Azure存储// azure-ad
团队将数据存储在Azure存储帐户中，S1。它们都处于同一Azure订阅中。假设团队成员是：M1，M2，M3和Admin A1。该团队在Azure中可见 -
存储帐户由两个容器组成：C1和C2
我如何授予C1中BLOB的授予授予的读数，以将C1的Blobs授予Team-Members M2和M3而不是M1？ 只有A1在此S1中的所有容器中都有写入访问。
我是否需要其他解决方案或服务来授予/撤销访问权限？ 问题是SAS连接字符串无法使用，因为订阅中的每个人都可以阅读所有存储帐户，包括所有容器。
是否有任何方法可以在容器级别的粒度上授予个人对S1的访问？
a team stores data in a AZURE storage account, S1. They're all in the same AZURE subscription. Let's say, the team-members are: M1, M2, M3 and an admin A1. The team is visible in the AZURE-AD
The storage account consists of two containers: C1 and C2
How can I grant grant read-access of the blobs in C1 to team-members M2 and M3 and NOT to M1?
Only the A1 shall have write-access to all containers in this S1.
Do I need a different solution or service for granting/revoking access-rights to team-members?
Problem is that an SAS-connection string won't work since everybody inside the subscription has read-access to all storage-account, including all containers.
Is there any way to grant individual access to S1 with the granularity on the container-level?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
确定可以。您可以分配
存储BLOB数据读取器对“ M2”和“ M3”用户的角色，并且不为用户分配任何存储数据角色“ M1”。这些角色应范围为“ C1”容器。对于“ A1”，您可以分配存储BLOB数据贡献者角色示于存储帐户。此外，您可能需要确保所有用户（M1，M2和M3）没有任何控制平面角色，可以使他们访问存储帐户的密钥。另外，您可以简单地关闭该存储帐户的基于共享的键授权，并迫使团队中的每个人都使用基于Azure AD的授权。
Sure you can. You can assign
Storage Blob Data Readerrole to "M2" and "M3" users and do not assign any storage data role to user "M1". These roles should be scoped to container "C1". For "A1", you can assignStorage Blob Data Contributorrole scoped to the storage account.Also, you may want to ensure that all of the users (M1, M2, and M3) do not have any control plane roles that would allow them to access the key for storage account. Alternately, you can simply turn off shared key based authorization for that storage account and force everyone in the team to use Azure AD based authorization.