Read Only Access to Azure Storage Account Blob Containers via Azure CLI?

[unixdespair]

Hi, is it currently possible to to provide read only access to Azure Storage Account blob containers via Azure CLI? It appears that once you connect to Azure via Azure CLI, it is just using the Storage Account's access key for all operations against the container, regardless of the RBAC rights associated with the SP I connect with.

[#2]

Hi @unixdespair  good night.

You can set the IAM Role for the user in the container level, if you set reader role, so this user will just can read the blobs inside your storage account and with it you minimize the access just to specific container.

However, if the user has one of the storage account Keys (Key1 or Key2) of you storage account, this user can do everything in this storage account until that the storage access keys has been regenerated, it's quite importante do not share de access Keys, i don't know if it's the case but, could use SAS(shared access signature).

I hope it can help you.

[#3]

Unfortunately that's not how Azure CLI  works currently. I did find the actual solution though in this case. You need to assign Reader and the preiew Storage Blob Data Reader role, then enable preview features in Azure CLI with:

az extension add -n storage-preview

Then, add "--auth-mode login" to your az storage commands after logging in with the SP that has only read-only rights.

As shipped, Azure CLI interactions with storage accounts are always using the account keys.