Remove dependency on Storage key auth from `deploymentScripts`
- Dominant language
- Bicep
- Stars
- 3.6k
- Forks
- 830
- Avg merge
- 1d 21m
- Merged PRs (30d)
- 79
Description
**Is your feature request related to a problem? Please describe.**
The `Microsoft.Resources/deploymentScripts` resource currently **requires** (at minimum) that a `Microsoft.Storage/storageAccounts` resource be deployed to hold the output from the job that is run. Based on what I have read, `deploymentScripts` does not fully support managed identity authentication to Storage accounts and requires a shared key or SAS token to work. This is problematic in situations where azure security policies no longer allow shared keys on storage accounts, causing any deployment code that uses the `deploymentScripts` resource to break.
**Describe the solution you'd like**
Some use cases of `deploymentScripts` are pretty simple ([sleeping to give managed identities time to propoagate through Entra ID](https://github.com/Azure/bicep/issues/1013)) and users don't have a high priority need to see the output. It would be great to give users the option to execute a script without saving the output (and therefore eliminating the need for a Storage resource).
If the storage resource were considered _optional_ for `deploymentScripts`, this would unblock MSFT teams in the short-term and enable simpler deployment scenarios while adhering to security requirements.
Contributor guide
Assessment
This issue has not been assessed yet.