I want to limit my user assigned MSI to be able to read and write tables only in a storage account. When assigning roles on IAM blade in the portal I don't see any table related roles. Why is that? I don't wanna use any SAS.
For now there is no support for accessing Azure Table Storage with Managed Identities.
Supported services are described here:
According to documentation, Azure Table Storage allows you to authenticate only by using account key. So SAS authentication is not solution here either.
Possible solution could be like this:
- Create Azure Key Vault and store account key as a secret Assign
- permission to this key vault to your Managed Identity Use Managed
- Identity to fetch the key from key vault in a runtime
- Use the key to Azure Table Storage
As additional step you can create separate Storage Account to store only tables. With this approach you should be able to restrict access to tables service properly.