microsoft / microsoft/GitHub-Copilot-for-Azure

azure-prepare skill: Missing Table Storage recipe and RBAC guidance

Open
#1,030 1 comment 1 reaction 2 assignees Claimed by @saikoumudi View on GitHub
deploy skills
Dominant language
Python
Stars
250
Forks
204
Avg merge
1d 12h
Merged PRs (30d)
67

Description

## Summary

The `azure-prepare` skill lacks a recipe for Azure Table Storage integration. When building applications that use Table Storage (e.g., a URL shortener storing mappings), the deployment fails with 500 errors because the necessary RBAC role (`Storage Table Data Contributor`) is not assigned.

## Problem

1. **No Table Storage recipe** in `references/services/functions/templates/recipes/`
2. **Base HTTP template only grants Blob access** (`Storage Blob Data Owner`), not Table access
3. **Composition algorithm** does not detect Table Storage usage in code and prompt for recipe application

## Reproduction

1. Use `azure-prepare` skill to create a .NET Azure Functions app
2. Add `Azure.Data.Tables` package and use `TableServiceClient`
3. Follow composition algorithm with HTTP base template (`functions-quickstart-dotnet-azd`)
4. Deploy with `azd up`
5. **Result**: 500 errors - function cannot access Table Storage due to missing RBAC

## Current Workaround

Manually assign `Storage Table Data Contributor` role after deployment:

```bash
az role assignment create \
--assignee "" \
--role "0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3" \
--scope ""
```

## Suggested Fix

### Option A: Add Table Storage Recipe (Preferred)

Create `references/services/functions/templates/recipes/table-storage/` with:

1. **Detection criteria** in `selection.md`:
```
Does it use Table Storage?
Indicators: TableServiceClient, TableClient, Azure.Data.Tables, @azure/data-tables
└─► YES → HTTP base + table-storage recipe
```

2. **Bicep module** to add RBAC:
```bicep
// Storage Table Data Contributor role
resource tableRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(storageAccount.id, functionApp.id, 'Storage Table Data Contributor')
scope: storageAccount
properties: {
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')
principalId: functionApp.identity.principalId
principalType: 'ServicePrincipal'
}
}
```

### Option B: Update Base Template

Modify base HTTP template to include Table Storage RBAC by default (since Storage Account already exists).

### Option C: Add Validation Check

In `azure-validate` skill, scan code for Table Storage usage and warn if recipe not applied:

```
⚠️ Detected Azure.Data.Tables usage but no Table Storage recipe applied.
Add Storage Table Data Contributor role or apply table-storage recipe.
```

## Impact

- Deployment failures requiring manual RBAC fixes
- Extended debugging time (~20+ minutes for simple deployments)
- Poor developer experience when following skill guidance exactly

## Environment

- Skill: azure-prepare
- Template: functions-quickstart-dotnet-azd
- Runtime: .NET 8 / Azure Functions Flex Consumption

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.