storage_accounts
Creates, updates, deletes, gets or lists a storage_accounts resource.
Overview
| Name | storage_accounts |
| Type | Resource |
| Id | azure.storage.storage_accounts |
Fields
The following fields are returned by SELECT queries:
- list_account_sas
- list_service_sas
- get_customer_initiated_migration
- list_keys
- check_name_availability
- list_by_resource_group
- list
| Name | Datatype | Description |
|---|---|---|
accountSasToken | string | List SAS credentials of storage account. |
| Name | Datatype | Description |
|---|---|---|
serviceSasToken | string | List service SAS credentials of specific resource. |
| Name | Datatype | Description |
|---|---|---|
id | string | Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. |
name | string | The name of the resource. |
migrationFailedDetailedReason | string | Reason for migration failure. |
migrationFailedReason | string | Error code for migration failure. |
migrationStatus | string | Current status of migration. Known values are: "Invalid", "SubmittedForConversion", "InProgress", "Complete", and "Failed". (Invalid, SubmittedForConversion, InProgress, Complete, Failed) |
systemData | object | Azure Resource Manager metadata containing createdBy and modifiedBy information. |
targetSkuName | string | Target sku name for the account. Required. Known values are: "Standard_LRS", "Standard_GRS", "Standard_RAGRS", "Standard_ZRS", "Premium_LRS", "Premium_ZRS", "Standard_GZRS", "Standard_RAGZRS", "StandardV2_LRS", "StandardV2_GRS", "StandardV2_ZRS", "StandardV2_GZRS", "PremiumV2_LRS", and "PremiumV2_ZRS". (Standard_LRS, Standard_GRS, Standard_RAGRS, Standard_ZRS, Premium_LRS, Premium_ZRS, Standard_GZRS, Standard_RAGZRS, StandardV2_LRS, StandardV2_GRS, StandardV2_ZRS, StandardV2_GZRS, PremiumV2_LRS, PremiumV2_ZRS) |
type | string | The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts". |
| Name | Datatype | Description |
|---|---|---|
keys | array | Gets the list of storage account keys and their properties for the specified storage account. |
| Name | Datatype | Description |
|---|---|---|
message | string | Gets an error message explaining the Reason value in more detail. |
nameAvailable | boolean | Gets a boolean value that indicates whether the name is available for you to use. If true, the name is available. If false, the name has already been taken or is invalid and cannot be used. |
reason | string | Gets the reason that a storage account name could not be used. The Reason element is only returned if NameAvailable is false. Known values are: "AccountNameInvalid" and "AlreadyExists". (AccountNameInvalid, AlreadyExists) |
| Name | Datatype | Description |
|---|---|---|
id | string | Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. |
name | string | The name of the resource. |
accessTier | string | Required for storage accounts where kind = BlobStorage. The access tier is used for billing. The 'Premium' access tier is the default value for premium block blobs storage account type and it cannot be changed for the premium block blobs storage account type. Known values are: "Hot", "Cool", "Premium", "Cold", and "Smart". (Hot, Cool, Premium, Cold, Smart) |
accountMigrationInProgress | boolean | If customer initiated account migration is in progress, the value will be true else it will be null. |
allowBlobPublicAccess | boolean | Allow or disallow public access to all blobs or containers in the storage account. The default interpretation is false for this property. |
allowCrossTenantReplication | boolean | Allow or disallow cross AAD tenant object replication. Set this property to true for new or existing accounts only if object replication policies will involve storage accounts in different AAD tenants. The default interpretation is false for new accounts to follow best security practices by default. |
allowSharedKeyAccess | boolean | Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). The default value is null, which is equivalent to true. |
allowSharedKeyAccessForServices | object | Indicate shared key access properties at service level. |
allowedCopyScope | string | Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet. Known values are: "PrivateLink", "AAD", and "All". (PrivateLink, AAD, All) |
azureFilesIdentityBasedAuthentication | object | Provides the identity based authentication settings for Azure Files. |
blobRestoreStatus | object | Blob restore status. |
creationTime | string (date-time) | Gets the creation date and time of the storage account in UTC. |
customDomain | object | Gets the custom domain the user assigned to this storage account. |
dataCollaborationPolicyProperties | object | Data Collaboration policy for the storage account. |
defaultToOAuthAuthentication | boolean | A boolean flag which indicates whether the default authentication is OAuth or not. The default interpretation is false for this property. |
dnsEndpointType | string | Allows you to specify the type of endpoint. Set this to AzureDNSZone to create a large number of accounts in a single subscription, which creates accounts in an Azure DNS Zone and the endpoint URL will have an alphanumeric DNS Zone identifier. Known values are: "Standard" and "AzureDnsZone". (Standard, AzureDnsZone) |
dualStackEndpointPreference | object | Maintains information about the Internet protocol opted by the user. |
enableExtendedGroups | boolean | Enables extended group support with local users feature, if set to true. |
encryption | object | Encryption settings to be used for server-side encryption for the storage account. |
extendedLocation | object | The extendedLocation of the resource. |
failoverInProgress | boolean | If the failover is in progress, the value will be true, otherwise, it will be null. |
geoPriorityReplicationStatus | object | Status indicating whether Geo Priority Replication is enabled for the account. |
geoReplicationStats | object | Geo Replication Stats. |
identity | object | The identity of the resource. |
