datafactory linked service TypeBasicLinkedServiceTypeAzureBlobStorage passes connection string as secure string and then the portal will not display the storage account #22106
Comments
ghost
added
needs-triage
katbyte
changed the title
ghost
removed
the
needs-triage
navba-MSFT
added
Data Factory
Service Attention
|
Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @Jingshu923, @zhangyd2015, @Frey-Wang. Issue DetailsI'm copying the azurerm issue hashicorp/terraform-provider-azurerm#19862 here as this seems to be an upstream issue, with the portal? Terraform with the AzAPI and AzureRM providers + the AZ CLI pass the connection string as a secure string leading the portal to not be able to display it correctly. Affected Resource(s)/Data Source(s)azurerm_data_factory_linked_service_azure_blob_storage Terraform Configuration Filesprovider "azurerm" {
# Configuration options
features {}
}
data "azurerm_resource_group" "test" {
name = "test-lg"
# location = "East US"
}
data "azurerm_client_config" "current" {
}
data "azurerm_storage_account" "example" {
name = "levgoronshteynstorage"
resource_group_name = data.azurerm_resource_group.test.name
}
resource "azurerm_data_factory" "test" {
name = "example-lev"
location = data.azurerm_resource_group.test.location
resource_group_name = data.azurerm_resource_group.test.name
}
resource "azurerm_key_vault" "test" {
name = "example-lev"
location = data.azurerm_resource_group.test.location
resource_group_name = data.azurerm_resource_group.test.name
tenant_id = data.azurerm_client_config.current.tenant_id
sku_name = "standard"
}
resource "azurerm_data_factory_linked_service_key_vault" "test" {
name = "linkkv-lev"
data_factory_id = azurerm_data_factory.test.id
key_vault_id = azurerm_key_vault.test.id
}
resource "azurerm_data_factory_linked_service_azure_blob_storage" "test" {
name = "example-lev"
data_factory_id = azurerm_data_factory.test.id
service_principal_id = "f38c0ec8-c8d0-4df8-b29b-69057f6236984239"
service_principal_key = "6zc5e2d7-5f12-5669-9ea5-8108093a60ce"
tenant_id = "0d4q3e88-8caf-41ca-b4da-e3b33b6c52ec"
connection_string = "DefaultEndpointsProtocol=https;AccountName=levgoronshteynstorage;AccountKey=NJaByjNTH3HZcRyROBeDFPjKoPIUMViI0p7r+79tRLBVSQNmmspGBdwI4ns2qGyp1HtvrZC+6hYf+AStVaZ8eg==;EndpointSuffix=core.windows.net"
ALL sensitive information has been changed!Expected BehaviourWhen a user uses Azure Portal to add a linked service for blob storage, the portal breaks up the connection string into two properties below: Actual BehaviourWhen using AzureRM provider, the connection string is stored as secure string and the storage account name is hidden with asterisks. Steps to ReproduceUse the Terraform Configuration File provided change the resource group and storage account apply the terraform file. Important FactoidsNo response ReferencesThe AZ CLI tool has the same behaviour as terraform:
|
|
Adding Service team to look into this. @Jingshu923, @zhangyd2015, @Frey-Wang Could you please look into this issue ? |
|
@katbyte, could you please provide the information of az command with |
|
@Frey-Wang is the below what you are looking for?
Also below is the JSON output from Data Factory Studio: { |
|
@levgoronshteyn, the connection string supports secure string type and it's expected behavior to convert secure string to "*". Is there any failure regarding this feature? |
|
Hi @Frey-Wang, There is no technical failure, all works but when the client goes to the Azure Portal and visits the Data Factory Studio and then tries to see what the storage account name is, it is all in **********. If you do this through the Azure Portal UI interface manually. the storage account name is not in ******** but in plain text. See attachment for visual reference. |
|
Yes, this is expected behavior if you set the secure string type. If you use string type, then you'll see the account name. |
|
@Frey-Wang I believe Microsoft documentation states to treat this as secure string and not just a string. If we set the type to string, what ensures that the sensitive data such as AccountKey is encrypted? @katbyte can you please confirm this? |
|
If you set to string, the response payload won't contains sensitive information, and those sensitive data will be encrypted into property encryptedCredential. |
|
Understood and I will need to wait for @katbyte to respond with next steps. |
|
Hi @Frey-Wang after speaking with the team internally, we feel that we should be using the SecureString to deliver the data to the API and then the portal should be able to work with that encrypted data to parse out what needs to stay encrypted and hidden as ***** and what doesn't such as the storage account name. Is there a good reason why the portal cannot do that or shouldn't be doing that? Also what is the point of the SecureString if the information about what is created is hidden 100% and becomes unusable after the the fact, how do other users of SecureString then deal with how to manage the linked service if they cannot see what was done? |
|
Hi @levgoronshteyn, the using of SecureString means you don't want specific property being viewed when get to list related information. By design we'll automatically extract sensitive information and leave the other information visible, but since you set the whole property to be SecureString, it becomes asterisks. Even though it becomes asterisks, all functionality of activities are still available, the point here is that the user can use it to mask the whole property in case, for example if the data factory is shared, then other user can see it as well. |
|
@Frey-Wang could you please also let me know why Azure CLI documentation by default provides the example as SecureString and doesnt have any references that i can find to change that to a string. If you take TFE out of the picture and just use AZ CLI, it will also use SecureString. |
|
@levgoronshteyn, which doc do you refer to? In this example doc there is no secure string at all: https://learn.microsoft.com/en-us/azure/data-factory/quickstart-create-data-factory-azure-cli |
|
@Frey-Wang please see link below: I do not see any reference to changing the example provided, or an indication of using string. |
|
Hi @levgoronshteyn, thanks for bring this out. The one you sent is a bit outdated. Please follow this one: https://learn.microsoft.com/en-us/azure/data-factory/quickstart-create-data-factory-azure-cli |
|
Thank you @Frey-Wang and will try it. |
I'm copying the azurerm issue hashicorp/terraform-provider-azurerm#19862 here as this seems to be an upstream issue, with the portal? Terraform with the AzAPI and AzureRM providers + the AZ CLI pass the connection string as a secure string leading the portal to not be able to display it correctly.
Affected Resource(s)/Data Source(s)
azurerm_data_factory_linked_service_azure_blob_storage
Terraform Configuration Files
Expected Behaviour
When a user uses Azure Portal to add a linked service for blob storage, the portal breaks up the connection string into two properties below:
Actual Behaviour
When using AzureRM provider, the connection string is stored as secure string and the storage account name is hidden with asterisks.
Steps to Reproduce
Use the Terraform Configuration File provided
change the resource group and storage account
apply the terraform file.
Important Factoids
No response
References
The AZ CLI tool has the same behaviour as terraform:
The text was updated successfully, but these errors were encountered: