az storage file list undocumented action change in 2.79

[SysAdminforCoffee]

Describe the bug

In Az CLI version 2.78 and below, running "az storage file list" only called the action: "Microsoft.Storage/storageAccounts/fileServices/fileShares/files/read", which is the allowed DataActions of the following Azure RBAC roles:

Storage File Data Privileged Contributor: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#storage-file-data-privileged-contributor
Storage File Data Privileged Reader: https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#storage-file-data-privileged-reader

However, with Az CLI version 2.79 and up, a new call was added: "Microsoft.Storage/storageAccounts/fileServices/shares/read", which is not included in the before mentioned RBAC roles. This causes a breaking change where the RBAC role no longer has enough permissions to perform the same task.

Related command

az storage file list

Errors

ERROR:
You do not have the required permissions needed to perform this operation.
Depending on your operation, you may need to be assigned one of the following roles:
"Storage Blob Data Owner"
"Storage Blob Data Contributor"
"Storage Blob Data Reader"
"Storage Queue Data Contributor"
"Storage Queue Data Reader"
"Storage Table Data Contributor"
"Storage Table Data Reader"

If you want to use the old authentication method and allow querying for the right account key, please use the "--auth-mode" parameter and "key" value.

Issue script & Debug output

• task: AzureCLI@2
  displayName: 'Validate Deployment'
  inputs:
  azureSubscription: serviceprincipal
  scriptType: 'pscore'
  scriptLocation: 'inlineScript'
  inlineScript: |

        # List files in target directory
        $files = az storage file list `
          --account-name _storageaccountname_ `
          --share-name _sharename_ `
          --path _directoryname`_
          --auth-mode login `
          --backup-intent `
          --exclude-extended-info `
          --output json | ConvertFrom-Json
  
        $files.name
  

Diagnostic Log with Az CLI 2.78:

Diagnostic Log with Az CLI 2.79+:

Expected behavior

A list of files from the script

Environment Summary

Working version:

/usr/bin/az version
{
  "azure-cli": "2.78.0",
  "azure-cli-core": "2.78.0",
  "azure-cli-telemetry": "1.1.0",
  "extensions": {
    "azure-devops": "1.0.2"
  }
}

Not-working version:

/usr/bin/az version
{
  "azure-cli": "2.79.0",
  "azure-cli-core": "2.79.0",
  "azure-cli-telemetry": "1.1.0",
  "extensions": {
    "azure-devops": "1.0.2"
  }
}

Additional context

No response

[azure-client-tools-bot-prd]

Hi @SysAdminforCoffee,

2.79.0 is not the latest Azure CLI(2.81.0).

If you haven't already attempted to do so, please upgrade to the latest Azure CLI version by following https://learn.microsoft.com/en-us/cli/azure/update-azure-cli.

[yonzhan]

Thank you for opening this issue, we will look into it.

[github-actions]

Here are some similar issues that might help you. Please check if they can solve your problem.

• az storage file list not working properly with OAuth since version 2.79 #32503

---

Possible solution (Extracted from existing issue, might be incorrect; please verify carefully)

Solution 1:

Can you try adding the builtin Reader role to the service principal? It should work afterwards.

Reference:

• az storage file list not working properly with OAuth since version 2.79 #32503 (comment)

Solution 2:

Based on the current implementation, listing files is done through the Share level while https://learn.microsoft.com/en-us/azure/role-based-access-control/built-in-roles/storage#storage-file-data-privileged-contributor only works on the list/directory level. Will see if SDK allows this change.

Reference:

• az storage file list not working properly with OAuth since version 2.79 #32503 (comment)

Powered by issue-sentinel