Open kimjamia opened 3 years ago
For now, I would recommend giving read access for the container and the storage account.
Setting Reader on the container and storage account doesnt work. The plugin still tries to list access keys and fails there.
Permission to list keys is included in the following built-in roles:
It's an excessive permission but a possible workaround.
This issue has become stale and is at risk of being closed. The community has 60 days to upvote the issue. If it receives 5 upvotes we will keep it open and take another look. If not, we will close it. To learn more about how we handle issues, please see our documentation.
Happy Coding!
Hi,
I have the same issue.
It comes from the use of the default authentication type (keys) which is marked as legacy.
The AZ Cli has the same behavior, by default, but it can be overridden by the environment variable AZURE_STORAGE_AUTH_MODE or the --auth-mode parameter set to login.
I think the extension should have a parameter or use the same environment variable.
Here is an AZ Cli example:
$ az storage blob list -c stcontainer --account-name staccount
==> Access denied
$ az storage blob list -c stcontainer --account-name staccount --auth-mode login
==> Access granted
@romain-leonard I don't think users should be configuring anything. I open the same thing up in the Azure Storage Explorer app and it works in 5 seconds.
I add my vote to this, our security model at my place of work will never allow the authentication through as it stands, and I am missing the ability to be able to view the contents of our storage containers in VS Code.
Steps to reproduce:
=>
Error: The client '' with object id '' does not have authorization to perform action 'Microsoft.Storage/storage/storageAccounts/listKeys'...
Do the same thing in Azure Storage Explorer and everything works well. User can see the containers under the Storage Account and can browse the container the user was given access to. Other containers report an error as expected.
Expected result: Reader role is sufficient to see the containers in an Storage Account and access to Storage Account keys is not needed.