Implementing access control in your Data Lake
Azure storage accounts implement different ways to control access to content that is stored there:
- RBAC
- ACLs
- Shared Key authorization
- Shared Access Signature (SAS) authorization
Understanding RBAC
To give access to a user, group, service principal, or a managed identity using RBAC, the user or the application needs to be managed by Azure Active Directory (AAD). Implementing RBAC will use a so-called permission set that is put together as a role that a security principal can be assigned to.
When RBAC is assigned to Data Lake Storage, this will always be at the top level of the account or the filesystem. This means that the user or the application will have access to everything that is stored in the account or in the container that access has been granted to.
The following roles can be used to grant access to data in a data lake:
