CODEWITHSUNDEEP
azureazure-data-lake-gen2
Martin Thøgersen
Martin Thøgersen

Reputation: 1639

Manage ADLSGen2 ACLs with Shared Key Access Disabled?

On ADLS Gen2 (Azure Blob Storage with HNS enabled), we assign access via Access Control Lists (ACL), see ADLS Gen2 access control models. However, if we disable "Storage account key access", we loose the ability to edit the ACLs with the error:

"Failed to update ACL for path (...). Error: This request is not authorized to perform this operation using this permission"

This is quite counter-intuitive, given that Microsoft discourages shared (account) keys, and encourages ACL.

In the Azure portal, one can toggle between using Authentication method: Azure AD User Account or Access key when browsing data. (The latter is not possible when we disable access keys.) But in ACL management, it is not possible to choose a similar Authentication Method, and I suspect that they only support access keys.

Is this a feature or a bug? How do we mange ACL with shared keys diasabled?

Upvotes: 1

Views: 371

Answers (1)

James Crowley
James Crowley

Reputation: 4081

You specifically need the 'Storage Blob Data Owner' role assigned and scoped so it applies to the relevant container. The 'Owner' role on it's own, for instance, does not work.

Upvotes: 1

Related Questions