immutableStorageWithVersioning | object | The property is immutable and can only be set to true at the account creation time. When set to true, it enables object level immutability for all the containers in the account by default. |
isHnsEnabled | boolean | Account HierarchicalNamespace enabled if sets to true. |
isLocalUserEnabled | boolean | Enables local users feature, if set to true. |
isNfsV3Enabled | boolean | NFS 3.0 protocol support enabled if set to true. |
isSftpEnabled | boolean | Enables Secure File Transfer Protocol, if set to true. |
isSkuConversionBlocked | boolean | This property will be set to true or false on an event of ongoing migration. Default value is null. |
keyCreationTime | object | Storage account keys creation time. |
keyPolicy | object | KeyPolicy assigned to the storage account. |
kind | string | Gets the Kind. Known values are: "Storage", "StorageV2", "BlobStorage", "FileStorage", and "BlockBlobStorage". (Storage, StorageV2, BlobStorage, FileStorage, BlockBlobStorage) |
largeFileSharesState | string | Allow large file shares if sets to Enabled. It cannot be disabled once it is enabled. Known values are: "Disabled" and "Enabled". (Disabled, Enabled) |
lastGeoFailoverTime | string (date-time) | Gets the timestamp of the most recent instance of a failover to the secondary location. Only the most recent timestamp is retained. This element is not returned if there has never been a failover instance. Only available if the accountType is Standard_GRS or Standard_RAGRS. |
location | string | The geo-location where the resource lives. Required. |
minimumTlsVersion | string | Set the minimum TLS version to be permitted on requests to storage. The default interpretation is TLS 1.0 for this property. Minimum TLS version 1.3 version is not supported. Known values are: "TLS1_0", "TLS1_1", "TLS1_2", and "TLS1_3". (TLS1_0, TLS1_1, TLS1_2, TLS1_3) |
networkAcls | object | Network rule set. |
placement | object | Optional. Gets or sets the zonal placement details for the storage account. |
primaryEndpoints | object | Gets the URLs that are used to perform a retrieval of a public blob, queue, or table object. Note that Standard_ZRS and Premium_LRS accounts only return the blob endpoint. |
primaryLocation | string | Gets the location of the primary data center for the storage account. |
privateEndpointConnections | array | List of private endpoint connection associated with the specified storage account. |
provisioningState | string | Gets the status of the storage account at the time the operation was called. Known values are: "Creating", "ResolvingDNS", and "Succeeded". (Creating, ResolvingDNS, Succeeded) |
publicNetworkAccess | string | Allow, disallow, or let Network Security Perimeter configuration to evaluate public network access to Storage Account. Known values are: "Enabled", "Disabled", and "SecuredByPerimeter". (Enabled, Disabled, SecuredByPerimeter) |
routingPreference | object | Maintains information about the network routing choice opted by the user for data transfer. |
sasPolicy | object | SasPolicy assigned to the storage account. |
secondaryEndpoints | object | Gets the URLs that are used to perform a retrieval of a public blob, queue, or table object from the secondary location of the storage account. Only available if the SKU name is Standard_RAGRS. |
secondaryLocation | string | Gets the location of the geo-replicated secondary for the storage account. Only available if the accountType is Standard_GRS or Standard_RAGRS. |
sku | object | Gets the SKU. |
statusOfPrimary | string | Gets the status indicating whether the primary location of the storage account is available or unavailable. Known values are: "available" and "unavailable". (available, unavailable) |
statusOfSecondary | string | Gets the status indicating whether the secondary location of the storage account is available or unavailable. Only available if the SKU name is Standard_GRS or Standard_RAGRS. Known values are: "available" and "unavailable". (available, unavailable) |
storageAccountSkuConversionStatus | object | This property is readOnly and is set by server during asynchronous storage account sku conversion operations. |
supportsHttpsTrafficOnly | boolean | Allows https traffic only to storage service if sets to true. |
systemData | object | Azure Resource Manager metadata containing createdBy and modifiedBy information. |
tags | object | Resource tags. |
type | string | The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts". |
zones | array | The availability zones. |
| Name | Datatype | Description |
|---|---|---|
id | string | Fully qualified resource ID for the resource. Ex - /subscriptions/{subscriptionId}/resourceGroups/{resourceGroupName}/providers/{resourceProviderNamespace}/{resourceType}/{resourceName}. |
name | string | The name of the resource. |
accessTier | string | Required for storage accounts where kind = BlobStorage. The access tier is used for billing. The 'Premium' access tier is the default value for premium block blobs storage account type and it cannot be changed for the premium block blobs storage account type. Known values are: "Hot", "Cool", "Premium", "Cold", and "Smart". (Hot, Cool, Premium, Cold, Smart) |
accountMigrationInProgress | boolean | If customer initiated account migration is in progress, the value will be true else it will be null. |
allowBlobPublicAccess | boolean | Allow or disallow public access to all blobs or containers in the storage account. The default interpretation is false for this property. |
allowCrossTenantReplication | boolean | Allow or disallow cross AAD tenant object replication. Set this property to true for new or existing accounts only if object replication policies will involve storage accounts in different AAD tenants. The default interpretation is false for new accounts to follow best security practices by default. |
allowSharedKeyAccess | boolean | Indicates whether the storage account permits requests to be authorized with the account access key via Shared Key. If false, then all requests, including shared access signatures, must be authorized with Azure Active Directory (Azure AD). The default value is null, which is equivalent to true. |
