Skip to content

[Role] Add long-summary/warning for commands generating credentials #15825

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jiasli merged 11 commits into from
Dec 2, 2020
Merged

[Role] Add long-summary/warning for commands generating credentials #15825

Changes from 3 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
be9b0db
Added long-summary for az ad sp create and az ad sp create-for-rbac
Nov 6, 2020
774c0e6
Added long-summary for az ad sp create and az ad sp create-for-rbac
Nov 6, 2020
34d287c
Added long-summary for az ad sp create and az ad sp create-for-rbac
Nov 6, 2020
db17221
Update src/azure-cli/azure/cli/command_modules/role/_help.py
dbradish-microsoft Nov 12, 2020
add3633
Add long-summary to correct commands
Nov 17, 2020
e008bc6
centralize
Nov 17, 2020
45d3651
Merge branch 'dev' into dbradish_LongDescForAzAdSp
Nov 17, 2020
90408c4
style
Nov 17, 2020
2ed8c45
update
Nov 19, 2020
5c12023
style
Nov 30, 2020
d636b9c
format
Nov 30, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions src/azure-cli/azure/cli/command_modules/role/_help.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -361,6 +361,7 @@
helps['ad sp create'] = """
type: command
short-summary: Create a service principal.
long-summary: When you create a service principal using the `az ad sp create` command, the output includes credentials that you must protect. Be sure that you do not include these credentials in your code or check the credentials into your source control. As an alternative, consider using `managed identities` (https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) to avoid the need to use credentials.

@jiasli jiasli Nov 10, 2020 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ad sp create simply creates a Service Principal from an app and won't show any credentials.

> az ad app create --display-name myapp20201110
  ...
  "appId": "d990dd3e-f5fe-4d3c-bb62-3e568a5b1209",

> az ad sp create --id d990dd3e-f5fe-4d3c-bb62-3e568a5b1209
  ...
  "appId": "d990dd3e-f5fe-4d3c-bb62-3e568a5b1209",

This help message should go to az ad app/sp credential reset instead.

> az ad app credential reset --id d990dd3e-f5fe-4d3c-bb62-3e568a5b1209
{
  "appId": "d990dd3e-f5fe-4d3c-bb62-3e568a5b1209",
  "name": "d990dd3e-f5fe-4d3c-bb62-3e568a5b1209",
  "password": "3f~XjdIB0AML4...",
  "tenant": "54826b22-38d6-4fb2-bad9-b7b93a3e9c5a"
}

examples:
- name: Create a service principal. (autogenerated)
text: az ad sp create --id 00000000-0000-0000-0000-000000000000
Expand All @@ -370,6 +371,7 @@
helps['ad sp create-for-rbac'] = """
type: command
short-summary: Create a service principal and configure its access to Azure resources.
long-summary: When you create a service principal using the `az ad sp create-for-rbac` command, the output includes credentials that you must protect. Be sure that you do not include these credentials in your code or check the credentials into your source control. As an alternative, consider using `managed identities` (https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/overview) to avoid the need to use credentials. By default, `az ad sp create-for-rbac` assigns the `Contributor` role to the service principal at the subscription scope. To reduce your risk of a compromised service principal, assign a more specific role and narrow the scope to a resource or resource group. See https://docs.microsoft.com/en-us/azure/role-based-access-control/role-assignments-steps for more information.
Comment thread
dbradish-microsoft marked this conversation as resolved.
Outdated
parameters:
- name: --name -n
short-summary: A URI to use as the logic name. It doesn't need to exist. If not present, CLI will generate one.
Expand Down