-
Notifications
You must be signed in to change notification settings - Fork 236
compose - configure Foundry Hub to use identity-based storage access #5158
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Disable account key and public blob access on hub storage account
Azure Dev CLI Install InstructionsInstall scriptsMacOS/Linux
bash:
pwsh:
WindowsPowerShell install
MSI install
Standalone Binary
MSI
Documentationlearn.microsoft.com documentationtitle: Azure Developer CLI reference
|
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
LGTM
Contributes to #4879.
In certain Azure tenants with stricter policies, deploying an AI project through composability can fail because the storage account created for the Foundry Hub has anonymous blob access and account key access enabled.
This PR disables anonymous blob access and account key access, and configures the Foundry Hub to use Identity-based access to access the storage account.
It also sets the appropriate role assignments for the user, Storage Blob Data Contributor and Storage File Data Privileged Contributor (documentation).