allowSharedKeyAccessForServices | object | Indicate shared key access properties at service level. |
allowedCopyScope | string | Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the same VNet. Known values are: "PrivateLink", "AAD", and "All". (PrivateLink, AAD, All) |
azureFilesIdentityBasedAuthentication | object | Provides the identity based authentication settings for Azure Files. |
blobRestoreStatus | object | Blob restore status. |
creationTime | string (date-time) | Gets the creation date and time of the storage account in UTC. |
customDomain | object | Gets the custom domain the user assigned to this storage account. |
dataCollaborationPolicyProperties | object | Data Collaboration policy for the storage account. |
defaultToOAuthAuthentication | boolean | A boolean flag which indicates whether the default authentication is OAuth or not. The default interpretation is false for this property. |
dnsEndpointType | string | Allows you to specify the type of endpoint. Set this to AzureDNSZone to create a large number of accounts in a single subscription, which creates accounts in an Azure DNS Zone and the endpoint URL will have an alphanumeric DNS Zone identifier. Known values are: "Standard" and "AzureDnsZone". (Standard, AzureDnsZone) |
dualStackEndpointPreference | object | Maintains information about the Internet protocol opted by the user. |
enableExtendedGroups | boolean | Enables extended group support with local users feature, if set to true. |
encryption | object | Encryption settings to be used for server-side encryption for the storage account. |
extendedLocation | object | The extendedLocation of the resource. |
failoverInProgress | boolean | If the failover is in progress, the value will be true, otherwise, it will be null. |
geoPriorityReplicationStatus | object | Status indicating whether Geo Priority Replication is enabled for the account. |
geoReplicationStats | object | Geo Replication Stats. |
identity | object | The identity of the resource. |
immutableStorageWithVersioning | object | The property is immutable and can only be set to true at the account creation time. When set to true, it enables object level immutability for all the containers in the account by default. |
isHnsEnabled | boolean | Account HierarchicalNamespace enabled if sets to true. |
isLocalUserEnabled | boolean | Enables local users feature, if set to true. |
isNfsV3Enabled | boolean | NFS 3.0 protocol support enabled if set to true. |
isSftpEnabled | boolean | Enables Secure File Transfer Protocol, if set to true. |
isSkuConversionBlocked | boolean | This property will be set to true or false on an event of ongoing migration. Default value is null. |
keyCreationTime | object | Storage account keys creation time. |
keyPolicy | object | KeyPolicy assigned to the storage account. |
kind | string | Gets the Kind. Known values are: "Storage", "StorageV2", "BlobStorage", "FileStorage", and "BlockBlobStorage". (Storage, StorageV2, BlobStorage, FileStorage, BlockBlobStorage) |
largeFileSharesState | string | Allow large file shares if sets to Enabled. It cannot be disabled once it is enabled. Known values are: "Disabled" and "Enabled". (Disabled, Enabled) |
lastGeoFailoverTime | string (date-time) | Gets the timestamp of the most recent instance of a failover to the secondary location. Only the most recent timestamp is retained. This element is not returned if there has never been a failover instance. Only available if the accountType is Standard_GRS or Standard_RAGRS. |
location | string | The geo-location where the resource lives. Required. |
minimumTlsVersion | string | Set the minimum TLS version to be permitted on requests to storage. The default interpretation is TLS 1.0 for this property. Minimum TLS version 1.3 version is not supported. Known values are: "TLS1_0", "TLS1_1", "TLS1_2", and "TLS1_3". (TLS1_0, TLS1_1, TLS1_2, TLS1_3) |
networkAcls | object | Network rule set. |
placement | object | Optional. Gets or sets the zonal placement details for the storage account. |
primaryEndpoints | object | Gets the URLs that are used to perform a retrieval of a public blob, queue, or table object. Note that Standard_ZRS and Premium_LRS accounts only return the blob endpoint. |
primaryLocation | string | Gets the location of the primary data center for the storage account. |
privateEndpointConnections | array | List of private endpoint connection associated with the specified storage account. |
provisioningState | string | Gets the status of the storage account at the time the operation was called. Known values are: "Creating", "ResolvingDNS", and "Succeeded". (Creating, ResolvingDNS, Succeeded) |
publicNetworkAccess | string | Allow, disallow, or let Network Security Perimeter configuration to evaluate public network access to Storage Account. Known values are: "Enabled", "Disabled", and "SecuredByPerimeter". (Enabled, Disabled, SecuredByPerimeter) |
routingPreference | object | Maintains information about the network routing choice opted by the user for data transfer. |
sasPolicy | object | SasPolicy assigned to the storage account. |
secondaryEndpoints | object | Gets the URLs that are used to perform a retrieval of a public blob, queue, or table object from the secondary location of the storage account. Only available if the SKU name is Standard_RAGRS. |
secondaryLocation | string | Gets the location of the geo-replicated secondary for the storage account. Only available if the accountType is Standard_GRS or Standard_RAGRS. |
sku | object | Gets the SKU. |
statusOfPrimary | string | Gets the status indicating whether the primary location of the storage account is available or unavailable. Known values are: "available" and "unavailable". (available, unavailable) |
statusOfSecondary | string | Gets the status indicating whether the secondary location of the storage account is available or unavailable. Only available if the SKU name is Standard_GRS or Standard_RAGRS. Known values are: "available" and "unavailable". (available, unavailable) |
