An organization is implementing Azure Machine Learning with sensitive training data in Azure Data Lake Storage Gen2. The security team requires that the AML workspace's managed identity can only access specific containers in the Data Lake, not the entire storage account. How should this access be configured?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you need to assign the 'Storage Blob Data Reader' role directly to the container resource for the AML workspace managed identity. That gives you least-privilege access to only the required containers, not the whole storage account.
Full Explanation
The correct configuration is to assign the 'Storage Blob Data Reader' role, or an appropriate role, to the AML workspace managed identity scoped specifically to the container resource rather than the storage account. Azure RBAC supports resource-level scoping for storage containers, so this provides least-privilege access to only the required containers. Assigning the role at the storage account level with a condition limiting access to specific containers is not the best choice because, while Azure RBAC conditions can add attribute-based access control conditions on storage role assignments, scoping the role directly to the container resource is simpler and more straightforward for container-level access control. Using a SAS token with container-level scope stored in Azure Key Vault is incorrect because it re-introduces secret management complexity; managed identity authentication is preferred and can be scoped at the container level through RBAC. Configuring Azure Storage firewall rules to allow only the AML workspace's managed identity IP address is incorrect because storage firewall rules control network-level access but cannot restrict an identity to specific containers within the storage account.