[Storage] Azure policy fails if --https-only is omitted
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
**Describe the bug**
When creating storage account without `--https-only`:
```
az storage account create -g {} -n {}
```
This command will fail if the built-in Azure policy `Secure transfer to storage accounts should be enabled` is enabled.
**Expected behavior**
The policy shouldn't be triggered, as the Storage Resource Provider will set it to `true` on server's side since API 2019-04-01.
https://github.com/Azure/azure-cli/blob/1174a3350fad3f308688fd37c9dacf12b7afa044/src/azure-cli/azure/cli/command_modules/storage/_params.py#L172-L173
**Root Cause**
If `--https-only` isn't provided, the REST request body sent by Azure CLI doesn't have `supportsHttpsTrafficOnly` property. The request is denied by the policy before reaching the Storage Resource Provider.
**Possible solutions**
Any of these:
**REST spec**: Add `"default": true` to [Storage REST spec](https://github.com/Azure/azure-rest-api-specs/blob/1ce433313012decfc5554f7a4c788156b921b400/specification/storage/resource-manager/Microsoft.Storage/stable/2019-06-01/storage.json#L2254-L2258):
```json
"supportsHttpsTrafficOnly": {
"type": "boolean",
"x-ms-client-name": "EnableHttpsTrafficOnly",
"description": "Allows https traffic only to storage service if sets to true."
},
```
This is what [Keyvault REST spec](https://github.com/Azure/azure-rest-api-specs/blob/1ce433313012decfc5554f7a4c788156b921b400/specification/keyvault/resource-manager/Microsoft.KeyVault/stable/2019-09-01/keyvault.json#L1123-L1127) does:
```json
"enableSoftDelete": {
"type": "boolean",
"default": true,
"description": "Property to specify whether the 'soft delete' functionality is enabled for this key vault. If it's not set to any value(true or false) when creating new key vault, it will be set to true by default. Once it's been set to true value, it can NOT be reverted to false."
},
```
This will make Python SDK have `enable_https_traffic_only: bool=True` thus sending `"supportsHttpsTrafficOnly": true` to ARM. The request will go through the policy.
**Azure CLI**: Set `enable_https_traffic_only` to `True` if `https_only` is `None` and the API is or is newer than API 2019-04-01:
https://github.com/Azure/azure-cli/blob/1174a3350fad3f308688fd37c9dacf12b7afa044/src/azure-cli/azure/cli/command_modules/storage/operations/account.py#L47-L48
**ARM Resource Provider**: Apply server-side default values before evaluating the policy.
Contributor guide
Assessment
This issue has not been assessed yet.