storage table 2020-08-04 ACL operation doesn't support AAD Auth

[magodo]

Azure has announced that storage table supports AAD Auth. It does for CRUD on table resource, while it doesn't for the CRUD on the ACL of the table. The portal still uses the shared key authorization for ACL.

💢  curl -H 'User-Agent: Go/go1.17.6 (amd64-linux) go-autorest/v14.2.1 tombuildsstuff/giovanni/v0.17.0 storage/2020-08-04' -H "$token" -H 'Accept: application/json; charset=utf-8' -H 'X-Ms-Version: 2020-08-04' -X GET "https://acctestacc60jhk.table.core.windows.net/Tables('acctestst220125151027937115')"
{"odata.metadata":"https://acctestacc60jhk.table.core.windows.net/$metadata#Tables/@Element","TableName":"acctestst220125151027937115"}%                                                      

azure/storage/table_aad via 💠 default 
💤  curl -H 'User-Agent: Go/go1.17.6 (amd64-linux) go-autorest/v14.2.1 tombuildsstuff/giovanni/v0.17.0 storage/2020-08-04' -H "$token" -H 'Accept: application/json; charset=utf-8' -H 'X-Ms-Version: 2020-08-04' -X GET "https://acctestacc60jhk.table.core.windows.net/acctestst220125151027937115?comp=acl" 
{"odata.error":{"code":"MediaTypeNotSupported","message":{"lang":"en-US","value":"None of the provided media types are supported\nRequestId:a3e7d729-e002-005c-0cbe-11265e000000\nTime:2022-01-25T07:35:32.4082275Z"}}}% 

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @xgithubtriage.

Issue Details

---

Azure has announced that [storage table supports AAD Auth](https://docs.microsoft.com/en-us/azure/storage/tables/authorize-access-azure-active-directory). It does for CRUD on table resource, while it doesn't for the CRUD on the ACL of the table. The portal still uses the shared key authorization for ACL. ``` 💢 curl -H 'User-Agent: Go/go1.17.6 (amd64-linux) go-autorest/v14.2.1 tombuildsstuff/giovanni/v0.17.0 storage/2020-08-04' -H "$token" -H 'Accept: application/json; charset=utf-8' -H 'X-Ms-Version: 2020-08-04' -X GET "https://acctestacc60jhk.table.core.windows.net/Tables('acctestst220125151027937115')" {"odata.metadata":"https://acctestacc60jhk.table.core.windows.net/$metadata#Tables/@Element","TableName":"acctestst220125151027937115"}% azure/storage/table_aad via 💠 default 💤 curl -H 'User-Agent: Go/go1.17.6 (amd64-linux) go-autorest/v14.2.1 tombuildsstuff/giovanni/v0.17.0 storage/2020-08-04' -H "$token" -H 'Accept: application/json; charset=utf-8' -H 'X-Ms-Version: 2020-08-04' -X GET "https://acctestacc60jhk.table.core.windows.net/acctestst220125151027937115?comp=acl" {"odata.error":{"code":"MediaTypeNotSupported","message":{"lang":"en-US","value":"None of the provided media types are supported\nRequestId:a3e7d729-e002-005c-0cbe-11265e000000\nTime:2022-01-25T07:35:32.4082275Z"}}}% ```

Author:	magodo
Assignees:	-
Labels:	`Storage`, `Service Attention`
Milestone:	-

[magodo]

@xgithubtriage

[marcoboffi]

@xgithubtriage

[blueww]

This is for dataplane. @seanmcc-msft Would you please help to look?

As I know, all B/T/Q/F rest API to manage ACL , request account shared key credentail. The limitation is not only for table.

[rgrace-puck]

Is there any update on this? Official Microsoft documentation doesn't recommend using shared access keys for production environments.

See https://learn.microsoft.com/en-us/azure/storage/blobs/authorize-access-azure-active-directory#access-data-with-a-microsoft-entra-account

Authorization with Shared Key is not recommended as it may be less secure. For optimal security, disable authorization via Shared Key for your storage account, as described in Prevent Shared Key authorization for an Azure Storage account.

Use of access keys and connection strings should be limited to initial proof of concept apps or development prototypes that don't access production or sensitive data. Otherwise, the token-based authentication classes available in the Azure SDK should always be preferred when authenticating to Azure resources.

This issue seems to be blocking https://github.com/hashicorp/terraform-provider-azurerm/issues/15083 which means anyone using Terraform to manage storage accounts needs to enable shared access keys.