I have a Azure Analytics Serverless Pool ( where I am the admin)
I also have got access to ADLS Gen-2 through ACL(Access Control List) for specific list of folders [ In the below image - all green boxes represents the access that I have ]

[![enter image description here](https://i.stack.imgur.com/tLjRP.png)](https://i.stack.imgur.com/tLjRP.png)

I am running below SQL statement on Synapse Studio ( Serverless Pool)

SELECT
TOP 100 \*
FROM
OPENROWSET(
BULK 'https://SAFINCAL.dfs.core.windows.net/Container-2/Post-Sale/shipments/2021/\*.parquet',
FORMAT='PARQUET'
) AS [result]

I am getting below error message

Started executing query at Line 1

File 'https://SAFINCAL.dfs.core.windows.net/Container-2/Post-Sale/shipments/2021/\*.parquet' cannot be opened because it does not exist or it is used by another process.
Visit this article to learn more about this error
Total execution time: 00:00:12.269

The article points to <https://learn.microsoft.com/en-us/azure/synapse-analytics/sql/resources-self-help-sql-on-demand#query-fails-because-file-cannot-be-opened>

The solution proposed in the article is get myself "Storage Blob Data Contributor". The question that I have is - if I get myself "Storage Blob Data Contributor" - then I may end up getting access to entire container and that defeats the purpose of ACL access granted at folder level ( green highlighted boxes)

[![enter image description here](https://i.stack.imgur.com/iRvi4.png)](https://i.stack.imgur.com/iRvi4.png)

Is that the right understanding ? If yes - how do I ensure I can still query the data in "shipments" folder from Azure Synapse Analytics Serverless pool without getting myself added as Contributor/Reader for entire container/storage account

Thanks