@azbake/ingredient-storage

Changelogs

• @azbake/ingredient-storage

Overview

The Storage ingredient is a plugin for Bake. When included in a recipe this will create a standard storage account. Whether services blob, file, disk, queue, or table storage are mounted on this resource is not defined in the template, only the logical construct is created.

Usage

This typically would be included as a dependent resource in a recipe. It is possible to setup a stand alone instance, but would not be a typical inclusion. Metrics and diagnostic logs are recorded to Storage Analytics is enabled by default.

Recipe

name: My package
shortName: mypkg
version: 0.0.1
ingredients:
  - "@azbake/ingredient-storage@~0"
parallelRegions: false
resourceGroup: true
variables:
  #"true" or "false" strings.  Defaults to "true" if unspecified.
  blobDiagnosticHourlyMetricsEnabled: "true"
  #Number of days to retain hourly metrics
  blobDiagnosticHourlyMetricsRetentionDays: 12
  #"true" or "false" strings.  Defaults to "true" if unspecified.
  blobDiagnosticMinuteMetricsEnabled: "false"
  #Number of days to retain minute metrics
  blobDiagnosticMinuteMetricsRetentionDays: 10    
    #"true" or "false" strings.  Defaults to "true" if unspecified.
  blobDiagnosticLoggingEnabled: "true"
  #Number of days to retain minute metrics
  blobDiagnosticLoggingRetentionDays: 10    
recipe:
  mypkg-storage:
    properties:
      type: "@azbake/ingredient-storage"
      source: ""
      parameters:
        storageAccountName: "[storage.create_resource_name()]"

*** Please note that the only value required for creation of this resource is the storageAccountName

Anonymous public blob access

The optional allowBlobPublicAccess parameter controls whether the storage account permits anonymous (unauthenticated) public read access to blob data.

BASELINE FLIP (Breaking Change): As of this version, the secure-by-default baseline has changed:

• Old behavior (Pass-1): Omitting allowBlobPublicAccess left the property unwritten, preserving the account's existing anonymous-access state.
• New behavior (Pass-2): Omitting allowBlobPublicAccess now writes an explicit false, disabling anonymous public blob access by default.

Impact: If your recipe redeploys an existing storage account and relies on maintaining its current anonymous-access state (if true), you must now explicitly set allowBlobPublicAccess: true in the recipe to preserve that state.

• Omitted or false: deploys the account with anonymous public blob access disabled. No exception tag is applied. This is the new secure-by-default baseline.
• true: allows anonymous public blob access to be configured (actual anonymous reads still depend on each container's public-access level) and stamps the approved-exception tag hchb-policy-exempt-anon-blob = true on the account, marking it as a sanctioned exception to the anonymous-blob deny policy. Existing tags (such as Metrics) are preserved.

recipe:
  mypkg-storage:
    properties:
      type: "@azbake/ingredient-storage"
      parameters:
        storageAccountName: "[storage.create_resource_name()]"
        allowBlobPublicAccess: false   # disable anonymous blob access (secure baseline)
        # OR omit allowBlobPublicAccess entirely—it defaults to false

ARM Template Compatibility:

• storage.json uses apiVersion 2020-08-01-preview — ✓ fully supports allowBlobPublicAccess
• storageNetwork.json uses apiVersion 2019-06-01 — ✓ supports allowBlobPublicAccess (GA'd in 2019-04-01)
• storageDatalake.json uses apiVersion 2018-02-01 — ⚠️ predates allowBlobPublicAccess (2019-04-01); the property may be silently ignored by ARM, though the tag still stamps. For datalake accounts (IsHnsEnabled), verify deployment behavior on the target Azure environment before relying on the property being enforced.

Public network access (Pass-1 stub — tag only)

The optional allowPublicNetworkAccess parameter is a forward-compatible stub. In this pass it stamps an approved-exception tag only; it deliberately does not write the storage account's publicNetworkAccess property, so no network behavior changes yet.

• Omitted (default): nothing is written — no tag, no property. Fully backward compatible.
• false: no tag is stamped and no property is written (Pass-1 stub — the publicNetworkAccess property is deferred).
• true: stamps the approved-exception tag hchb-policy-exempt-public-network = true on the account, marking it as a sanctioned exception to the public-network-access deny policy. Existing tags (such as Metrics) are preserved, and this tag co-exists with hchb-policy-exempt-anon-blob (the CDN case).

