Disable storage access keys

[tamirkamara]

Resolves #4218

What is being addressed

Storage accounts have the access key option enabled despite us not needing it. Some policies keep changing it and it can create noise in Terraform deployments.

How is this addressed

• Disable access key usage on almost all storage account
• Add a comment where it appears we have an issue

[github-actions]

Unit Test Results

0 tests   0 ✅  0s ⏱️
0 suites  0 💤
0 files    0 ❌

Results for commit 72f5823.

♻️ This comment has been updated with latest results.

[tamirkamara]

/test-extended

[github-actions]

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/12536353417 (with refid 0dd64cf9)

(in response to this comment from @tamirkamara)

[tamirkamara]

/test-extended

[github-actions]

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/12536639727 (with refid 0dd64cf9)

(in response to this comment from @tamirkamara)

[tamirkamara]

/test-extended

[github-actions]

🤖 pr-bot 🤖

🏃 Running extended tests: https://github.com/microsoft/AzureTRE/actions/runs/12536832599 (with refid 0dd64cf9)

(in response to this comment from @tamirkamara)

[tamirkamara]

/test-force-approve

[github-actions]

🤖 pr-bot 🤖

✅ Marking tests as complete (for commit 72f5823)

(in response to this comment from @tamirkamara)

[jonnyry]

Hi @tamirkamara

Just noticed this one still has a storage account key enabled...

AzureTRE/templates/workspaces/base/terraform/storage.tf

Line 1 in e74fbe8

resource "azurerm_storage_account" "stg" {

though it is used in mounting the file storage to the VM.

[tamirkamara]

@jonnyry we have an Azure Files share which will never support AAD so the key has to be enabled there.

[jonnyry]

Ah OK no problem :-) wasn't sure if you could use SAS keys