Azure / azure-quickstart-templates

Azure Quickstart Templates
https://aka.ms/azqst
MIT License
14.09k stars 16.14k forks source link

Using MSI auth instead of storage account keys #14063

Open manojsubramani opened 5 months ago

manojsubramani commented 5 months ago

--------------------MESSAGE FROM ADMIN, DELETE BEFORE SUBMITTING----------------------

Sorry to hear you had a bad experience with one of the templates :worried: But, in case you're just asking a question, we're happy to help. You can also check if the question might already have been asked here https://github.com/Azure/azure-quickstart-templates/issues?utf8=%E2%9C%93&q=is%3Aissue

We've created an outline of recommended sections to fill out that will help make this Pull Request awesome!

--------------------MESSAGE FROM ADMIN, DELETE BEFORE SUBMITTING----------------------

azuredeploy.json

Issue Details

The template uses storage keys. Can you please let me know if it is possible to use MSI to authenticate with the storage account? Is there an ARM example? https://github.com/Azure/azure-quickstart-templates/blob/6a9594abdc8c46fb23eb813db558ce89a165ec27/quickstarts/microsoft.servicefabric/service-fabric-secure-cluster-5-node-1-nodetype/azuredeploy.json#L443C1-L444C175

"protectedSettings": { "StorageAccountKey1": "[listKeys(resourceId('Microsoft.Storage/storageAccounts', variables('supportLogStorageAccountName')), '2023-01-01').keys[0].value]", "StorageAccountKey2": "[listkeys(resourceId('Microsoft.Storage/storageAccounts', variables('supportLogStorageAccountName')), '2023-01-01').keys[1].value]" }

Same question for the IaaSDiagnostics extension https://github.com/Azure/azure-quickstart-templates/blob/6a9594abdc8c46fb23eb813db558ce89a165ec27/quickstarts/microsoft.servicefabric/service-fabric-secure-cluster-5-node-1-nodetype/azuredeploy.json#L466C18-L470C20

uchi-mata commented 2 months ago

I'm also interested in this. I configured a Deployment Script with a User-assigned Identity as described here, however, the container instance does not have a UAI assigned and trying to login in the Deployment Script fails. If I try to add a user-assigned identity to the Container Instance, I get this error message:

Error code
MissingIpAddressPorts
Message
The ports in the 'ipAddress' of container group 'd3lw7xe2nv4byazscripts' cannot be empty.