Changelogs

• @azbake/ingredient-storage

Overview

The Storage ingredient is a plugin for Bake. When included in a recipe this will create a standard storage account. Whether services blob, file, disk, queue, or table storage are mounted on this resource is not defined in the template, only the logical construct is created.

Usage

This typically would be included as a dependent resource in a recipe. It is possible to setup a stand alone instance, but would not be a typical inclusion. Metrics and diagnostic logs are recorded to Storage Analytics is enabled by default.

Recipe

name: My package
shortName: mypkg
version: 0.0.1
ingredients:
  - "@azbake/ingredient-storage@~0"
parallelRegions: false
resourceGroup: true
variables:
  #"true" or "false" strings.  Defaults to "true" if unspecified.
  blobDiagnosticHourlyMetricsEnabled: "true"
  #Number of days to retain hourly metrics
  blobDiagnosticHourlyMetricsRetentionDays: 12
  #"true" or "false" strings.  Defaults to "true" if unspecified.
  blobDiagnosticMinuteMetricsEnabled: "false"
  #Number of days to retain minute metrics
  blobDiagnosticMinuteMetricsRetentionDays: 10    
    #"true" or "false" strings.  Defaults to "true" if unspecified.
  blobDiagnosticLoggingEnabled: "true"
  #Number of days to retain minute metrics
  blobDiagnosticLoggingRetentionDays: 10    
recipe:
  mypkg-storage:
    properties:
      type: "@azbake/ingredient-storage"
      source: ""
      parameters:
        storageAccountName: "[storage.create_resource_name()]"

| parameter |required|default|description| |---------|--------|-----------|-----------| | storageAccountName | yes | | Name for the storage account resource | | storageKind | no | StorageV2 | Sets the storage account kind | | storageTier | no | Standard | Sets the pricing tier for the storage account | | location | no | Parent resource group geographic location | The location for this resource | | storageAccountType | no | | The type for the storage account See documentation | | storageAccessTier | no | | Selects Hot or Cold tiers for the storage account. See documentation | | container | yes (when source is populated) | | Container to upload the specific source to. Only used when source is specified. | | uploadPath | yes (when source is populated) | | Path within the specified container to upload the source to. Only used when source is specified. | | deploy | no | true | Flag to determine whether or not to deploy the service account. Useful for skipping deployment when just adding context to a container via source | | unzip | no | false | Flag to determine whether or not to unzip and upload if a zip file is encountered in the specified path. | | rgOverride | no | | Specifics a resource group override for the storage account if different from the main resource group of the bake recipe. | | allowBlobPublicAccess | no | false (secure-by-default baseline flip) | Optional. When omitted or false, deploys the account with anonymous public blob access disabled. When true, enables it AND stamps the approved-exception tag hchb-policy-exempt-anon-blob = true. BREAKING CHANGE: As of this version, the baseline is explicit false (property is written); prior versions left the property unwritten (backward compatible with nothing). Recipes relying on the account to maintain its existing anonymous-access state after redeployment must now explicitly set allowBlobPublicAccess: true if that state is true. | | allowPublicNetworkAccess | no | (unset — tag-only stub, property not written) | Optional (Pass-1 stub). When true, stamps the approved-exception tag hchb-policy-exempt-public-network = true; the publicNetworkAccess property itself is not written in this pass. When false or omitted, no tag and no property are written. See Public network access. |

| variable |required|default|description| |---------|--------|-----------|-----------| | blobDiagnosticHourlyMetricsEnabled | no | "true" | Enables recording of hourly metrics to Storage Analytics. Currently accepts "true" / "false" as strings only. | | blobDiagnosticHourlyMetricsRetentionDays | no | 10 | Data retention of hourly metrics in Storage Analytics. | | blobDiagnosticMinuteMetricsEnabled | no | "true" | Enables recording of minute metrics to Storage Analytics. Currently accepts "true" / "false" as strings only. | | blobDiagnosticMinuteMetricsRetentionDays | no | 10 | Data retention of minute metrics in Storage Analytics | | blobDiagnosticLoggingEnabled | no | "true" | Enables recording of diagnostic logs to Storage Analytics. Currently accepts "true" / "false" as strings only. | | blobDiagnosticLoggingRetentionDays | 10 | "true" | Data retention of diagnostic logs in Storage Analytics |

*** Please note that the only value required for creation of this resource is the storageAccountName

Anonymous public blob access

The optional allowBlobPublicAccess parameter controls whether the storage account permits anonymous (unauthenticated) public read access to blob data.