storageAccountSkuConversionStatus | object | This property is readOnly and is set by server during asynchronous storage account sku conversion operations. |
supportsHttpsTrafficOnly | boolean | Allows https traffic only to storage service if sets to true. |
systemData | object | Azure Resource Manager metadata containing createdBy and modifiedBy information. |
tags | object | Resource tags. |
type | string | The type of the resource. E.g. "Microsoft.Compute/virtualMachines" or "Microsoft.Storage/storageAccounts". |
zones | array | The availability zones. |
Methods
The following methods are available for this resource:
| Name | Accessible by | Required Params | Optional Params | Description |
|---|---|---|---|---|
list_account_sas | select | resource_group_name, account_name, subscription_id | List SAS credentials of a storage account. | |
list_service_sas | select | resource_group_name, account_name, subscription_id | List service SAS credentials of a specific resource. | |
get_customer_initiated_migration | select | resource_group_name, account_name, migration_name, subscription_id | Gets the status of the ongoing migration for the specified storage account. | |
list_keys | select | resource_group_name, account_name, subscription_id | $expand | Lists the access keys or Kerberos keys (if active directory enabled) for the specified storage account. |
check_name_availability | select | subscription_id | Checks that the storage account name is valid and is not already in use. | |
list_by_resource_group | select | resource_group_name, subscription_id | Lists all the storage accounts available under the given resource group. Note that storage keys are not returned; use the ListKeys operation for this. | |
list | select | subscription_id | Lists all the storage accounts available under the subscription. Note that storage keys are not returned; use the ListKeys operation for this. | |
create | insert | resource_group_name, account_name, subscription_id, sku, kind, location | Asynchronously creates a new storage account with the specified parameters. If an account is already created and a subsequent create request is issued with different properties, the account properties will be updated. If an account is already created and a subsequent create or update request is issued with the exact same set of properties, the request will succeed. | |
update | update | resource_group_name, account_name, subscription_id | The update operation can be used to update the SKU, encryption, access tier, or tags for a storage account. It can also be used to map the account to a custom domain. Only one custom domain is supported per storage account; the replacement/change of custom domain is not supported. In order to replace an old custom domain, the old value must be cleared/unregistered before a new value can be set. The update of multiple properties is supported. This call does not change the storage keys for the account. If you want to change the storage account keys, use the regenerate keys operation. The location and name of the storage account cannot be changed after creation. | |
delete | delete | resource_group_name, account_name, subscription_id | Deletes a storage account in Microsoft Azure. | |
get_properties | exec | resource_group_name, account_name, subscription_id | $expand | Returns the properties for the specified storage account including but not limited to name, SKU name, location, and account status. The ListKeys operation should be used to retrieve storage keys. |
regenerate_key | exec | resource_group_name, account_name, subscription_id, keyName | Regenerates one of the access keys or Kerberos keys for the specified storage account. | |
failover | exec | resource_group_name, account_name, subscription_id | failoverType | A failover request can be triggered for a storage account in the event a primary endpoint becomes unavailable for any reason. The failover occurs from the storage account's primary cluster to the secondary cluster for RA-GRS accounts. The secondary cluster will become primary after failover and the account is converted to LRS. In the case of a Planned Failover, the primary and secondary clusters are swapped after failover and the account remains geo-replicated. Failover should continue to be used in the event of availability issues as Planned failover is only available while the primary and secondary endpoints are available. The primary use case of a Planned Failover is disaster recovery testing drills. This type of failover is invoked by setting FailoverType parameter to 'Planned'. Learn more about the failover options here- https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance _. |
hierarchical_namespace_migration | exec | resource_group_name, account_name, subscription_id, requestType | Live Migration of storage account to enable Hns. | |
abort_hierarchical_namespace_migration | exec | resource_group_name, account_name, subscription_id | Abort live Migration of storage account to enable Hns. | |
customer_initiated_migration | exec | resource_group_name, account_name, subscription_id, properties | Account Migration request can be triggered for a storage account to change its redundancy level. The migration updates the non-zonal redundant storage account to a zonal redundant account or vice-versa in order to have better reliability and availability. Zone-redundant storage (ZRS) replicates your storage account synchronously across three Azure availability zones in the primary region. | |
restore_blob_ranges | exec | resource_group_name, account_name, subscription_id, timeToRestore, blobRanges | Restore blobs in the specified blob ranges. | |
revoke_user_delegation_keys | exec | resource_group_name, account_name, subscription_id | Revoke user delegation keys. |
Parameters
Parameters can be passed in the WHERE clause of a query. Check the Methods section to see which parameters are required or optional for each operation.
