Azure / Azure/azure-cli

'az functionapp deployment source config-zip' doesn't support storage accounts where shared keys are disabled

Open
#28,509 3 comments 1 reaction 4 assignees Claimed by @kamperiadis View on GitHub
act-observability-squad Auto-Assign Auto-Resolve bug customer-reported Functions Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

### Describe the bug

We are trying to run `az functionapp deployment source config-zip` on a storage account where [shared key access has been disabled](https://learn.microsoft.com/en-us/azure/storage/common/shared-key-authorization-prevent?tabs=portal) (for security reasons).

However it appears that although the az commands authenticate fine without the key, the function app deployment isn't allowed to proceed.

### Related command

az functionapp deployment source config-zip -g ${{ functionapp.resourcegroup }} -n ${{ functionapp.name }} --src $(System.DefaultWorkingDirectory)/build$(Build.BuildId).zip

### Errors

ERROR: Client-Request-ID=4bc02f4a-db54-11ee-b164-6f6aa11f0696 Retry policy did not allow for a retry: Server-Timestamp=Wed, 06 Mar 2024 00:55:58 GMT, Server-Request-ID=25e9e3cc-901e-005a-3761-6fb010000000, HTTP status code=403, Exception=Key based authentication is not permitted on this storage account. ErrorCode: KeyBasedAuthenticationNotPermittedKeyBasedAuthenticationNotPermittedKey based authentication is not permitted on this storage account.RequestId:25e9e3cc-901e-005a-3761-6fb010000000Time:2024-03-06T00:55:59.0876420Z.

ERROR: Key based authentication is not permitted on this storage account. ErrorCode: KeyBasedAuthenticationNotPermitted
KeyBasedAuthenticationNotPermittedKey based authentication is not permitted on this storage account.
RequestId:25e9e3cc-901e-005a-3761-6fb010000000
Time:2024-03-06T00:55:59.0876420Z

### Issue script & Debug output

I tried to clean up the debug output but there was way too much sensitive data, including the account key, being leaked. I'm happy to share it with any MS representatives - please contact me at the email in my bio

### Expected behavior

The functionapp deploys as per usual

### Environment Summary

[Using AzureCLI@2 task](https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/azure-cli-v2?view=azure-pipelines)

azure-cli 2.57.0 *

core 2.57.0 *
telemetry 1.1.0

Extensions:
azure-devops 1.0.0

Dependencies:
msal 1.26.0
azure-mgmt-resource 23.1.0b2

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.