Limit Queue ABAC designs to supported data actions

Source facts

Microsoft documents Queue role conditions for supported DataActions and explicitly excludes management Actions through the Storage resource provider. The supported built-in roles include Queue Data Contributor, Message Processor, Message Sender, and Data Reader. The guide says attribute-based rules require a consistent attribute taxonomy and protection of the attributes themselves. Microsoft Learn

Applicability

This applies when a team proposes Azure Queue Storage ABAC conditions and needs to determine whether the intended operation is inside the supported authorization surface.

DSE recommendation

DSE recommends listing each requested operation before writing the condition. Classify the relevant data action, role, resource scope, and attributes, and route account-management requirements to their appropriate authorization review. Assign owners for the attributes used by the condition so their values remain controlled. Keep the policy’s business meaning beside the technical expression and require a separate test for every materially different action it is intended to constrain.

Verification

Use an approved test principal to exercise the selected data operations against the intended resource and an out-of-scope case. Compare the results with the recorded role and condition. Document management permissions separately and avoid claiming that a successful Queue data-action test validates restrictions on storage-account administration.

Official references

• Microsoft: Authorize access to queues using Azure role assignment conditions – Azure Storage | Microsoft Learn