| Name | Datatype | Description |
|---|---|---|
account_name | string | The name of the storage account within the specified resource group. Storage account names must be between 3 and 24 characters in length and use numbers and lower-case letters only. Required. |
migration_name | string | The name of the Storage Account Migration. It should always be 'default'. "default" Required. |
requestType | string | Required. Hierarchical namespace migration type can either be a hierarchical namespace validation request 'HnsOnValidationRequest' or a hydration request 'HnsOnHydrationRequest'. The validation request will validate the migration whereas the hydration request will migrate the account. Required. |
resource_group_name | string | The name of the resource group. The name is case insensitive. Required. |
subscription_id | string | |
$expand | string | May be used to expand the properties within account's properties. By default, data is not included when fetching properties. Currently we only support geoReplicationStats and blobRestoreStatus. Known values are: "geoReplicationStats" and "blobRestoreStatus". Default value is None. |
failoverType | string | The parameter is set to 'Planned' to indicate whether a Planned failover is requested. Known values are "Planned" and None. Default value is "Planned". |
SELECT examples
- list_account_sas
- list_service_sas
- get_customer_initiated_migration
- list_keys
- check_name_availability
- list_by_resource_group
- list
List SAS credentials of a storage account.
SELECT
accountSasToken
FROM azure.storage.storage_accounts
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND account_name = '{{ account_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;
List service SAS credentials of a specific resource.
SELECT
serviceSasToken
FROM azure.storage.storage_accounts
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND account_name = '{{ account_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;
Gets the status of the ongoing migration for the specified storage account.
SELECT
id,
name,
migrationFailedDetailedReason,
migrationFailedReason,
migrationStatus,
systemData,
targetSkuName,
type
FROM azure.storage.storage_accounts
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND account_name = '{{ account_name }}' -- required
AND migration_name = '{{ migration_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;
Lists the access keys or Kerberos keys (if active directory enabled) for the specified storage account.
SELECT
keys
FROM azure.storage.storage_accounts
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND account_name = '{{ account_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
AND $expand = '{{ $expand }}'
;
Checks that the storage account name is valid and is not already in use.
SELECT
message,
nameAvailable,
reason
FROM azure.storage.storage_accounts
WHERE subscription_id = '{{ subscription_id }}' -- required
;
Lists all the storage accounts available under the given resource group. Note that storage keys are not returned; use the ListKeys operation for this.
SELECT
id,
name,
accessTier,
accountMigrationInProgress,
allowBlobPublicAccess,
allowCrossTenantReplication,
allowSharedKeyAccess,
allowSharedKeyAccessForServices,
allowedCopyScope,
azureFilesIdentityBasedAuthentication,
blobRestoreStatus,
creationTime,
customDomain,
dataCollaborationPolicyProperties,
defaultToOAuthAuthentication,
dnsEndpointType,
dualStackEndpointPreference,
enableExtendedGroups,
encryption,
extendedLocation,
failoverInProgress,
geoPriorityReplicationStatus,
geoReplicationStats,
identity,
immutableStorageWithVersioning,
isHnsEnabled,
isLocalUserEnabled,
isNfsV3Enabled,
isSftpEnabled,
isSkuConversionBlocked,
keyCreationTime,
keyPolicy,
kind,
largeFileSharesState,
lastGeoFailoverTime,
location,
minimumTlsVersion,
networkAcls,
placement,
primaryEndpoints,
primaryLocation,
privateEndpointConnections,
provisioningState,
publicNetworkAccess,
routingPreference,
sasPolicy,
secondaryEndpoints,
secondaryLocation,
sku,
statusOfPrimary,
statusOfSecondary,
storageAccountSkuConversionStatus,
supportsHttpsTrafficOnly,
systemData,
tags,
type,
zones
FROM azure.storage.storage_accounts
WHERE resource_group_name = '{{ resource_group_name }}' -- required
AND subscription_id = '{{ subscription_id }}' -- required
;
Lists all the storage accounts available under the subscription. Note that storage keys are not returned; use the ListKeys operation for this.
