Analysis of ACL Requirements for Azure Data Lake Storage Gen2

Understanding ACL Types

• Access ACLs: Control access to existing objects (files and directories). Permissions apply only to the specific object where they are set.
• Default ACLs: Act as templates that determine the access ACLs for any child items created under a directory. They ensure inheritance of permissions to newly created items.

Requirements Analysis

1. Traverse child items that are created in Folder2:

   • Traverse permission requires Execute permission on directories
   • Since these are "child items that are created" (future items), we need Default ACLs to ensure the traverse permission applies to newly created subdirectories
   • Default - Execute (F) is required

2. Read files that are created in Folder2:

   • Read permission on files requires Read permission
   • Since these are "files that are created" (future files), we need Default ACLs to ensure read permission applies to newly created files
   • Default - Read (D) is required

Why These Options Are Optimal

• Default ACLs are necessary because the requirements specify actions on items "that are created" - indicating future items that don't exist yet
• Access ACLs alone are insufficient because they only apply to existing items and won't automatically propagate to newly created child items
• Principle of least privilege is maintained by only granting the specific Default permissions needed (Read and Execute) without unnecessary permissions

Why Other Options Are Less Suitable

• Access - Execute (C): Only applies to existing items, won't help with traversing newly created child directories
• Access - Read (A): Only applies to existing files, won't help with reading newly created files
• Default - Write (E): Not required by the specified requirements
• Access - Write (B): Not required and violates least privilege

Key Insight

In Azure Data Lake Storage Gen2, permissions are not automatically inherited from parent directories unless Default ACLs are configured. Since the requirements specifically mention items "that are created" (future items), Default ACLs are mandatory to ensure the permissions propagate to newly created child items.