> For the complete documentation index, see [llms.txt](https://docs.forestall.io/forestall/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.forestall.io/forestall/edges/azure/az_storage_contributor.md).

# AZ\_STORAGE\_CONTRIBUTOR

## Summary

|                            |                                                                      |
| -------------------------- | -------------------------------------------------------------------- |
| **Forestall ACL Alias**    | AZ\_STORAGE\_CONTRIBUTOR                                             |
| **Azure Alias**            | Storage Account Contributor                                          |
| **Affected Object Types**  | Storage Accounts                                                     |
| **Exploitation Certainty** | Certain                                                              |
| **Severity**               | Critical                                                             |
| **Azure RBAC Roles**       | Storage Account Contributor (`17d1049b-9a84-46fb-8f53-869881c3d3ab`) |

**Custom Role Actions:**

* `Microsoft.Storage/storageAccounts/*`

## Description

`AZ_STORAGE_CONTRIBUTOR` represents broad management-plane control over an Azure Storage Account. A principal with this edge can manage account configuration, networking, encryption, lifecycle policies, containers, and access-related settings. In many environments this also leads to storage account key extraction and full data-plane access.

This edge is critical because storage accounts commonly contain application data, logs, backups, deployment artifacts, and files that may hold credentials. Even when direct data-plane permissions are not assigned, management-plane control can enable a pivot through account keys, SAS generation, relaxed network controls, or configuration changes.

Related edges: [AZ\_STORAGE\_LIST\_KEYS](https://docs.forestall.io/fsprotect/edges/azure/az_storage_list_keys), [AZ\_STORAGE\_SAS\_GENERATE](https://docs.forestall.io/fsprotect/edges/azure/az_storage_sas_generate), [AZ\_STORAGE\_BLOB\_DATA\_READER](https://docs.forestall.io/fsprotect/edges/azure/az_storage_blob_data_reader), [AZ\_STORAGE\_BLOB\_DATA\_WRITER](https://docs.forestall.io/fsprotect/edges/azure/az_storage_blob_data_writer).

## Identification

### PowerShell (Az Module)

```powershell
Connect-AzAccount

# List Storage Account Contributor assignments
Get-AzRoleAssignment -RoleDefinitionName "Storage Account Contributor" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

# Include broad roles at storage scopes
Get-AzRoleAssignment |
    Where-Object {
        $_.RoleDefinitionName -in @("Owner", "Contributor", "Storage Account Contributor") -and
        $_.Scope -match "/Microsoft.Storage/storageAccounts/"
    } |
    Select-Object RoleDefinitionName, DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize
```

### Azure Portal

1. Open **Azure Portal** -> target **Storage account**.
2. Go to **Access control (IAM)** -> **Role assignments**.
3. Filter for **Owner**, **Contributor**, **Storage Account Contributor**, and custom roles with `Microsoft.Storage/storageAccounts/*`.
4. Review inherited assignments from the resource group, subscription, and management group.

## Exploitation

These examples are for authorized testing only.

### Modify Storage Account Controls

```powershell
Connect-AzAccount

# Example: inspect the account configuration first
Get-AzStorageAccount -ResourceGroupName "<RGName>" -Name "<AccountName>" |
    Select-Object StorageAccountName, AllowBlobPublicAccess, AllowSharedKeyAccess, PublicNetworkAccess
```

### Pivot to Account Keys

If the assigned role includes key-listing permissions, management-plane control can become full data-plane access. For detailed exploitation steps, see [AZ\_STORAGE\_LIST\_KEYS](https://docs.forestall.io/fsprotect/edges/azure/az_storage_list_keys).

### Generate Delegated Access

Storage account control can also support SAS-based access paths when the required SAS actions are present. For detailed exploitation steps, see [AZ\_STORAGE\_SAS\_GENERATE](https://docs.forestall.io/fsprotect/edges/azure/az_storage_sas_generate).

### Data-Plane Access

Once keys or SAS tokens are obtained, full blob read/write operations become possible. For exploitation details, see [AZ\_STORAGE\_BLOB\_DATA\_READER](https://docs.forestall.io/fsprotect/edges/azure/az_storage_blob_data_reader) and [AZ\_STORAGE\_BLOB\_DATA\_WRITER](https://docs.forestall.io/fsprotect/edges/azure/az_storage_blob_data_writer).

## Mitigation

1. **Reduce broad storage roles** - replace **Storage Account Contributor** with narrower data-plane or management roles where possible.
2. **Use Privileged Identity Management** for temporary elevation to Owner, Contributor, and Storage Account Contributor.
3. **Disable shared key authorization** when workloads support Microsoft Entra authorization.
4. **Use private endpoints and firewall rules** to reduce the impact of exposed keys or SAS tokens.
5. **Monitor inherited assignments** at subscription and resource-group scopes, not only direct storage-account assignments.

## Detection

Use the Azure Portal:

1. Open **Azure Portal** -> target **Storage account** -> **Activity log**.
2. Review write operations against `Microsoft.Storage/storageAccounts/*`, especially networking, key, SAS, access policy, and public access setting changes.
3. Review **Access control (IAM)** for new or unexpected assignments of **Owner**, **Contributor**, or **Storage Account Contributor**.
4. Send Activity Log and Storage diagnostic logs to a SIEM and alert on configuration changes by unusual principals.

## References

* [Storage Account Contributor built-in role](https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#storage-account-contributor)
* [Azure Storage security guide](https://learn.microsoft.com/en-us/azure/storage/blobs/security-recommendations)
* [Authorize access to data in Azure Storage](https://learn.microsoft.com/en-us/azure/storage/common/authorize-data-access)
* [Prevent Shared Key authorization for an Azure Storage account](https://learn.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent)