Skip to content

Use shared key auth for custom blob resource so we don't need RBAC#3719

Merged
thomas11 merged 1 commit into
masterfrom
tkappler/blob-keys
Nov 21, 2024
Merged

Use shared key auth for custom blob resource so we don't need RBAC#3719
thomas11 merged 1 commit into
masterfrom
tkappler/blob-keys

Conversation

@thomas11

@thomas11 thomas11 commented Nov 20, 2024

Copy link
Copy Markdown
Contributor

This PR resolves #3709. Writing a blob failed with 403 Forbidden using the new azcore backend but succeeded using the old backend.

Both backends are based on Azure authentication tokens. However, for blob operations, the old implementation used the token only to get a shared access key for the storage account, then used the key for all other operations. The new implementation attempted to use the auth token directly for blob operations like create.

Using the token directly works if the user/principal has the correct RBAC role, which is "Storage Blob Data Owner" (and possibly others). That's how our CI test suite passed: our service principal had that role assigned.

RBAC is actually the preferred way of accessing Azure storage. But not all users of this provider have the required roles configured, and we cannot regress scenarios that used to work in the v2 major version, so we need to switch to using access keys even in the new backend.

Here is a full CI test suite run for this branch.
Here's the one with autorest enabled.

@thomas11 thomas11 requested review from a team and danielrbradley November 20, 2024 14:40
@github-actions

Copy link
Copy Markdown
Contributor

Does the PR have any schema changes?

Looking good! No breaking changes found.
No new resources/functions.

@codecov

codecov Bot commented Nov 20, 2024

Copy link
Copy Markdown

Codecov Report

Attention: Patch coverage is 67.70833% with 31 lines in your changes missing coverage. Please review.

Project coverage is 58.97%. Comparing base (93fac42) to head (7a9d7f8).
Report is 1 commits behind head on master.

Files with missing lines Patch % Lines
...urces/customresources/custom_storage_azidentity.go 67.36% 24 Missing and 7 partials ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##           master    #3719      +/-   ##
==========================================
+ Coverage   58.88%   58.97%   +0.08%     
==========================================
  Files          74       74              
  Lines       11738    11811      +73     
==========================================
+ Hits         6912     6965      +53     
- Misses       4288     4302      +14     
- Partials      538      544       +6     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.


🚨 Try these New Features:

@pulumi-bot

Copy link
Copy Markdown
Contributor

This PR has been shipped in release v2.73.1.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[v2.72.0] Creating Blob fails with 403

3 participants