Skip to content

Commit f9785e6

Browse files
committed
replace blob examples with queue examples
1 parent ae319bd commit f9785e6

File tree

2 files changed

+3
-3
lines changed

2 files changed

+3
-3
lines changed

articles/storage/queues/queues-auth-abac-attributes.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -106,7 +106,7 @@ This section lists the Azure Queue storage attributes you can use in your condit
106106
> | **Attribute** | `Microsoft.Storage/storageAccounts:name` |
107107
> | **Attribute source** | Resource |
108108
> | **Attribute type** | String |
109-
> | **Examples** | `@Resource[Microsoft.Storage/storageAccounts:name] StringEquals 'sampleaccount'`<br/>[Example: Read or write blobs in named storage account with specific encryption scope](../blobs\storage-auth-abac-examples.md#example-read-or-write-blobs-in-named-storage-account-with-specific-encryption-scope) |
109+
> | **Examples** | `@Resource[Microsoft.Storage/storageAccounts:name] StringEquals 'sampleaccount'` |
110110
111111
### Queue name
112112

articles/storage/queues/queues-auth-abac.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ Azure ABAC builds on Azure RBAC by adding [role assignment conditions](../../rol
3232
- Environment from which the request originates
3333

3434
The benefits of using role assignment conditions are:
35-
- **Enable finer-grained access to resources** - For example, if you want to grant a user read access to blobs in your storage accounts only if the blobs are tagged as Project=Sierra, you can use conditions on the read action using tags as an attribute.
36-
- **Reduce the number of role assignments you have to create and manage** - You can do this by using a generalized role assignment for a security group, and then restricting the access for individual members of the group using a condition that matches attributes of a principal with attributes of a specific resource being accessed (such as a blob or a container).
35+
- **Enable finer-grained access to resources** - For example, if you want to grant a user access to peek messages in a specific queue, you can use peek messages DataAction and the queue name storage attribute.
36+
- **Reduce the number of role assignments you have to create and manage** - You can do this by using a generalized role assignment for a security group, and then restricting the access for individual members of the group using a condition that matches attributes of a principal with attributes of a specific resource being accessed (such as a queue).
3737
- **Express access control rules in terms of attributes with business meaning** - For example, you can express your conditions using attributes that represent a project name, business application, organization function, or classification level.
3838

3939
The tradeoff of using conditions is that you need a structured and consistent taxonomy when using attributes across your organization. Attributes must be protected to prevent access from being compromised. Also, conditions must be carefully designed and reviewed for their effect.

0 commit comments

Comments
 (0)