storage_account_sample.py
def add_storage_account(self):
        """
        Creates a storage account then adds the storage account to the vault to manage its keys.
        """
        from azure.mgmt.storage import StorageManagementClient
        from azure.mgmt.storage.models import StorageAccountCreateParameters, Sku, SkuName, Kind
        from msrestazure.azure_active_directory import AADTokenCredentials
        from azure.mgmt.authorization.models import RoleAssignmentCreateParameters
        from azure.keyvault.models import StorageAccountAttributes
        from azure.mgmt.authorization import AuthorizationManagementClient

        self.config.storage_account_name = get_name('sa', '')

        # only user accounts with access to the storage account keys can add a storage account to
        # a vault.  For this reason this sample creates the storage account with a user account
        # authenticated through device login rather than the service principal credentials used
        # in other samples.
        # create the StorageManagementClient with user token credentials
        user_token_creds = AADTokenCredentials(self.get_user_token('https://management.core.windows.net/'))

        print('creating storage account %s'%self.config.storage_account_name)
        storage_mgmt_client = StorageManagementClient(user_token_creds, self.config.subscription_id)

        # create the storage account
        sa_params = StorageAccountCreateParameters(sku=Sku(SkuName.standard_ragrs),
                                                   kind=Kind.storage,
                                                   location=self.config.location)
        sa = storage_mgmt_client.storage_accounts.create(resource_group_name=self.config.group_name,
                                                         account_name=self.config.storage_account_name,
                                                         parameters=sa_params).result()

        # the KeyVault service must be given the "Storage Account Key Operator Service Role" on the
        # storage account before the storage account can be added to the vault

        print('granting Azure Key Vault the "Storage Account Key Operator Service Role" on the storage account')
        # find the role definition for "Storage Account Key Operator Service Role"
        filter_str = 'roleName eq \'Storage Account Key Operator Service Role\''
        authorization_mgmt_client = AuthorizationManagementClient(user_token_creds, self.config.subscription_id)
        role_id = list(authorization_mgmt_client.role_definitions.list(scope='/', filter=filter_str))[0].id

        # create a role assignment granting the key vault service principal this role
        role_params = RoleAssignmentCreateParameters(role_definition_id=role_id,
                                                     # the Azure Key Vault service id
                                                     principal_id='93c27d83-f79b-4cb2-8dd4-4aa716542e74')
        authorization_mgmt_client.role_assignments.create(scope=sa.id,
                                                          role_assignment_name=str(uuid.uuid4()),
                                                          parameters=role_params)

        # since the set_storage_account can only be called by a user account with access to the keys of
        # the storage account, we grant the user that created the storage account access to the vault
        # and add the storage account to the vault
        vault = self.get_sample_vault()

        # grant the user access the vault
        self.grant_access_to_sample_vault(vault, self._user_oid)

        # add the storage account to the vault using the users KeyVaultClient
        print('adding storage acount %s to vault %s' % (self.config.storage_account_name, vault.name))
        attributes = StorageAccountAttributes(enabled=True)
        self.keyvault_user_client.set_storage_account(vault_base_url=self.sample_vault_url,
                                                      storage_account_name=sa.name,
                                                      resource_id=sa.id,
                                                      active_key_name='key1',
                                                      auto_regenerate_key=True,
                                                      regeneration_period='P30D',
                                                      storage_account_attributes=attributes)

        Creates a storage account then adds the storage account to the vault to manage its keys.
        
