A data plane operation accesses or manipulates the data managed by a cloud resource. In Azure Storage, reading and writing stored data use the data plane, while creating or deleting the storage account uses the control plane. Securing a storage account therefore requires authorization for both planes. section 5.1.1
Control-plane permissions do not normally grant access to stored data. An exception is an Azure RBAC role that includes Microsoft.Storage/storageAccounts/listkeys/action: listing account keys can provide access to storage data, making account keys comparable to administrator passwords. section 5.1.2
Treat data-plane authorization as a separate security decision:
- Authorize access to data stored in Azure Storage independently from permissions that manage the storage account. section 5.1.1 section 5.1.2
- Protect account keys because roles that can list them may indirectly grant access to storage data. section 5.1.2
- Apply the same distinction to Azure Key Vault: managing the vault is a control-plane activity, while working with stored secrets, keys, and certificates is a data-plane activity. section 5.2
Storage account access
Creating a storage account changes the Azure resource through the control plane. Reading or writing a blob uses the data plane and requires data authorization; a role that can list the account keys may also enable that access. section 5.1.1 section 5.1.2
