Azure / Azure/bicep-types-az

listAccountSas signedPermission does not support 'i' 't' 'f' 'x' 'y'

Open
#2,101 0 comments 0 reactions 0 assignees View on GitHub
Needs: Triage :mag:
Dominant language
TypeScript
Stars
108
Forks
44
Avg merge
18h 53m
Merged PRs (30d)
29

Description

**Bicep version**
Bicep CLI version 0.26.54 (5e20b29b58)

**Describe the bug**
Error `Values for request parameters are invalid: signedPermission` when using the letters 'i' 't' 'f' 'x' 'y'

Immutable storage (i),
Allowed blob index permissions Read/Write (t) and filter (f)
Enables deletion of versions (x)
Permanent delete (y)

**To Reproduce**

```bicep
resource storage_resource 'Microsoft.Storage/storageAccounts@2023-01-01' = {
kind: 'StorageV2'
location: location
name: name
properties: {
accessTier: 'Cool'
allowBlobPublicAccess: false
allowCrossTenantReplication: true
allowSharedKeyAccess: true
defaultToOAuthAuthentication: true
dnsEndpointType: 'Standard'
encryption: {
keySource: 'Microsoft.Storage'
requireInfrastructureEncryption: false
services: {
blob: {
enabled: true
keyType: 'Account'
}
file: {
enabled: true
keyType: 'Account'
}
}
}
minimumTlsVersion: 'TLS1_2'
networkAcls: {
bypass: 'AzureServices'
defaultAction: 'Allow'
ipRules: []
virtualNetworkRules: []
}
publicNetworkAccess: 'Enabled'
supportsHttpsTrafficOnly: true
}
sku: {
name: 'Standard_LRS'
}
}

var sasConfig = {
signedResourceTypes: 'co'
signedPermission: 'rwdlacupitfyx' // remove itfyx and this then works
signedServices: 'bfqt'
signedExpiry: '2034-01-26T12:00:00Z'
signedProtocol: 'https'
keyToSign: 'key2'
}
var sasToken = storage_resource.listAccountSas(storage_resource.apiVersion, sasConfig).accountSasToken
```

**Additional context**
Seems similar to https://github.com/Azure/azure-cli/issues/20452

We are able to generate the SAS token on the web portal and the token has those letters.

Contributor guide

No contributing guide indexed for this repository

Research direction

Reproduce the failure with the Bicep CLI 0.26.54 example and inspect the Microsoft.Storage/storageAccounts listAccountSas type definition, especially signedPermission. Confirm how the supported permission letters are represented and compare them with the portal-generated SAS token. Done means the letters i, t, f, x, and y are accepted and the listAccountSas call succeeds.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, typescript
Domain
cloud, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.