[Reference feedback]: AZ Storage Account CLI - Wrong Default listed in Docs
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
### Type of issue
Other (describe below)
### Reference command name
az storage account create
### Feedback
The documentation states when the --cross-tenant-replication flag is not set, it defaults to 'false'
> --allow-cross-tenant-replication -r
Allow or disallow cross AAD tenant object replication. Set this property to true for new or existing accounts only if object replication policies will involve storage accounts in different AAD tenants. **_If not specified, the default value is false_** for new accounts to follow best security practices.
However, this is not actually the case, as can be seen by this:
**Command: ** az storage account create --name testnoflagsa --resource-group testrg
**Response:**
Code: RequestDisallowedByPolicy
Message: Resource 'testnoflagsa' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"***","id":"/subscriptions/****/resourceGroups/testrg/providers/Microsoft.Authorization/policyAssignments/***"},"policyDefinition":{"name":"AZAS-DP05A-1: Cross Tenant Replication MUST be disabled","id":"/providers/Microsoft.Management/managementGroups/***/providers/Microsoft.Authorization/policyDefinitions/AZAS-DP05A-1","version":"1.0.0"},"policySetDefinition":{"name":"***","id":"/providers/Microsoft.Management/managementGroups/***/providers/Microsoft.Authorization/policySetDefinitions/***","version":"1.0.0"}}]'.
Target: testnoflagsa
Additional Information:Type: PolicyViolation
Info: {
"evaluationDetails": {
"evaluatedExpressions": [
{
"result": "True",
"expressionKind": "Field",
"expression": "type",
"path": "type",
"expressionValue": "Microsoft.Storage/storageAccounts",
"targetValue": "Microsoft.Storage/storageAccounts",
"operator": "Equals"
},
{
"result": "True",
"expressionKind": "Field",
"expression": "Microsoft.Storage/storageAccounts/allowCrossTenantReplication",
"path": "properties.allowCrossTenantReplication",
"targetValue": "false",
"operator": "Exists"
}
]
},
"policyDefinitionId": "/providers/Microsoft.Management/managementGroups/***/providers/Microsoft.Authorization/policyDefinitions/AZAS-DP05A-1",
### Page URL
https://learn.microsoft.com/en-us/cli/azure/storage/account?view=azure-cli-latest
### Content source URL
https://github.com/MicrosoftDocs/azure-docs-cli/blob/main/docs-ref-autogen/Latest-version/latest/storage/account.yml
### Author
@mikefrobbins
### Document Id
aa8a0403-f0a1-d5a8-14b8-072d4e8af140
Contributor guide
Assessment
This issue has not been assessed yet.