Resolving Conflicting Rules: RBAC and ACLs

Azure RBAC and ACLs are two key mechanisms for managing access control in Azure. RBAC focuses on defining roles and permissions for users, groups, and service principals, granting specific permissions at different levels, such as subscription, resource group, or resource. It’s particularly useful for high-level access control across Azure resources. ACLs, on the other hand, operate at a finer granularity, allowing the association of security principals with specific access levels for files and directories within a storage account. Each file and directory has its own ACL, making it essential for controlling access to individual resources within the storage account.

Figure 8.13 shows a flow chart reproduced from Azure that shows how the authorization decision is made between RBAC and ACL:

Figure 8.13 – RBAC and ACL evaluation sequence

Imagine a situation where a user has both RBAC permissions and...