SELECT
id,
name,
accessTier,
accountMigrationInProgress,
allowBlobPublicAccess,
allowCrossTenantReplication,
allowSharedKeyAccess,
allowSharedKeyAccessForServices,
allowedCopyScope,
azureFilesIdentityBasedAuthentication,
blobRestoreStatus,
creationTime,
customDomain,
dataCollaborationPolicyProperties,
defaultToOAuthAuthentication,
dnsEndpointType,
dualStackEndpointPreference,
enableExtendedGroups,
encryption,
extendedLocation,
failoverInProgress,
geoPriorityReplicationStatus,
geoReplicationStats,
identity,
immutableStorageWithVersioning,
isHnsEnabled,
isLocalUserEnabled,
isNfsV3Enabled,
isSftpEnabled,
isSkuConversionBlocked,
keyCreationTime,
keyPolicy,
kind,
largeFileSharesState,
lastGeoFailoverTime,
location,
minimumTlsVersion,
networkAcls,
placement,
primaryEndpoints,
primaryLocation,
privateEndpointConnections,
provisioningState,
publicNetworkAccess,
routingPreference,
sasPolicy,
secondaryEndpoints,
secondaryLocation,
sku,
statusOfPrimary,
statusOfSecondary,
storageAccountSkuConversionStatus,
supportsHttpsTrafficOnly,
systemData,
tags,
type,
zones
FROM azure.storage.storage_accounts
WHERE subscription_id = '{{ subscription_id }}' -- required
;
INSERT examples
- create
- Manifest
Asynchronously creates a new storage account with the specified parameters. If an account is already created and a subsequent create request is issued with different properties, the account properties will be updated. If an account is already created and a subsequent create or update request is issued with the exact same set of properties, the request will succeed.
INSERT INTO azure.storage.storage_accounts (
sku,
kind,
location,
extendedLocation,
zones,
placement,
tags,
identity,
properties,
resource_group_name,
account_name,
subscription_id
)
SELECT
'{{ sku }}' /* required */,
'{{ kind }}' /* required */,
'{{ location }}' /* required */,
'{{ extendedLocation }}',
'{{ zones }}',
'{{ placement }}',
'{{ tags }}',
'{{ identity }}',
'{{ properties }}',
'{{ resource_group_name }}',
'{{ account_name }}',
'{{ subscription_id }}'
RETURNING
id,
name,
extendedLocation,
identity,
kind,
location,
placement,
properties,
sku,
systemData,
tags,
type,
zones
;
# Description fields are for documentation purposes
- name: storage_accounts
props:
- name: resource_group_name
value: "{{ resource_group_name }}"
description: Required parameter for the storage_accounts resource.
- name: account_name
value: "{{ account_name }}"
description: Required parameter for the storage_accounts resource.
- name: subscription_id
value: "{{ subscription_id }}"
description: Required parameter for the storage_accounts resource.
- name: sku
description: |
Required. Gets or sets the SKU name. Required.
value:
name: "{{ name }}"
tier: "{{ tier }}"
- name: kind
value: "{{ kind }}"
description: |
Required. Indicates the type of storage account. Required. Known values are: "Storage", "StorageV2", "BlobStorage", "FileStorage", and "BlockBlobStorage".
valid_values: ['Storage', 'StorageV2', 'BlobStorage', 'FileStorage', 'BlockBlobStorage']
- name: location
value: "{{ location }}"
description: |
Required. Gets or sets the location of the resource. This will be one of the supported and registered Azure Geo Regions (e.g. West US, East US, Southeast Asia, etc.). The geo region of a resource cannot be changed once it is created, but if an identical geo region is specified on update, the request will succeed. Required.
- name: extendedLocation
description: |
Optional. Set the extended location of the resource. If not set, the storage account will be created in Azure main region. Otherwise it will be created in the specified extended location.
value:
name: "{{ name }}"
type: "{{ type }}"
- name: zones
value:
- "{{ zones }}"
description: |
Optional. Gets or sets the pinned logical availability zone for the storage account.
- name: placement
description: |
Optional. Gets or sets the zonal placement details for the storage account.
value:
zonePlacementPolicy: "{{ zonePlacementPolicy }}"
- name: tags
value: "{{ tags }}"
description: |
Gets or sets a list of key value pairs that describe the resource. These tags can be used for viewing and grouping this resource (across resource groups). A maximum of 15 tags can be provided for a resource. Each tag must have a key with a length no greater than 128 characters and a value with a length no greater than 256 characters.
