A control plane operation changes or manages a cloud resource’s configuration or lifecycle. In Azure Storage, creating or deleting an account uses the control plane, while reading and writing stored data uses the data plane. Securing a resource therefore requires authorization for both operation categories. section 5.1.1 section 5.2
Authorize control plane operations with Azure RBAC and apply least privilege:
- Select an appropriate built-in role, such as Owner, Contributor, Reader, Storage Account Contributor, User Access Administrator, or Virtual Machine Contributor. section 5.1.2
- Assign the role at the narrowest suitable scope: storage account, resource group, subscription, or management group. section 5.1.2
- Treat control-plane authorization separately from data access; a role supporting listkeys/action can expose storage account keys and thereby enable data access. section 5.1.2
Restricting a storage account
Use Azure CLI to update a storage account, set its default network action to Deny, enable the Microsoft.Storage service endpoint on a subnet, and add that subnet as an allowed network rule. The resulting configuration reports defaultAction as Deny and the subnet rule as Allow with state Succeeded.
