jperezduerto.info
Security in depth · Unit 25 · Lesson 5 of 12
Management and data paths differ
Decide whether seeing a storage account’s settings authorizes reading its reports.
Helpful before thisCloud identity
After this lesson you can
- Separate configuration visibility, data access, and authority to change access.
A visible resource is not necessarily a readable dataset.
Follow the requested operation
The control plane manages cloud resources and their configuration. The data plane uses the resource, such as reading a stored report. Azure distinguishes management actions from data actions in role definitions. Decide from the requested action and applicable permissions, not the word “Reader” alone.
Mira’s support ticket
P1: Mira has Azure’s built-in management Reader role on the Reports storage account. She has no data role, account key, shared access signature, or additional grant. Anonymous data access is disabled.
P2: The owner approves reviewing account settings. A later ticket asks Mira to download a sample report; that data task has no approval yet.
Assume valid authentication, normal role enforcement, and no additional restriction blocking the settings review. Under these records, Mira can inspect management information. Her assignment does not authorize reading blob contents. The resource’s appearance in a portal does not enlarge the role.
Keep the two decisions separate. Mark settings review as supported by P1/P2. Mark the download as requiring both owner approval and a suitable data grant. If approved, a data-reader assignment scoped to the necessary container is more defensible than broad account administration; confirm that the container contains only approved material.
There is still a connection between the planes: some management permissions can change access assignments or expose account keys. Review those separately before claiming isolation. Their existence does not give Mira permissions absent from P1.
Write the current result and proposed scope for each action. A useful acceptance record shows the permitted report read and an unrelated container denied, using the approved identity and access method.
Check yourself
No timer. No penalties. Read the explanation and try again whenever you like.
This lesson’s questions have changed. Your reading progress is saved; review the updated questions.
-
What does Mira’s management Reader assignment establish in this record?
Show the answer
Correct answer: Mira can inspect settings, but reading a report needs a separate approved data permission. P1 separates the management grant from data access, and P2 approves only settings review. A new data task needs its own owner-approved scope.
Try it
- WriteWrite a two-row permission decision for viewing settings and reading a sample report. Cite P1/P2, give the current result, and describe the narrowly scoped approval needed for any added data access.