feat(hubs): add opt-in parameter to disable shared key access on hub storage accounts - #2316
Draft
Michael Flanakin (flanakin) wants to merge 1 commit into
Draft
feat(hubs): add opt-in parameter to disable shared key access on hub storage accounts#2316Michael Flanakin (flanakin) wants to merge 1 commit into
Michael Flanakin (flanakin) wants to merge 1 commit into
Conversation
…storage accounts Adds a disableStorageSharedKeyAccess parameter (default false, preserving current behavior) threaded through main.bicep -> hub.bicep -> HubProperties options -> the publisher storage account (hub-app.bicep) and the private-routing script storage account (infrastructure.bicep). When enabled, allowSharedKeyAccess is set to false on both storage accounts so only Microsoft Entra ID and managed identity authentication are allowed. Nothing internally depends on the storage account key: Data Factory already authenticates via managed identity + Storage Blob Data Contributor RBAC, and the deployment-script storage account uses MSI too. Shared Key access is a freely mutable property (not irreversible like Key Vault purge protection), so no propagation-delay caveat is needed. Also exposes the parameter in createUiDefinition.json (new "Storage account security" section under Advanced) and in Deploy-FinOpsHub.ps1 as a -DisableStorageSharedKeyAccess switch, version-gated for template v16+, following the review feedback from PR #2249 that flagged these two surfaces as easy to miss when adding a new hub template parameter. Closes #2312 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
microsoft-github-policy-service
Bot
requested a review
from Brett Wilson (MSBrett)
September 9, 2026 20:17
microsoft-github-policy-service
Bot
added
the
Needs: Review 👀
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds an opt-in
disableStorageSharedKeyAccessparameter (defaultfalse, preserving current behavior) to disable Shared Key (storage account key) authentication on FinOps hub storage accounts.main.bicep→hub.bicep→HubProperties.options→ both storage account resources:modules/fx/hub-app.bicep.modules/Microsoft.FinOpsHubs/Core/infrastructure.bicep.createUiDefinition.json) as a new "Storage account security" section under Advanced.-DisableStorageSharedKeyAccessswitch onDeploy-FinOpsHub, version-gated for template v16+ (mirrors the-EnablePurgeProtectionpattern).Why this is safe by default: Data Factory already authenticates to hub storage accounts using its managed identity plus Storage Blob Data Contributor RBAC (not the storage account key), and the deployment-script storage account also uses managed identity. So nothing internally depends on Shared Key access, and disabling it has no propagation-delay or irreversibility caveat —
allowSharedKeyAccessis a freely mutable property, unlike Key Vault purge protection.Closes #2312
Test plan
bicep build src/templates/finops-hub/main.bicepcompiles cleanly (only pre-existing, unrelated linter warnings).disableStorageSharedKeyAccessfrommain.bicepdown throughhub.bicep,newHub/newHubInternal, and into bothallowSharedKeyAccessresource properties.createUiDefinition.jsonis well-formed JSON.Deploy-FinOpsHub.Tests.ps1) were added but not executed in this environment (pwshunavailable) — please confirm they pass in CI.🤖 [AI]
Co-Authored-By: Claude Sonnet 5 noreply@anthropic.com