microsoft / microsoft/GitHub-Copilot-for-Azure
azure-prepare skill: Missing Table Storage recipe and RBAC guidance
- Dominant language
- Python
- Stars
- 250
- Forks
- 204
- Avg merge
- 1d 12h
- Merged PRs (30d)
- 67
Description
## Summary
The `azure-prepare` skill lacks a recipe for Azure Table Storage integration. When building applications that use Table Storage (e.g., a URL shortener storing mappings), the deployment fails with 500 errors because the necessary RBAC role (`Storage Table Data Contributor`) is not assigned.
## Problem
1. **No Table Storage recipe** in `references/services/functions/templates/recipes/`
2. **Base HTTP template only grants Blob access** (`Storage Blob Data Owner`), not Table access
3. **Composition algorithm** does not detect Table Storage usage in code and prompt for recipe application
## Reproduction
1. Use `azure-prepare` skill to create a .NET Azure Functions app
2. Add `Azure.Data.Tables` package and use `TableServiceClient`
3. Follow composition algorithm with HTTP base template (`functions-quickstart-dotnet-azd`)
4. Deploy with `azd up`
5. **Result**: 500 errors - function cannot access Table Storage due to missing RBAC
## Current Workaround
Manually assign `Storage Table Data Contributor` role after deployment:
```bash
az role assignment create \
--assignee "" \
--role "0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3" \
--scope ""
```
## Suggested Fix
### Option A: Add Table Storage Recipe (Preferred)
Create `references/services/functions/templates/recipes/table-storage/` with:
1. **Detection criteria** in `selection.md`:
```
Does it use Table Storage?
Indicators: TableServiceClient, TableClient, Azure.Data.Tables, @azure/data-tables
└─► YES → HTTP base + table-storage recipe
```
2. **Bicep module** to add RBAC:
```bicep
// Storage Table Data Contributor role
resource tableRoleAssignment 'Microsoft.Authorization/roleAssignments@2022-04-01' = {
name: guid(storageAccount.id, functionApp.id, 'Storage Table Data Contributor')
scope: storageAccount
properties: {
roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', '0a9a7e1f-b9d0-4cc4-a60d-0319b160aaa3')
principalId: functionApp.identity.principalId
principalType: 'ServicePrincipal'
}
}
```
### Option B: Update Base Template
Modify base HTTP template to include Table Storage RBAC by default (since Storage Account already exists).
### Option C: Add Validation Check
In `azure-validate` skill, scan code for Table Storage usage and warn if recipe not applied:
```
⚠️ Detected Azure.Data.Tables usage but no Table Storage recipe applied.
Add Storage Table Data Contributor role or apply table-storage recipe.
```
## Impact
- Deployment failures requiring manual RBAC fixes
- Extended debugging time (~20+ minutes for simple deployments)
- Poor developer experience when following skill guidance exactly
## Environment
- Skill: azure-prepare
- Template: functions-quickstart-dotnet-azd
- Runtime: .NET 8 / Azure Functions Flex Consumption
Contributor guide
Assessment
This issue has not been assessed yet.