Azure / Azure/bicep-registry-modules
[AVM Module Issue]: unnecessary environment variables set for storage account creating conflict
- Dominant language
- Bicep
- Stars
- 736
- Forks
- 564
- Avg merge
- 3d 15h
- Merged PRs (30d)
- 30
Description
### Check for previous/existing GitHub issues
- [x] I have checked for previous/existing GitHub issues
### Issue Type?
Bug
### Module Name
avm/res/web/site
### (Optional) Module Version
latest
### Description
Description
In the site/config module, when a Storage Account is provided, the module configures four environment variables related to Function App host storage, including:
Storage account name
Blob service URI
Queue service URI
Table service URI
This behavior occurs even when the Function App is configured to use a system-assigned identity for accessing host storage.
Problem Statement
I recently ran into issues related to Function App host storage and reached out to Azure Support. They confirmed that, according to current official Microsoft documentation, when a Function App uses a system-assigned managed identity to connect to host storage, only the storage account name environment variable is required.
The additional service-specific URI environment variables (Blob/Queue/Table) are not required in this scenario and do not appear in Microsoft’s official examples.
Expected Behavior
When a Function App uses a system-assigned identity for host storage access:
Only the storage account name environment variable should be configured.
Explicit service URIs (Blob/Queue/Table) should not be required unless there is a documented requirement.
Aligning the module behavior with official guidance would help avoid unnecessary configuration and potential confusion.
References
Azure Support pointed me to the following official resources:
Microsoft Learn – Connecting to host storage with an identity
https://learn.microsoft.com/en-us/azure/azure-functions/functions-reference?tabs=blob&pivots=programming-language-csharp#connecting-to-host-storage-with-an-identity
Azure Quickstart Template – Function App (system-assigned identity)
https://github.com/Azure/azure-quickstart-templates/blob/master/quickstarts/microsoft.web/function-app-flex-managed-identities/main.bicep
Both references demonstrate usage where only the storage account name is configured when using a system-assigned identity.
### (Optional) Correlation Id
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.