Skip to content

[Modules] StorageAccounts - new feature - sasPolicy #3028

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Mar 24, 2023
Merged

[Modules] StorageAccounts - new feature - sasPolicy #3028

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
8b27d1c
initial commit
Mar 20, 2023
577e8fa
removed expirationAction Parameter because not needed
Mar 21, 2023
c5fb947
updated readme
Mar 21, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions modules/Microsoft.Storage/storageAccounts/.test/common/deploy.test.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -213,6 +213,7 @@ module testDeployment '../../deploy.bicep' = {
}
]
}
sasExpirationPeriod: '180.00:00:00'
systemAssignedIdentity: true
userAssignedIdentities: {
'${nestedDependencies.outputs.managedIdentityResourceId}': {}
Expand Down
10 changes: 10 additions & 0 deletions modules/Microsoft.Storage/storageAccounts/deploy.bicep
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -201,6 +201,12 @@ param cMKKeyVersion string = ''
@description('Optional. The name of the diagnostic setting, if deployed. If left empty, it defaults to "<resourceName>-diagnosticSettings".')
param diagnosticSettingsName string = ''

@description('Optional. The SAS expiration action. Can only be Log.')
param expirationAction string = 'Log'

@description('Optional. The SAS expiration period. DD.HH:MM:SS.')
param sasExpirationPeriod string = ''

var diagnosticsMetrics = [for metric in diagnosticMetricsToEnable: {
category: metric
timeGrain: null
Expand Down Expand Up @@ -286,6 +292,10 @@ resource storageAccount 'Microsoft.Storage/storageAccounts@2022-09-01' = {
} : null
}
accessTier: storageAccountKind != 'Storage' ? storageAccountAccessTier : null
sasPolicy: !empty(sasExpirationPeriod) ? {
expirationAction: expirationAction
sasExpirationPeriod: sasExpirationPeriod
} : null
supportsHttpsTrafficOnly: supportsHttpsTrafficOnly
isHnsEnabled: enableHierarchicalNamespace ? enableHierarchicalNamespace : null
isSftpEnabled: enableSftp
Expand Down
6 changes: 6 additions & 0 deletions modules/Microsoft.Storage/storageAccounts/readme.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,7 @@ This module is used to deploy a storage account, with the ability to deploy 1 or
| `enableDefaultTelemetry` | bool | `True` | | Enable telemetry via a Globally Unique Identifier (GUID). |
| `enableNfsV3` | bool | `False` | | If true, enables NFS 3.0 support for the storage account. Requires enableHierarchicalNamespace to be true. |
| `enableSftp` | bool | `False` | | If true, enables Secure File Transfer Protocol for the storage account. Requires enableHierarchicalNamespace to be true. |
| `expirationAction` | string | `'Log'` | | The SAS expiration action. Can only be Log. |
| `fileServices` | _[fileServices](fileServices/readme.md)_ object | `{object}` | | File service and shares to deploy. |
| `isLocalUserEnabled` | bool | `False` | | Enables local users feature, if set to true. |
| `largeFileSharesState` | string | `'Disabled'` | `[Disabled, Enabled]` | Allow large file shares if sets to 'Enabled'. It cannot be disabled once it is enabled. Only supported on locally redundant and zone redundant file shares. It cannot be set on FileStorage storage accounts (storage accounts for premium file shares). |
Expand All @@ -90,6 +91,7 @@ This module is used to deploy a storage account, with the ability to deploy 1 or
| `queueServices` | _[queueServices](queueServices/readme.md)_ object | `{object}` | | Queue service and queues to create. |
| `requireInfrastructureEncryption` | bool | `True` | | A Boolean indicating whether or not the service applies a secondary layer of encryption with platform managed keys for data at rest. For security reasons, it is recommended to set it to true. |
| `roleAssignments` | array | `[]` | | Array of role assignment objects that contain the 'roleDefinitionIdOrName' and 'principalId' to define RBAC role assignments on this resource. In the roleDefinitionIdOrName attribute, you can provide either the display name of the role definition, or its fully qualified ID in the following format: '/providers/Microsoft.Authorization/roleDefinitions/c2f4ef07-c644-48eb-af81-4b1b4947fb11'. |
| `sasExpirationPeriod` | string | `''` | | The SAS expiration period. DD.HH:MM:SS. |
| `storageAccountKind` | string | `'StorageV2'` | `[BlobStorage, BlockBlobStorage, FileStorage, Storage, StorageV2]` | Type of Storage Account to create. |
| `storageAccountSku` | string | `'Standard_GRS'` | `[Premium_LRS, Premium_ZRS, Standard_GRS, Standard_GZRS, Standard_LRS, Standard_RAGRS, Standard_RAGZRS, Standard_ZRS]` | Storage Account Sku Name. |
| `supportsHttpsTrafficOnly` | bool | `True` | | Allows HTTPS traffic only to storage service if sets to true. |
Expand Down Expand Up @@ -585,6 +587,7 @@ module storageAccounts './Microsoft.Storage/storageAccounts/deploy.bicep' = {
roleDefinitionIdOrName: 'Reader'
}
]
sasExpirationPeriod: '180.00:00:00'
storageAccountSku: 'Standard_LRS'
systemAssignedIdentity: true
tableServices: {
Expand Down Expand Up @@ -820,6 +823,9 @@ module storageAccounts './Microsoft.Storage/storageAccounts/deploy.bicep' = {
}
]
},
"sasExpirationPeriod": {
"value": "180.00:00:00"
},
"storageAccountSku": {
"value": "Standard_LRS"
},
Expand Down