Skip to content

[Storage] az storage account create/update: Add --sas-expiration-action to sas policy #31674

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
calvinhzy merged 2 commits into from
Jun 20, 2025
Merged

[Storage] az storage account create/update: Add --sas-expiration-action to sas policy #31674

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1428ac7
add `--sas-expiration-action` to `az storage account create/update`
calvinhzy Jun 19, 2025
91085d0
lint
calvinhzy Jun 20, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 13 additions & 2 deletions src/azure-cli/azure/cli/command_modules/storage/_params.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -199,6 +199,15 @@ def load_arguments(self, _): # pylint: disable=too-many-locals, too-many-statem
help='Expiration period of the SAS Policy assigned to the storage account, DD.HH:MM:SS.'
)

t_expiration_action_type = self.get_models('ExpirationAction', resource_type=ResourceType.MGMT_STORAGE)
sas_expiration_action_type = CLIArgumentType(
arg_type=get_enum_type(t_expiration_action_type),
options_list=['--sas-expiration-action', '--sas-exp-action'],
help="The action to be performed when --sas-expiration-period is violated. The 'Log' action can be used "
"for audit purposes and the 'Block' action can be used to block and deny the usage of SAS tokens that "
"do not adhere to the sas policy expiration period. The default action is 'Log'."
)

key_expiration_period_in_days_type = CLIArgumentType(
options_list=['--key-expiration-period-in-days', '--key-exp-days'], type=int,
help='Expiration period in days of the Key Policy assigned to the storage account'
Expand Down Expand Up @@ -389,7 +398,8 @@ def load_arguments(self, _): # pylint: disable=too-many-locals, too-many-statem
help='The key is the ARM resource identifier of the identity. Only 1 User Assigned identity is '
'permitted here.')
c.argument('key_expiration_period_in_days', key_expiration_period_in_days_type, is_preview=True)
c.argument('sas_expiration_period', sas_expiration_period_type, is_preview=True)
c.argument('sas_expiration_period', sas_expiration_period_type)
c.argument('sas_expiration_action', sas_expiration_action_type)
c.argument('allow_cross_tenant_replication', allow_cross_tenant_replication_type)
c.argument('default_share_permission', default_share_permission_type)
c.argument('enable_nfs_v3', arg_type=get_three_state_flag(),
Expand Down Expand Up @@ -492,7 +502,8 @@ def load_arguments(self, _): # pylint: disable=too-many-locals, too-many-statem
help='The key is the ARM resource identifier of the identity. Only 1 User Assigned identity is '
'permitted here.')
c.argument('key_expiration_period_in_days', key_expiration_period_in_days_type, is_preview=True)
c.argument('sas_expiration_period', sas_expiration_period_type, is_preview=True)
c.argument('sas_expiration_period', sas_expiration_period_type)
c.argument('sas_expiration_action', sas_expiration_action_type)
c.argument('allow_cross_tenant_replication', allow_cross_tenant_replication_type)
c.argument('default_share_permission', default_share_permission_type)
c.argument('immutability_period_since_creation_in_days',
Expand Down
29 changes: 23 additions & 6 deletions src/azure-cli/azure/cli/command_modules/storage/operations/account.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -73,7 +73,7 @@ def create_storage_account(cmd, resource_group_name, account_name, sku=None, loc
min_tls_version=None, allow_shared_key_access=None, edge_zone=None,
identity_type=None, user_identity_id=None,
key_vault_user_identity_id=None, federated_identity_client_id=None,
sas_expiration_period=None, key_expiration_period_in_days=None,
sas_expiration_action=None, sas_expiration_period=None, key_expiration_period_in_days=None,
allow_cross_tenant_replication=None, default_share_permission=None,
enable_nfs_v3=None, subnet=None, vnet_name=None, action='Allow', enable_alw=None,
immutability_period_since_creation_in_days=None, immutability_policy_state=None,
Expand Down Expand Up @@ -265,9 +265,16 @@ def create_storage_account(cmd, resource_group_name, account_name, sku=None, loc
KeyPolicy = cmd.get_models('KeyPolicy')
params.key_policy = KeyPolicy(key_expiration_period_in_days=key_expiration_period_in_days)

if sas_expiration_period:
if sas_expiration_period is not None or sas_expiration_action is not None:
SasPolicy = cmd.get_models('SasPolicy')
params.sas_policy = SasPolicy(sas_expiration_period=sas_expiration_period)
if sas_expiration_period is None and sas_expiration_action is not None:
from azure.cli.core.azclierror import InvalidArgumentValueError
raise InvalidArgumentValueError('--sas-expiration-action can only be specified together with'
' --sas-expiration-period')
if sas_expiration_action is None:
sas_expiration_action = 'Log'
params.sas_policy = SasPolicy(sas_expiration_period=sas_expiration_period,
expiration_action=sas_expiration_action)

if allow_cross_tenant_replication is not None:
params.allow_cross_tenant_replication = allow_cross_tenant_replication
Expand Down Expand Up @@ -387,7 +394,7 @@ def update_storage_account(cmd, instance, sku=None, tags=None, custom_domain=Non
allow_blob_public_access=None, min_tls_version=None, allow_shared_key_access=None,
identity_type=None, user_identity_id=None,
key_vault_user_identity_id=None, federated_identity_client_id=None,
sas_expiration_period=None, key_expiration_period_in_days=None,
sas_expiration_action=None, sas_expiration_period=None, key_expiration_period_in_days=None,
allow_cross_tenant_replication=None, default_share_permission=None,
immutability_period_since_creation_in_days=None, immutability_policy_state=None,
allow_protected_append_writes=None, public_network_access=None, upgrade_to_storagev2=None,
Expand Down Expand Up @@ -646,9 +653,19 @@ def update_storage_account(cmd, instance, sku=None, tags=None, custom_domain=Non
KeyPolicy = cmd.get_models('KeyPolicy')
params.key_policy = KeyPolicy(key_expiration_period_in_days=key_expiration_period_in_days)

if sas_expiration_period:
if sas_expiration_period is not None or sas_expiration_action is not None:
SasPolicy = cmd.get_models('SasPolicy')
params.sas_policy = SasPolicy(sas_expiration_period=sas_expiration_period)
if sas_expiration_period is None and sas_expiration_action is not None:
from azure.cli.core.azclierror import InvalidArgumentValueError
raise InvalidArgumentValueError('--sas-expiration-action can only be specified together '
'with --sas-expiration-period')
if sas_expiration_action is None:
sas_expiration_action = 'Log'
if instance.sas_policy is not None and instance.sas_policy.expiration_action is not None:
sas_expiration_action = instance.sas_policy.expiration_action

params.sas_policy = SasPolicy(sas_expiration_period=sas_expiration_period,
expiration_action=sas_expiration_action)

if allow_cross_tenant_replication is not None:
params.allow_cross_tenant_replication = allow_cross_tenant_replication
Expand Down
Loading
Loading