- name: identity
description: |
The identity of the resource.
value:
principalId: "{{ principalId }}"
tenantId: "{{ tenantId }}"
type: "{{ type }}"
userAssignedIdentities: "{{ userAssignedIdentities }}"
- name: properties
description: |
The parameters used to create the storage account.
value:
allowedCopyScope: "{{ allowedCopyScope }}"
publicNetworkAccess: "{{ publicNetworkAccess }}"
sasPolicy:
sasExpirationPeriod: "{{ sasExpirationPeriod }}"
expirationAction: "{{ expirationAction }}"
keyPolicy:
keyExpirationPeriodInDays: {{ keyExpirationPeriodInDays }}
customDomain:
name: "{{ name }}"
useSubDomainName: {{ useSubDomainName }}
encryption:
services:
blob:
enabled: {{ enabled }}
lastEnabledTime: "{{ lastEnabledTime }}"
keyType: "{{ keyType }}"
file:
enabled: {{ enabled }}
lastEnabledTime: "{{ lastEnabledTime }}"
keyType: "{{ keyType }}"
table:
enabled: {{ enabled }}
lastEnabledTime: "{{ lastEnabledTime }}"
keyType: "{{ keyType }}"
queue:
enabled: {{ enabled }}
lastEnabledTime: "{{ lastEnabledTime }}"
keyType: "{{ keyType }}"
keySource: "{{ keySource }}"
requireInfrastructureEncryption: {{ requireInfrastructureEncryption }}
keyvaultproperties:
keyname: "{{ keyname }}"
keyversion: "{{ keyversion }}"
keyvaulturi: "{{ keyvaulturi }}"
currentVersionedKeyIdentifier: "{{ currentVersionedKeyIdentifier }}"
lastKeyRotationTimestamp: "{{ lastKeyRotationTimestamp }}"
currentVersionedKeyExpirationTimestamp: "{{ currentVersionedKeyExpirationTimestamp }}"
identity:
userAssignedIdentity: "{{ userAssignedIdentity }}"
federatedIdentityClientId: "{{ federatedIdentityClientId }}"
networkAcls:
bypass: "{{ bypass }}"
resourceAccessRules:
- tenantId: "{{ tenantId }}"
resourceId: "{{ resourceId }}"
virtualNetworkRules:
- id: "{{ id }}"
action: "{{ action }}"
state: "{{ state }}"
ipRules:
- value: "{{ value }}"
action: "{{ action }}"
ipv6Rules:
- value: "{{ value }}"
action: "{{ action }}"
defaultAction: "{{ defaultAction }}"
accessTier: "{{ accessTier }}"
azureFilesIdentityBasedAuthentication:
directoryServiceOptions: "{{ directoryServiceOptions }}"
activeDirectoryProperties:
domainName: "{{ domainName }}"
netBiosDomainName: "{{ netBiosDomainName }}"
forestName: "{{ forestName }}"
domainGuid: "{{ domainGuid }}"
domainSid: "{{ domainSid }}"
azureStorageSid: "{{ azureStorageSid }}"
samAccountName: "{{ samAccountName }}"
accountType: "{{ accountType }}"
defaultSharePermission: "{{ defaultSharePermission }}"
smbOAuthSettings:
isSmbOAuthEnabled: {{ isSmbOAuthEnabled }}
supportsHttpsTrafficOnly: {{ supportsHttpsTrafficOnly }}
isSftpEnabled: {{ isSftpEnabled }}
isLocalUserEnabled: {{ isLocalUserEnabled }}
enableExtendedGroups: {{ enableExtendedGroups }}
isHnsEnabled: {{ isHnsEnabled }}
largeFileSharesState: "{{ largeFileSharesState }}"
routingPreference:
routingChoice: "{{ routingChoice }}"
publishMicrosoftEndpoints: {{ publishMicrosoftEndpoints }}
publishInternetEndpoints: {{ publishInternetEndpoints }}
dualStackEndpointPreference:
publishIpv6Endpoint: {{ publishIpv6Endpoint }}
allowBlobPublicAccess: {{ allowBlobPublicAccess }}
minimumTlsVersion: "{{ minimumTlsVersion }}"
allowSharedKeyAccess: {{ allowSharedKeyAccess }}
isNfsV3Enabled: {{ isNfsV3Enabled }}
allowCrossTenantReplication: {{ allowCrossTenantReplication }}
defaultToOAuthAuthentication: {{ defaultToOAuthAuthentication }}
immutableStorageWithVersioning:
enabled: {{ enabled }}
immutabilityPolicy:
immutabilityPeriodSinceCreationInDays: {{ immutabilityPeriodSinceCreationInDays }}
state: "{{ state }}"
allowProtectedAppendWrites: {{ allowProtectedAppendWrites }}
dnsEndpointType: "{{ dnsEndpointType }}"
geoPriorityReplicationStatus:
isBlobEnabled: {{ isBlobEnabled }}
allowSharedKeyAccessForServices:
blob:
enabled: {{ enabled }}
file:
enabled: {{ enabled }}
table:
enabled: {{ enabled }}
queue:
enabled: {{ enabled }}
dataCollaborationPolicyProperties:
allowStorageConnectors: {{ allowStorageConnectors }}
allowStorageDataShares: {{ allowStorageDataShares }}
allowCrossTenantDataSharing: {{ allowCrossTenantDataSharing }}
UPDATE examples
- update
The update operation can be used to update the SKU, encryption, access tier, or tags for a storage account. It can also be used to map the account to a custom domain. Only one custom domain is supported per storage account; the replacement/change of custom domain is not supported. In order to replace an old custom domain, the old value must be cleared/unregistered before a new value can be set. The update of multiple properties is supported. This call does not change the storage keys for the account. If you want to change the storage account keys, use the regenerate keys operation. The location and name of the storage account cannot be changed after creation.