BASELINE FLIP (Breaking Change): As of this version, the secure-by-default baseline has changed:

• Old behavior (Pass-1): Omitting allowBlobPublicAccess left the property unwritten, preserving the account's existing anonymous-access state.
• New behavior (Pass-2): Omitting allowBlobPublicAccess now writes an explicit false, disabling anonymous public blob access by default.

Impact: If your recipe redeploys an existing storage account and relies on maintaining its current anonymous-access state (if true), you must now explicitly set allowBlobPublicAccess: true in the recipe to preserve that state.

• Omitted or false: deploys the account with anonymous public blob access disabled. No exception tag is applied. This is the new secure-by-default baseline.
• true: allows anonymous public blob access to be configured (actual anonymous reads still depend on each container's public-access level) and stamps the approved-exception tag hchb-policy-exempt-anon-blob = true on the account, marking it as a sanctioned exception to the anonymous-blob deny policy. Existing tags (such as Metrics) are preserved.

recipe:
  mypkg-storage:
    properties:
      type: "@azbake/ingredient-storage"
      parameters:
        storageAccountName: "[storage.create_resource_name()]"
        allowBlobPublicAccess: false   # disable anonymous blob access (secure baseline)
        # OR omit allowBlobPublicAccess entirely—it defaults to false

ARM Template Compatibility:

• storage.json uses apiVersion 2020-08-01-preview — ✓ fully supports allowBlobPublicAccess
• storageNetwork.json uses apiVersion 2019-06-01 — ✓ supports allowBlobPublicAccess (GA'd in 2019-04-01)
• storageDatalake.json uses apiVersion 2018-02-01 — ⚠️ predates allowBlobPublicAccess (2019-04-01); the property may be silently ignored by ARM, though the tag still stamps. For datalake accounts (IsHnsEnabled), verify deployment behavior on the target Azure environment before relying on the property being enforced.

Public network access (Pass-1 stub — tag only)

The optional allowPublicNetworkAccess parameter is a forward-compatible stub. In this pass it stamps an approved-exception tag only; it deliberately does not write the storage account's publicNetworkAccess property, so no network behavior changes yet.

• Omitted (default): nothing is written — no tag, no property. Fully backward compatible.
• false: no tag is stamped and no property is written (Pass-1 stub — the publicNetworkAccess property is deferred).
• true: stamps the approved-exception tag hchb-policy-exempt-public-network = true on the account, marking it as a sanctioned exception to the public-network-access deny policy. Existing tags (such as Metrics) are preserved, and this tag co-exists with hchb-policy-exempt-anon-blob (the CDN case).

Deferred enforcement: the boolean will later map to publicNetworkAccess Enabled/Disabled (with private endpoints) in Feature 698027, behind the NetOps private-DNS gate (Feature 701425) — with no further recipe edit required. Setting the property before that DNS enabler exists would sever connectivity, which is why Pass 1 is tag-only.

recipe:
  mypkg-storage:
    properties:
      type: "@azbake/ingredient-storage"
      parameters:
        storageAccountName: "[storage.create_resource_name()]"
        allowPublicNetworkAccess: true   # stamp the exception tag only (no property yet)

Uploading Files to Blob Storage

Files can be uploaded to a blob container during deployment by specifying the source property within the recipe. The source property supports pointing to a direct file via file:/// syntax or pointing to a directory using relative pathing.

NOTE: only blob storage is supported at this time.

name: My package
shortName: mypkg
version: 0.0.1
ingredients:
  - "@azbake/ingredient-storage@~0"
parallelRegions: false
resourceGroup: false
recipe:
  mypkg-storage:
    properties:
      type: "@azbake/ingredient-storage"
      source: "file:///./deploy/deploy.zip" # "./deploy"
      parameters:
        storageAccountName: "[storage.create_resource_name()]"
        container: myContainer
        uploadPath: mypkg/__build_buildNumber__
        deploy: false
        unzip: true

Utilities

Utility classes can be used inside of the bake.yaml file for parameter and source values.

storage class

|function|description| |--------|-----------| |create_resource_name()| Returns the name created for the traffic manager profile when deployed.| |add_delete_policy(name, enabled, daysAfter, options?)| Creates a delete policy rule with optional container/path/tag filters.| |create_policy(...rules)| Creates a management policy schema from one or more rules.| |get_container(account, container, accessLevel?, policy?)| Gets or creates a container and optionally applies a management policy.| |get_storageaccount(resourceGroup, name)| Gets storage account details including endpoints and key.| |get_primary_key(name, rg?)| Gets the primary access key for a storage account.| |get_secondary_key(name, rg?)| Gets the secondary access key for a storage account.| |get_primary_connectionstring(name, rg?)| Gets the primary connection string for a storage account.| |get_secondary_connectionstring(name, rg?)| Gets the secondary connection string for a storage account.|

Function Details

create_resource_name()

Gets the name create for the traffic manager profile deployed.

