services / Azure / Storage Blob Service Containers

A blob container is a namespace within an Azure Storage account's blob service that groups and holds blobs, similar to a directory. Containers also carry their own metadata, stored access policies, and immutability/legal-hold protections.

Container-level operations affect every blob grouped under the container at once and control the access-policy and immutability settings that govern them; scope matches the underlying blobs.yml rating for consistency.

Microsoft.​Storage/​storageAccounts/​blobServices/​containers/​setAcl/​action

Sets the container's stored access policy, the named, revocable access-policy definitions that container/blob SAS tokens can reference for their permissions and expiry. An attacker who can write this policy can mint or broaden a policy identifier granting long-lived or overly broad access, which every SAS token scoped to it will then honor, and can do so without minting a new SAS itself, similar in effect to attaching a favorable IAM policy.

Risks

1. Privilege escalation (CRITICAL)
2. Data manipulation (HIGH)

Scope: HIGH

This privilege may grant access to sensitive data from a single organizational function, or allow interruption of a service supporting a single organizational function.

Links