Azure / Azure/azure-cli

[Reference feedback]: AZ Storage Account CLI - Wrong Default listed in Docs

Open
#32,276 1 comment 0 reactions 1 assignee Assigned to @calvinhzy View on GitHub
act-codegen-extensibility-squad Auto-Assign Azure CLI Team customer-reported needs-triage question Storage
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

### Type of issue

Other (describe below)

### Reference command name

az storage account create

### Feedback

The documentation states when the --cross-tenant-replication flag is not set, it defaults to 'false'

> --allow-cross-tenant-replication -r
Allow or disallow cross AAD tenant object replication. Set this property to true for new or existing accounts only if object replication policies will involve storage accounts in different AAD tenants. **_If not specified, the default value is false_** for new accounts to follow best security practices.

However, this is not actually the case, as can be seen by this:

**Command: ** az storage account create --name testnoflagsa --resource-group testrg
**Response:**

Code: RequestDisallowedByPolicy
Message: Resource 'testnoflagsa' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"***","id":"/subscriptions/****/resourceGroups/testrg/providers/Microsoft.Authorization/policyAssignments/***"},"policyDefinition":{"name":"AZAS-DP05A-1: Cross Tenant Replication MUST be disabled","id":"/providers/Microsoft.Management/managementGroups/***/providers/Microsoft.Authorization/policyDefinitions/AZAS-DP05A-1","version":"1.0.0"},"policySetDefinition":{"name":"***","id":"/providers/Microsoft.Management/managementGroups/***/providers/Microsoft.Authorization/policySetDefinitions/***","version":"1.0.0"}}]'.
Target: testnoflagsa
Additional Information:Type: PolicyViolation
Info: {
"evaluationDetails": {
"evaluatedExpressions": [
{
"result": "True",
"expressionKind": "Field",
"expression": "type",
"path": "type",
"expressionValue": "Microsoft.Storage/storageAccounts",
"targetValue": "Microsoft.Storage/storageAccounts",
"operator": "Equals"
},
{
"result": "True",
"expressionKind": "Field",
"expression": "Microsoft.Storage/storageAccounts/allowCrossTenantReplication",
"path": "properties.allowCrossTenantReplication",
"targetValue": "false",
"operator": "Exists"
}
]
},
"policyDefinitionId": "/providers/Microsoft.Management/managementGroups/***/providers/Microsoft.Authorization/policyDefinitions/AZAS-DP05A-1",

### Page URL

https://learn.microsoft.com/en-us/cli/azure/storage/account?view=azure-cli-latest

### Content source URL

https://github.com/MicrosoftDocs/azure-docs-cli/blob/main/docs-ref-autogen/Latest-version/latest/storage/account.yml

### Author

@mikefrobbins

### Document Id

aa8a0403-f0a1-d5a8-14b8-072d4e8af140

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.