Azure / Azure/bicep

Remove dependency on Storage key auth from `deploymentScripts`

Open
#16,604 11 comments 6 reactions 1 assignee Claimed by @SydneyhSmith View on GitHub
Deployment Scripts enhancement
Dominant language
Bicep
Stars
3.6k
Forks
830
Avg merge
1d 21m
Merged PRs (30d)
79

Description

**Is your feature request related to a problem? Please describe.**
The `Microsoft.Resources/deploymentScripts` resource currently **requires** (at minimum) that a `Microsoft.Storage/storageAccounts` resource be deployed to hold the output from the job that is run. Based on what I have read, `deploymentScripts` does not fully support managed identity authentication to Storage accounts and requires a shared key or SAS token to work. This is problematic in situations where azure security policies no longer allow shared keys on storage accounts, causing any deployment code that uses the `deploymentScripts` resource to break.

**Describe the solution you'd like**
Some use cases of `deploymentScripts` are pretty simple ([sleeping to give managed identities time to propoagate through Entra ID](https://github.com/Azure/bicep/issues/1013)) and users don't have a high priority need to see the output. It would be great to give users the option to execute a script without saving the output (and therefore eliminating the need for a Storage resource).

If the storage resource were considered _optional_ for `deploymentScripts`, this would unblock MSFT teams in the short-term and enable simpler deployment scenarios while adhering to security requirements.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.