Support Azure storage backend with OAuth token

[mbrancato]

Feature Request:

Currently the Azure storage backend requires a storage account Key. To bring this in-line with other backends like Google and remove secrets from the Vault config HCL, I’d like Vault to support Azure storage requests authenticated using OAuth Bearer tokens. There is probably good reason to initially only support Managed service identities to again avoid secrets in the HCL.

Vault Config File:

Proposed config may simply omit the accoutKey field.

storage “azure” {
  accountName = “storageaccountname”
  container   = “vault”
}

Expected Behavior:

Vault would be able to obtain an OAuth Bearer token and issue storage API calls directly without an account key.

Actual Behavior:

Currently the account key is required and the MSI is not used.

References:

https://docs.microsoft.com/en-us/rest/api/storageservices/authorize-with-azure-active-directory

[mbrancato]

It looks like this is dependent on an enhancement to the Azure Go SDK.

Azure/azure-sdk-for-go#5226