Implementing Role-Based Access Control, Managed Identities, and Protected Immutable Storage
Tags: cloudcomputing, identity, azure, storage
Published: 2024-06-03 01:02:17

**Create the storage account and managed identity**

**Provide a storage account for the web app.**

**In the portal, search for and select Storage accounts.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ccr8yrgxtadc6v5pjid9.png)

**Select + Create.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g0d9thg3y5z628opt7g4.png)


**For Resource group select Create new. Give your resource group a name and select OK to save your changes.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8jfy7ozv5073onebm7vf.png)


**Provide a Storage account name. Ensure the name is unique and meets the naming requirements.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gssdunrziki8mxrkrb2j.png)


**Move to the Encryption tab.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mpi7e6fh9i14rvpdj4w1.png)


**Check the box for Enable infrastructure encryption.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/t0ugx9znucl7qj7z3knv.png)


**Notice the warning, This option cannot be changed after this storage account is created.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fgzbryubcu6514fsqlnp.png)


**Select Review + Create.**

**Wait for the resource to deploy.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fxz7i8tvixh1qa8jq42d.png)

2.** Provide a managed identity for the web app to use. **

**Search for and select Managed identities.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/v4ucthy8h2hj0y4juvh9.png)


**Select Create.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zch9tmywodrgs0f5hf7m.png)


**Select your resource group.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8yd201qhptbfts76dp39.png)


**Give your managed identity a name.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6lybr0hg78cb2la1cmfy.png)


**Select Review and create, and then Create.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nz3a3bqnr1usd5f9ge6s.png)

3. **Assign the correct permissions to the managed identity. The identity only needs to read and list containers and blobs. **

**Search for and select your storage account.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/9185rsjuzs7xc7s1de1z.png)


**Select the Access Control (IAM) blade.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aelf1ux3br0dchrxquwd.png)


**Select Add role assignment (center of the page).**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/d37me02q2hi0o98sdbi1.png)



**On the Job functions roles page, search for and select the Storage Blob Data Reader role.**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u4kyrl32ot8u71t6zpo2.png)


**On the Members page, select Managed identity.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/560d6u4ksldgm03kfc6f.png)


**Select Select members, in the Managed identity drop-down select User-assigned managed identity.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mi3l4lu8uauozi2t32eq.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/irdu2hp2y43oomboicvl.png)



**Select the managed identity you created in the previous step.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zfa9u4ovuzofmkwjul5g.png)


**Click Select and then Review + assign the role.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ygfhyd9ktii5imipovmp.png)

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/oyra98uiyb01u6bo0el5.png)



**Select Review + assign a second time to add the role assignment.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6qwas13ipy818j4ort0g.png)


**Your storage account can now be accessed by a managed identity with the Storage Data Blob Reader permissions.**



**Secure access to the storage account with a key vault and key**

1. **To create the key vault and key needed for this part of the lab, your user account must have Key Vault Administrator permissions. **


**In the portal, search for and select Resource groups.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ymp3gltrwswlfdaw5v97.png)


**Select your resource group, and then the Access Control (IAM) blade.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ge7tzal89ent3j90bt7d.png)


**Select Add role assignment (center of the page).**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1ussn7ipsy7y11gr7wfh.png)


**On the Job functions roles page, search for and select the Key Vault Administrator role.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6pvo5wloe1hufmxhjh8c.png)


**On the Members page, select User, group, or service principal.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5m1gvwfteq3ii2vhtoa3.png)


**Select Select members.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/g3gu5uih2uoc24h1p63x.png)



**Search for and select your user account. Your user account is shown in the top right of the portal.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3aho5cunonso6nbo1rzf.png)


**Click Select and then Review + assign.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ngylsuikl7lzxl7kzwjy.png)


**Select Review + assign a second time to add the role assignment.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gk8ujh19ki82ahr6avfd.png)


**You are now ready to continue with the lab.**



2. **Create a key vault to store the access keys.**

**In the portal, search for and select Key vaults.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qnicl4qobx4agdk2sipb.png)


**Select Create.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ayjz7hnjor5p4r23b1wd.png)


**Select your resource group.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/hvhucfyh9rxlx0zy60tv.png)


**Provide the name for the key vault. The name must be unique.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/cayyquifepavy8ls3q9n.png)


**Ensure on the Access configuration tab that Azure role-based access control (recommended) is selected.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/6ml161gtm2cijmak8iuz.png)


**Select Review + create.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/8plhjmvkc0p5mwuw9drm.png)


**Wait for the validation checks to complete and then select Create.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fput5knotqizjl635rji.png)


**After the deployment, select Go to resource.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5rjt6ll972d73jlek983.png)


