azure-devopsazure-blob-storageazcopy

AzCopy Blob Storage List Containers Permission Denied

I'm using RBAC to perform a blob copy operation: the service principal which azcopy is logged in as has the Storage Blob Data Contributor role for my subscription (listed as a requirement here)... however, I get a permission denied exception as follows:

Failure output

As you can see, the failing operation is to list the storage account containers (line 68 and 74)

I appreciate this isn't easy to debug without further info... but I'm pretty stumped, so if anyone has had a similar issue, I'd be very grateful for any observations/past experiences :)

Edit: please note that azcopy reports successful authentication:

INFO: SPN Auth via secret succeeded.
INFO: Scanning...
INFO: Authenticating to destination using Azure AD
INFO: Authenticating to source using Azure AD
Solution

  • Found this in the API docs:

    enter image description here

    Now, what's interesting here is that my service principal already had Owner permission on the subscription (infra pipeline stands up resources and assigns permissions etc.) - so I initially discounted this from being the issue... then, on a hunch, I assigned the Storage Blob Data Owner role directly on the storage account... and Voila - it worked!!