[AVM Module Issue]: Cannot create a storage account with public network access

[sebassem]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Issue Type?

Bug

Module Name

avm/res/storage/storage-account

(Optional) Module Name if not listed above

No response

(Optional) Module Version

0.8.0

Description

I'm trying the below code where I expect a storage account with public access but I always get it configured as "Enabled from selected virtual networks and IP addresses"

module storageAccount 'br/public:avm/res/storage/storage-account:0.8.0' = { name: 'storageAccount' params: { name: 'stgsbfinops9823' location:'eastus' publicNetworkAccess: 'Enabled' allowBlobPublicAccess: false } }

(Optional) Correlation Id

No response

[github-actions]

@sebassem, thanks for submitting this issue for the avm/res/storage/storage-account module!

A member of the @azure/avm-res-storage-storageaccount-module-owners-bicep or @azure/avm-res-storage-storageaccount-module-contributors-bicep team will review it soon!

[microsoft-github-policy-service]

Warning

Tagging the AVM Core Team (@Azure/avm-core-team-technical-bicep) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

Tip

• To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.
• To avoid this rule being (re)triggered, the ""Needs: Triage 🔍" label must be removed as part of the triage process (when the issue is first responded to)!

Note

This message was posted as per ITA01BCP.

[AlexanderSehr]

Hey @sebassem,
if I'm not mistaken this comes down to the 'secure' default for the firewall settings:

bicep-registry-modules/avm/res/storage/storage-account/main.bicep

Lines 72 to 75 in e91b62b

	param networkAcls networkAclsType = {
	bypass: 'AzureServices'
	defaultAction: 'Deny'
	}

To not have it setup the firewall you'd need to overwrite the default e.g. via

networkAcls: {
  defaultAction: 'Allow'
  bypass: 'AzureServices'
}

Then again, it is a bit cumbersome. It would be better if it is enough to just specify

networkAcls: {}

Hey @fblix, what would you think about making the 2 required parameters of the networkAclsType optional? Unless the RP really doesn't like an empty object this should disable the firewall.

[matebarabas]

Please note that @fblix is OOF until April 2nd. I've pinged him internally and asked him to pick this up when he's back.