Azure / Azure/azure-cli

az communication email send shouldn't require an accessKey

Open
#29,975 5 comments 0 reactions 0 assignees View on GitHub
bug Communication customer-reported Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

### Describe the bug

See the context for all my details, but essentially the operation of the `az communication email send` command is incredibly inconsistent with MS documentation and is misleading to administrators on how to authenticate to the service when using azcli.

### Related command

`az communication email send`

### Errors

```
The command failed with an unexpected error. Here is the traceback:

Invalid connection string. You can get the connection string from your resource page in the Azure Portal. The format should be as follows: endpoint=https:///;accesskey=
```

### Issue script & Debug output

```
The command failed with an unexpected error. Here is the traceback:

Invalid connection string. You can get the connection string from your resource page in the Azure Portal. The format should be as follows: endpoint=https:///;accesskey=

Traceback (most recent call last):

File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke

File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 664, in execute

File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 731, in _run_jobs_serially

File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 701, in _run_job

File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 334, in __call__

File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 112, in handler

File "C:\Users\REDACTED\.azure\cliextensions\communication\azext_communication\manual\_client_factory.py", line 93, in cf_communication_email

client = EmailClient.from_connection_string(connection_string, **args)

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "C:\Users\REDACTED\.azure\cliextensions\communication\azure\communication\email\_email_client.py", line 78, in from_connection_string

endpoint, access_key = parse_connection_str(conn_str)

^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

File "C:\Users\REDACTED\.azure\cliextensions\communication\azure\communication\email\_shared\utils.py", line 46, in parse_connection_str

raise ValueError(

ValueError: Invalid connection string. You can get the connection string from your resource page in the Azure Portal. The format should be as follows: endpoint=https:///;accesskey=

To check existing issues, please visit: https://github.com/Azure/azure-cli/issues
```

### Expected behavior

See context.

### Environment Summary

I don't have this information on me at present, sorry.

### Additional context

This is driving me crazy and I think this is either a bug or it's working as intended and the MS documentation for the service is **incredibly** misleading, or no one has tested this properly.

I am wanting to use an Azure service principal to send mail with the az cli.

This [documentation](https://learn.microsoft.com/en-us/azure/communication-services/quickstarts/email/send-email?tabs=windows%2Cconnection-string%2Csend-email-and-get-status-async%2Csync-client&pivots=platform-azcli) under the 'Azure CLI' pivot suggests you need to sign in to the Azure CLI.

I know this isn't correct because a connection string with the access key *does* work without needing to login to az cli. Even still, this is something that I want to do to send emails.

Further though, I do not understand for the LIFE OF ME why the connection string is required **with** an accesskey. It's antithetical to the principal of least privileged access.

My service principal doesn't need to make voice calls. Or send SMS. Or do teams messaging. It needs to send email. That's it. I don't want to give the service principal the access key to the entire Azure Communication Services resource.

What I really really really want to encourage the MS developers to do is drop the requirement for the accesskey in the connection string. Sure, you need a connection string to understand what endpoint to work with, but you _don't always_ need the access key.

I also find it confusing under [this](https://learn.microsoft.com/en-us/cli/azure/communication/email?view=azure-cli-latest#az-communication-email-send) documentation how the connection string isn't considered a required parameter. _Technically_ speaking it isn't as there's an environment variable, but this is documentation intended to be read by humans. Educating the human audience on "hey you at least need this parameter OR an envvar" is exactly what should show up under the Required Parameters section.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.