...
parameters:
    storageAccountName: "[storage.create_resource_name()]"
...

Returns

string

Lifecycle Management Policies

The storage ingredient supports Azure Blob Storage lifecycle management policies for automatic blob deletion based on age. You can apply policies globally, per container, or even per path prefix.

add_delete_policy(name, enabled, daysAfter, options?)

Creates a delete policy rule for blob lifecycle management. Supports global policies (all blobs), container-level, path-level, or tag-based filtering.

| Parameter | Type | Description | |-----------|------|-------------| | name | string | The name of the policy rule (unique within the policy, up to 256 alphanumeric characters) | | enabled | boolean | Whether the rule is enabled | | daysAfter | number | Days after last modification to delete the blob | | options | object | Optional. Filtering options for container/path/tag-based policies | | options.prefixMatch | string[] | Optional. Array of prefix strings (e.g., ["logs/", "data/temp/"]). Each prefix must start with a container name. Up to 10 prefixes per rule. | | options.blobIndexMatch | object[] | Optional. Array of blob index tag conditions { name, op, value } | | options.blobTypes | string[] | Optional. Blob types. Defaults to ["blockBlob"]. Valid: "blockBlob", "appendBlob" |

Example: Global delete policy (all blobs)

// Delete all blockBlobs in the storage account after 90 days
const globalRule = storage.add_delete_policy("delete-all", true, 90);

Example: Container-level TTL

// Delete blobs in 'logs' container after 30 days
const logsRule = storage.add_delete_policy("delete-logs", true, 30, { prefixMatch: ["logs/"] });

// Delete blobs in 'temp' container after 7 days  
const tempRule = storage.add_delete_policy("delete-temp", true, 7, { prefixMatch: ["temp/"] });

// Delete blobs in 'archive' container after 365 days
const archiveRule = storage.add_delete_policy("delete-archive", true, 365, { prefixMatch: ["archive/"] });

// Create combined policy
const policy = storage.create_policy(logsRule, tempRule, archiveRule);

Example: Path-level TTL within a container

// Delete blobs in 'data/temp/' after 7 days, 'data/cache/' after 14 days
const tempRule = storage.add_delete_policy("delete-data-temp", true, 7, { prefixMatch: ["data/temp/"] });
const cacheRule = storage.add_delete_policy("delete-data-cache", true, 14, { prefixMatch: ["data/cache/"] });

const policy = storage.create_policy(tempRule, cacheRule);

Example: Filter by blob index tags

// Delete blobs tagged as "archived" in 'reports' container after 14 days
const rule = storage.add_delete_policy("delete-archived-reports", true, 14, {
  prefixMatch: ["reports/"],
  blobIndexMatch: [{ name: "status", op: "==", value: "archived" }]
});

Example: Include appendBlobs

// Delete both blockBlobs and appendBlobs in 'logs' container after 30 days
const rule = storage.add_delete_policy("delete-all-types", true, 30, { 
  prefixMatch: ["logs/"],
  blobTypes: ["blockBlob", "appendBlob"] 
});

create_policy(...rules)

Creates a management policy schema from one or more policy rules.

| Parameter | Type | Description | |-----------|------|-------------| | rules | ManagementPolicyRule[] | One or more policy rules created by add_delete_policy |

get_container(account, container, accessLevel?, policy?)

Gets or creates a container and optionally applies a management policy. When a policy is provided, it automatically scopes the policy rules to the specified container by adding prefix filters.

| Parameter | Type | Description | |-----------|------|-------------| | account | BakeStorageAccount | Storage account object from get_storageaccount() | | container | string | Container name | | accessLevel | string | Optional. Access level: "container", "blob", or undefined | | policy | ManagementPolicySchema | Optional. Policy to apply (rules will be scoped to this container) |