Creates a storage account then adds the storage account to the vault to manage its keys.
Creates a storage account then adds the storage account to the vault to manage its keys .
def add_storage_account(self):
        from azure.mgmt.storage import StorageManagementClient
        from azure.mgmt.storage.models import StorageAccountCreateParameters, Sku, SkuName, Kind
        from msrestazure.azure_active_directory import AADTokenCredentials
        from azure.mgmt.authorization.models import RoleAssignmentCreateParameters
        from azure.keyvault.models import StorageAccountAttributes
        from azure.mgmt.authorization import AuthorizationManagementClient
        self.config.storage_account_name = get_name('sa', '')
        user_token_creds = AADTokenCredentials(self.get_user_token('https://management.core.windows.net/'))
        print('creating storage account %s'%self.config.storage_account_name)
        storage_mgmt_client = StorageManagementClient(user_token_creds, self.config.subscription_id)
        sa_params = StorageAccountCreateParameters(sku=Sku(SkuName.standard_ragrs),
                                                   kind=Kind.storage,
                                                   location=self.config.location)
        sa = storage_mgmt_client.storage_accounts.create(resource_group_name=self.config.group_name,
                                                         account_name=self.config.storage_account_name,
                                                         parameters=sa_params).result()
        print('granting Azure Key Vault the "Storage Account Key Operator Service Role" on the storage account')
        filter_str = 'roleName eq \'Storage Account Key Operator Service Role\''
        authorization_mgmt_client = AuthorizationManagementClient(user_token_creds, self.config.subscription_id)
        role_id = list(authorization_mgmt_client.role_definitions.list(scope='/', filter=filter_str))[0].id
        role_params = RoleAssignmentCreateParameters(role_definition_id=role_id,
                                                     principal_id='93c27d83-f79b-4cb2-8dd4-4aa716542e74')
        authorization_mgmt_client.role_assignments.create(scope=sa.id,
                                                          role_assignment_name=str(uuid.uuid4()),
                                                          parameters=role_params)
        vault = self.get_sample_vault()
        self.grant_access_to_sample_vault(vault, self._user_oid)
        print('adding storage acount %s to vault %s' % (self.config.storage_account_name, vault.name))
        attributes = StorageAccountAttributes(enabled=True)
        self.keyvault_user_client.set_storage_account(vault_base_url=self.sample_vault_url,
                                                      storage_account_name=sa.name,
                                                      resource_id=sa.id,
                                                      active_key_name='key1',
                                                      auto_regenerate_key=True,
                                                      regeneration_period='P30D',
                                                      storage_account_attributes=attributes)
def add_storage_account ( self ) : from azure . mgmt . storage import StorageManagementClient from azure . mgmt . storage . models import StorageAccountCreateParameters , Sku , SkuName , Kind from msrestazure . azure_active_directory import AADTokenCredentials from azure . mgmt . authorization . models import RoleAssignmentCreateParameters from azure . keyvault . models import StorageAccountAttributes from azure . mgmt . authorization import AuthorizationManagementClient self . config . storage_account_name = get_name ( 'sa' , '' ) user_token_creds = AADTokenCredentials ( self . get_user_token ( 'https://management.core.windows.net/' ) ) print ( 'creating storage account %s' % self . config . storage_account_name ) storage_mgmt_client = StorageManagementClient ( user_token_creds , self . config . subscription_id ) sa_params = StorageAccountCreateParameters ( sku = Sku ( SkuName . standard_ragrs ) , kind = Kind . storage , location = self . config . location ) sa = storage_mgmt_client . storage_accounts . create ( resource_group_name = self . config . group_name , account_name = self . config . storage_account_name , parameters = sa_params ) . result ( ) print ( 'granting Azure Key Vault the "Storage Account Key Operator Service Role" on the storage account' ) filter_str = 'roleName eq \'Storage Account Key Operator Service Role\'' authorization_mgmt_client = AuthorizationManagementClient ( user_token_creds , self . config . subscription_id ) role_id = list ( authorization_mgmt_client . role_definitions . list ( scope = '/' , filter = filter_str ) ) [ 0 ] . id role_params = RoleAssignmentCreateParameters ( role_definition_id = role_id , principal_id = '93c27d83-f79b-4cb2-8dd4-4aa716542e74' ) authorization_mgmt_client . role_assignments . create ( scope = sa . id , role_assignment_name = str ( uuid . uuid4 ( ) ) , parameters = role_params ) vault = self . get_sample_vault ( ) self . grant_access_to_sample_vault ( vault , self . _user_oid ) print ( 'adding storage acount %s to vault %s' % ( self . config . storage_account_name , vault . name ) ) attributes = StorageAccountAttributes ( enabled = True ) self . keyvault_user_client . set_storage_account ( vault_base_url = self . sample_vault_url , storage_account_name = sa . name , resource_id = sa . id , active_key_name = 'key1' , auto_regenerate_key = True , regeneration_period = 'P30D' , storage_account_attributes = attributes )
Creates a storage account then adds the storage account to the vault to manage its keys.
Creates a storage account then adds the storage account to the vault to manage its keys .
"""
        Creates a storage account then adds the storage account to the vault to manage its keys.
        """ # only user accounts with access to the storage account keys can add a storage account to # a vault.  For this reason this sample creates the storage account with a user account # authenticated through device login rather than the service principal credentials used # in other samples. # create the StorageManagementClient with user token credentials # create the storage account # the KeyVault service must be given the "Storage Account Key Operator Service Role" on the # storage account before the storage account can be added to the vault # find the role definition for "Storage Account Key Operator Service Role" # create a role assignment granting the key vault service principal this role # the Azure Key Vault service id # since the set_storage_account can only be called by a user account with access to the keys of # the storage account, we grant the user that created the storage account access to the vault # and add the storage account to the vault # grant the user access the vault # add the storage account to the vault using the users KeyVaultClient
self