're owner - it's a resource managed by Databricks, and it prevents direct access to the data because it stores some system information inside storage account. If you attempt to do this, you will get an error like this:

Failed to add User as Storage Blob Data Contributor for dbstorageveur7e23e27e4c : The client '....' with object id '...' has permission to perform action 'Microsoft.Authorization/roleAssignments/write' on scope '/subscriptions/..../resourceGroups/databricks-rg-...-jm5c8b2za1oks/providers/Microsoft.Storage/storageAccounts/dbstorageveur7e23e27e4c/providers/Microsoft.Authorization/roleAssignments/f2bc46d3-4aee-4d8f-803d-3d6324b5c094'; however, the access is denied because of the deny assignment with name 'System deny assignment created by Azure Databricks /subscriptions/.../resourceGroups/.../providers/Microsoft.Databricks/workspaces/...' and Id '99598a6270644ecdacfb23af7b0df9a0' at scope '/subscriptions/....resourceGroups/databricks-rg-...-jm5c8b2za1oks'..

Alex_Ott_186270
Related