UPDATE azure.storage.storage_accounts
SET
sku = '{{ sku }}',
tags = '{{ tags }}',
identity = '{{ identity }}',
properties = '{{ properties }}',
kind = '{{ kind }}',
zones = '{{ zones }}',
placement = '{{ placement }}'
WHERE
resource_group_name = '{{ resource_group_name }}' --required
AND account_name = '{{ account_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
RETURNING
id,
name,
extendedLocation,
identity,
kind,
location,
placement,
properties,
sku,
systemData,
tags,
type,
zones;
DELETE examples
- delete
Deletes a storage account in Microsoft Azure.
DELETE FROM azure.storage.storage_accounts
WHERE resource_group_name = '{{ resource_group_name }}' --required
AND account_name = '{{ account_name }}' --required
AND subscription_id = '{{ subscription_id }}' --required
;
Lifecycle Methods
- get_properties
- regenerate_key
- failover
- hierarchical_namespace_migration
- abort_hierarchical_namespace_migration
- customer_initiated_migration
- restore_blob_ranges
- revoke_user_delegation_keys
Returns the properties for the specified storage account including but not limited to name, SKU name, location, and account status. The ListKeys operation should be used to retrieve storage keys.
EXEC azure.storage.storage_accounts.get_properties
@resource_group_name='{{ resource_group_name }}' --required,
@account_name='{{ account_name }}' --required,
@subscription_id='{{ subscription_id }}' --required,
@$expand='{{ $expand }}'
;
Regenerates one of the access keys or Kerberos keys for the specified storage account.
EXEC azure.storage.storage_accounts.regenerate_key
@resource_group_name='{{ resource_group_name }}' --required,
@account_name='{{ account_name }}' --required,
@subscription_id='{{ subscription_id }}' --required
@@json=
'{
"keyName": "{{ keyName }}"
}'
;
A failover request can be triggered for a storage account in the event a primary endpoint becomes unavailable for any reason. The failover occurs from the storage account's primary cluster to the secondary cluster for RA-GRS accounts. The secondary cluster will become primary after failover and the account is converted to LRS. In the case of a Planned Failover, the primary and secondary clusters are swapped after failover and the account remains geo-replicated. Failover should continue to be used in the event of availability issues as Planned failover is only available while the primary and secondary endpoints are available. The primary use case of a Planned Failover is disaster recovery testing drills. This type of failover is invoked by setting FailoverType parameter to 'Planned'. Learn more about the failover options here- https://learn.microsoft.com/azure/storage/common/storage-disaster-recovery-guidance _.
EXEC azure.storage.storage_accounts.failover
@resource_group_name='{{ resource_group_name }}' --required,
@account_name='{{ account_name }}' --required,
@subscription_id='{{ subscription_id }}' --required,
@failoverType='{{ failoverType }}'
;
Live Migration of storage account to enable Hns.
EXEC azure.storage.storage_accounts.hierarchical_namespace_migration
@resource_group_name='{{ resource_group_name }}' --required,
@account_name='{{ account_name }}' --required,
@subscription_id='{{ subscription_id }}' --required,
@requestType='{{ requestType }}' --required
;
Abort live Migration of storage account to enable Hns.
EXEC azure.storage.storage_accounts.abort_hierarchical_namespace_migration
@resource_group_name='{{ resource_group_name }}' --required,
@account_name='{{ account_name }}' --required,
@subscription_id='{{ subscription_id }}' --required
;
Account Migration request can be triggered for a storage account to change its redundancy level. The migration updates the non-zonal redundant storage account to a zonal redundant account or vice-versa in order to have better reliability and availability. Zone-redundant storage (ZRS) replicates your storage account synchronously across three Azure availability zones in the primary region.
EXEC azure.storage.storage_accounts.customer_initiated_migration
@resource_group_name='{{ resource_group_name }}' --required,
@account_name='{{ account_name }}' --required,
@subscription_id='{{ subscription_id }}' --required
@@json=
'{
"properties": "{{ properties }}"
}'
;
Restore blobs in the specified blob ranges.
EXEC azure.storage.storage_accounts.restore_blob_ranges
@resource_group_name='{{ resource_group_name }}' --required,
@account_name='{{ account_name }}' --required,
@subscription_id='{{ subscription_id }}' --required
@@json=
'{
"timeToRestore": "{{ timeToRestore }}",
"blobRanges": "{{ blobRanges }}"
}'
;
Revoke user delegation keys.
EXEC azure.storage.storage_accounts.revoke_user_delegation_keys
@resource_group_name='{{ resource_group_name }}' --required,
@account_name='{{ account_name }}' --required,
@subscription_id='{{ subscription_id }}' --required
;