**On the Overview blade ensure both Soft-delete and Purge protection are enabled.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ivl91r1om3y7wcov13ga.png)


3. **Create a customer-managed key in the key vault.**

**In your key vault, in the Objects section, select the Keys blade.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mc0t2kgxw7te6e4vd8za.png)


**Select Generate/Import and Name the key.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/s32a08d1hpcv2jehjvoi.png)


**Take the defaults for the rest of the parameters, and Create the key.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0v7hrova9c3mto75ydd8.png)



**Configure the storage account to use the customer managed key in the key vault**

1. **Before you can complete the next steps, you must assign the Key Vault Crypto Service Encryption User role to the managed identity.**

**In the portal, search for and select Resource groups.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ymp3gltrwswlfdaw5v97.png)


**Select your resource group, and then the Access Control (IAM) blade.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ge7tzal89ent3j90bt7d.png)

**Select Add role assignment (center of the page).**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1ussn7ipsy7y11gr7wfh.png)

**On the Job functions roles page, search for and select the Key Vault Crypto Service Encryption User role.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c8cc7k6ovo634aso9t1n.png)


**On the Members page, select Managed identity.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/aodiybqs586vflcuceev.png)


**Select Select members, in the Managed identity drop-down select User-assigned managed identity.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ts9kcs32vzlwve01stey.png)


**Select your managed identity.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/fbb81rgniktpznq3i4m1.png)


**Click Select and then Review + assign.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/35hbzynq00ajr24yy0g3.png)


**Select Review + assign a second time to add the role assignment.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0q3gmibiuotkjpjxrwa7.png)



2. **Configure the storage account to use the customer managed key in your key vault. **

**Return to your the storage account.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/2jvnktvjcpvhqbstd5js.png)



**In the Security + networking section, select the Encryption blade.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0sruwjnkfkza81lr5uqo.png)



**Select Customer-managed keys.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/627kdmuhkvbfup2x5hfl.png)


**Select a key vault and key. Select your key vault and key.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/4tc45fum9dwr8u8zbdae.png)


**Select to confirm your choices.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/dwgea5wq065kb6v8rfvc.png)


**Ensure the Identity type is User-assigned.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/xu95whrdh908oqc3t7kr.png)


**Select an identity.**


![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/mcsxb80gj0mcthxi97gt.png)



**Select your managed identity then select Add.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x8hyfx5n4sax4udneon2.png)


**Save your changes.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/u8c7aaarzizcllmxp2ge.png)



**Configure an time-based retention policy and an encryption scope.**

1. **The developers require a storage container where files can’t be modified, even by the administrator. **

**Navigate to your storage account.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3gimzuegnvcccd8ps19m.png)



**In the Data storage section, select the Containers blade.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/h5nlwk4qjgpu3x6aihz1.png)


**Create a container called hold. Take the defaults. Be sure to Create the container.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tf87ysq21mszxdhqxdy7.png)


**Upload a file to the container.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/0tey01cq5dzpnpy74bfe.png)


**In the Settings section, select the Access policy blade.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3hu6cztqqb8eosimc9dx.png)


**In the Immutable blob storage section, select + Add policy.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/54lnxwppm4b89xg0tsgo.png)


**For the Policy type, select time-based retention.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/3xs88zb2u6mpzqz79dtq.png)


**Set the Retention period to 5 days.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/qxm5jwwxj0632owdst69.png)


**Be sure to Save your changes.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/nai03n79mrw1583kztb9.png)


**Try to delete the file in the container.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/c16xvgh4cb2hmg5ow24b.png)


**Verify you are notified failed to delete blobs due to policy.**



2. **The developers require an encryption scope that enables infrastructure encryption. **

**Navigate back to your storage account.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5qdrpo70fgpdvkgz8xnc.png)


**In the Security + networking blade, select Encryption.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ppg6edp4tog89wv237of.png)


**In the Encryption scopes tab, select Add.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/lq41qwejpbu6zobwvsho.png)


**Give your encryption scope a name.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/omnjwrha5fbdffz8zacl.png)


**The Encryption type is Microsoft-managed key.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tl2wab02l27e8qmnh1su.png)


**Set Infrastructure encryption to Enable.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/sy52ajjixim0q6ldcu6j.png)


**Create the encryption scope.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/l7d420t0zl636rwlwdo7.png)


**Return to your storage account and create a new container.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/spuxzcivbaqgomwlw0nh.png)


**Notice on the New container page, there is the Name and Public access level.
Notice in the Advanced section you can select the Encryption scope you created and apply it to all blobs in the container.**

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vjskz3r6gtcqz96lwhp9.png)