AZ_STORAGE_CONTRIBUTOR

Copy page

Summary


Forestall ACL Alias	AZ_STORAGE_CONTRIBUTOR
Azure Alias	Storage Account Contributor
Affected Object Types	Storage Accounts
Exploitation Certainty	Certain
Severity	Critical
Azure RBAC Roles	Storage Account Contributor (`17d1049b-9a84-46fb-8f53-869881c3d3ab`)

Custom Role Actions:

Microsoft.Storage/storageAccounts/*

Description

AZ_STORAGE_CONTRIBUTOR represents broad management-plane control over an Azure Storage Account. A principal with this edge can manage account configuration, networking, encryption, lifecycle policies, containers, and access-related settings. In many environments this also leads to storage account key extraction and full data-plane access.

This edge is critical because storage accounts commonly contain application data, logs, backups, deployment artifacts, and files that may hold credentials. Even when direct data-plane permissions are not assigned, management-plane control can enable a pivot through account keys, SAS generation, relaxed network controls, or configuration changes.

Identification

PowerShell (Az Module)

Connect-AzAccount

# List Storage Account Contributor assignments
Get-AzRoleAssignment -RoleDefinitionName "Storage Account Contributor" |
    Select-Object DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

# Include broad roles at storage scopes
Get-AzRoleAssignment |
    Where-Object {
        $_.RoleDefinitionName -in @("Owner", "Contributor", "Storage Account Contributor") -and
        $_.Scope -match "/Microsoft.Storage/storageAccounts/"
    } |
    Select-Object RoleDefinitionName, DisplayName, SignInName, ObjectType, Scope |
    Format-Table -AutoSize

Azure Portal

Open Azure Portal -> target Storage account.
Go to Access control (IAM) -> Role assignments.
Filter for Owner, Contributor, Storage Account Contributor, and custom roles with Microsoft.Storage/storageAccounts/*.
Review inherited assignments from the resource group, subscription, and management group.

Exploitation

These examples are for authorized testing only.

Modify Storage Account Controls

Connect-AzAccount

# Example: inspect the account configuration first
Get-AzStorageAccount -ResourceGroupName "<RGName>" -Name "<AccountName>" |
    Select-Object StorageAccountName, AllowBlobPublicAccess, AllowSharedKeyAccess, PublicNetworkAccess

Pivot to Account Keys

If the assigned role includes key-listing permissions, management-plane control can become full data-plane access. For detailed exploitation steps, see AZ_STORAGE_LIST_KEYS.

Generate Delegated Access

Storage account control can also support SAS-based access paths when the required SAS actions are present. For detailed exploitation steps, see AZ_STORAGE_SAS_GENERATE.

Data-Plane Access

Once keys or SAS tokens are obtained, full blob read/write operations become possible. For exploitation details, see AZ_STORAGE_BLOB_DATA_READER and AZ_STORAGE_BLOB_DATA_WRITER.

Mitigation

Reduce broad storage roles - replace Storage Account Contributor with narrower data-plane or management roles where possible.
Use Privileged Identity Management for temporary elevation to Owner, Contributor, and Storage Account Contributor.
Disable shared key authorization when workloads support Microsoft Entra authorization.
Use private endpoints and firewall rules to reduce the impact of exposed keys or SAS tokens.
Monitor inherited assignments at subscription and resource-group scopes, not only direct storage-account assignments.

Detection

Use the Azure Portal:

Open Azure Portal -> target Storage account -> Activity log.
Review write operations against Microsoft.Storage/storageAccounts/*, especially networking, key, SAS, access policy, and public access setting changes.
Review Access control (IAM) for new or unexpected assignments of Owner, Contributor, or Storage Account Contributor.
Send Activity Log and Storage diagnostic logs to a SIEM and alert on configuration changes by unusual principals.

Ask AI