Fix: Authentication Issue: azure.azcollection.azure_rm_storageblob Fails with Disabled Shared Keys

[paronbol]

SUMMARY

PR in order to fix the feature of accessing storage blobs without SAS/key.
It is related with: #1255

ISSUE TYPE

• Bugfix Pull Request

COMPONENT NAME

• azure.azcollection.azure_rm_storageblob
• plugins/module_utils/azure_rm_common.py

ADDITIONAL INFORMATION

Now the access without SAS is supported by environment variables and cli

[Fred-sun]

@paronbol This certainly is not reasonable, you through the client_secret. ClientSecretCredential is not authorized to obtain credentials, cannot manage a blob of resources. Thanks!

[paronbol]

@paronbol This certainly is not reasonable, you through the client_secret. ClientSecretCredential is not authorized to obtain credentials, cannot manage a blob of resources. Thanks!

Hi @Fred-sun, thank you for your support.

I propose to use client_secret.ClientSecretCredential() because is exactly the same method used in the working AzureCLI credentials method for the api rest in get_mgmt_svc_client().
Even is not required to import it.
It is used in:

azure/plugins/module_utils/azure_rm_common.py

Lines 1505 to 1510 in 5191b94

	self.azure_credential_track2 = client_secret.ClientSecretCredential(client_id=self.credentials['client_id'],
	client_secret=self.credentials['secret'],
	tenant_id=self.credentials['tenant'],
	authority=self._adfs_authority_url,
	disable_instance_discovery=self._disable_instance_discovery)

MS Documentation of the ClientSecretCredential Class

Source Code of the class

I tried on a real blob storage and worked. The class is able to obtain credentials to manage blob resources.
But maybe you need the properly configure RBAC right to access through Microsft Entra ID, in my case is a Service Principal.
More info in MS documentation

MS for security recommends to disable SAS and use login or shared key when it is not possible. This is the importance of supporting this feature.

[Fred-sun]

@paronbol What you refer to configuring RBAC access, can you be more specific? I don't quite understand the authorization you said, thank you!

[paronbol]

In order to provide access to Service Principal into a Blob Storage you need to provide data access using a role, e.g. Storage Blob Data Contributor role
More info in MS documentation

[Fred-sun]

@paronbol I assigned the role, but the mistake is still, I am investigating the reason, thank you!

[Ratanavery]

Hi, I am facing an issue when trying to use "auth_source: msi" for downloading the azure storage blob.

Looks like it always defaults to storage account key based access and when i use "auth_mode: login", it asks for msgraph module (where I think it will try to login) but msi doesn`t need to do any login.

PS:
I am able to use the azure key vault without any issues using the MSI.

[Fred-sun]

@Ratanavery Thank for your feedback! Welcome to submit your problems!

[xuzhang3]

@Ratanavery Which value did you set for auth_mode? The default is key