Deferred enforcement: the boolean will later map to publicNetworkAccess Enabled/Disabled (with private endpoints) in Feature 698027, behind the NetOps private-DNS gate (Feature 701425) — with no further recipe edit required. Setting the property before that DNS enabler exists would sever connectivity, which is why Pass 1 is tag-only.

recipe:
  mypkg-storage:
    properties:
      type: "@azbake/ingredient-storage"
      parameters:
        storageAccountName: "[storage.create_resource_name()]"
        allowPublicNetworkAccess: true   # stamp the exception tag only (no property yet)

Uploading Files to Blob Storage

Files can be uploaded to a blob container during deployment by specifying the source property within the recipe. The source property supports pointing to a direct file via file:/// syntax or pointing to a directory using relative pathing.

NOTE: only blob storage is supported at this time.

name: My package
shortName: mypkg
version: 0.0.1
ingredients:
  - "@azbake/ingredient-storage@~0"
parallelRegions: false
resourceGroup: false
recipe:
  mypkg-storage:
    properties:
      type: "@azbake/ingredient-storage"
      source: "file:///./deploy/deploy.zip" # "./deploy"
      parameters:
        storageAccountName: "[storage.create_resource_name()]"
        container: myContainer
        uploadPath: mypkg/__build_buildNumber__
        deploy: false
        unzip: true

Utilities

Utility classes can be used inside of the bake.yaml file for parameter and source values.

storage class

Function Details

create_resource_name()

Gets the name create for the traffic manager profile deployed.

...
parameters:
    storageAccountName: "[storage.create_resource_name()]"
...

Returns

string

Lifecycle Management Policies

The storage ingredient supports Azure Blob Storage lifecycle management policies for automatic blob deletion based on age. You can apply policies globally, per container, or even per path prefix.

add_delete_policy(name, enabled, daysAfter, options?)

Creates a delete policy rule for blob lifecycle management. Supports global policies (all blobs), container-level, path-level, or tag-based filtering.

Example: Global delete policy (all blobs)

// Delete all blockBlobs in the storage account after 90 days
const globalRule = storage.add_delete_policy("delete-all", true, 90);

Example: Container-level TTL

// Delete blobs in 'logs' container after 30 days
const logsRule = storage.add_delete_policy("delete-logs", true, 30, { prefixMatch: ["logs/"] });

// Delete blobs in 'temp' container after 7 days  
const tempRule = storage.add_delete_policy("delete-temp", true, 7, { prefixMatch: ["temp/"] });

// Delete blobs in 'archive' container after 365 days
const archiveRule = storage.add_delete_policy("delete-archive", true, 365, { prefixMatch: ["archive/"] });

// Create combined policy
const policy = storage.create_policy(logsRule, tempRule, archiveRule);

Example: Path-level TTL within a container

// Delete blobs in 'data/temp/' after 7 days, 'data/cache/' after 14 days
const tempRule = storage.add_delete_policy("delete-data-temp", true, 7, { prefixMatch: ["data/temp/"] });
const cacheRule = storage.add_delete_policy("delete-data-cache", true, 14, { prefixMatch: ["data/cache/"] });

const policy = storage.create_policy(tempRule, cacheRule);

Example: Filter by blob index tags

// Delete blobs tagged as "archived" in 'reports' container after 14 days
const rule = storage.add_delete_policy("delete-archived-reports", true, 14, {
  prefixMatch: ["reports/"],
  blobIndexMatch: [{ name: "status", op: "==", value: "archived" }]
});

Example: Include appendBlobs

// Delete both blockBlobs and appendBlobs in 'logs' container after 30 days
const rule = storage.add_delete_policy("delete-all-types", true, 30, { 
  prefixMatch: ["logs/"],
  blobTypes: ["blockBlob", "appendBlob"] 
});

create_policy(...rules)

Creates a management policy schema from one or more policy rules.

get_container(account, container, accessLevel?, policy?)

Gets or creates a container and optionally applies a management policy. When a policy is provided, it automatically scopes the policy rules to the specified container by adding prefix filters.