az communication email send shouldn't require an accessKey
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
### Describe the bug
See the context for all my details, but essentially the operation of the `az communication email send` command is incredibly inconsistent with MS documentation and is misleading to administrators on how to authenticate to the service when using azcli.
### Related command
`az communication email send`
### Errors
```
The command failed with an unexpected error. Here is the traceback:
Invalid connection string. You can get the connection string from your resource page in the Azure Portal. The format should be as follows: endpoint=https:///;accesskey=
```
### Issue script & Debug output
```
The command failed with an unexpected error. Here is the traceback:
Invalid connection string. You can get the connection string from your resource page in the Azure Portal. The format should be as follows: endpoint=https:///;accesskey=
Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 664, in execute
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 731, in _run_jobs_serially
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 701, in _run_job
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 334, in __call__
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 112, in handler
File "C:\Users\REDACTED\.azure\cliextensions\communication\azext_communication\manual\_client_factory.py", line 93, in cf_communication_email
client = EmailClient.from_connection_string(connection_string, **args)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\REDACTED\.azure\cliextensions\communication\azure\communication\email\_email_client.py", line 78, in from_connection_string
endpoint, access_key = parse_connection_str(conn_str)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "C:\Users\REDACTED\.azure\cliextensions\communication\azure\communication\email\_shared\utils.py", line 46, in parse_connection_str
raise ValueError(
ValueError: Invalid connection string. You can get the connection string from your resource page in the Azure Portal. The format should be as follows: endpoint=https:///;accesskey=
To check existing issues, please visit: https://github.com/Azure/azure-cli/issues
```
### Expected behavior
See context.
### Environment Summary
I don't have this information on me at present, sorry.
### Additional context
This is driving me crazy and I think this is either a bug or it's working as intended and the MS documentation for the service is **incredibly** misleading, or no one has tested this properly.
I am wanting to use an Azure service principal to send mail with the az cli.
This [documentation](https://learn.microsoft.com/en-us/azure/communication-services/quickstarts/email/send-email?tabs=windows%2Cconnection-string%2Csend-email-and-get-status-async%2Csync-client&pivots=platform-azcli) under the 'Azure CLI' pivot suggests you need to sign in to the Azure CLI.
I know this isn't correct because a connection string with the access key *does* work without needing to login to az cli. Even still, this is something that I want to do to send emails.
Further though, I do not understand for the LIFE OF ME why the connection string is required **with** an accesskey. It's antithetical to the principal of least privileged access.
My service principal doesn't need to make voice calls. Or send SMS. Or do teams messaging. It needs to send email. That's it. I don't want to give the service principal the access key to the entire Azure Communication Services resource.
What I really really really want to encourage the MS developers to do is drop the requirement for the accesskey in the connection string. Sure, you need a connection string to understand what endpoint to work with, but you _don't always_ need the access key.
I also find it confusing under [this](https://learn.microsoft.com/en-us/cli/azure/communication/email?view=azure-cli-latest#az-communication-email-send) documentation how the connection string isn't considered a required parameter. _Technically_ speaking it isn't as there's an environment variable, but this is documentation intended to be read by humans. Educating the human audience on "hey you at least need this parameter OR an envvar" is exactly what should show up under the Required Parameters section.
Contributor guide
Assessment
This issue has not been assessed yet.