Java SDK / Add option to better manage roles / assign user managed identity to storage accounts via SDK

[kobaltoxid]

Hello, I'm writing since I've searched high and low for the above 2 things.

As of now, I have found that the features I'm looking for are not implemented in the SDK as of version 2.31.0 . The version 2.32.0 release notes mention nothing of this so I'm assuming there are no changes there either.

In essence, this would be my struggle:

azureResourceManager.accessManagement().roleAssignments()
                        .define(azureResourceManager.resourceGroups().manager().internalContext().randomUuid())
                        .forObjectId(storageAccount.systemAssignedManagedServiceIdentityPrincipalId())
                        .withBuiltInRole(BuiltInRole.KEY_VAULT_ADMINISTRATOR)                                         
                        .withResourceGroupScope(azureResourceManager.resourceGroups().getByName(getKeyVaultResourceGroupName()))
                        .create());

I'm forced to do error handling if I were to touch the same storage account a second time. It would be very useful if the SDK would allow to search a given role assignment and to remove/add it to a resource afterwards. Instead, I have to create a brand new assignment and apply it here at the same time.

On the following note, an Azure role assignment seems to contain a GUID/UUID as a name field. This is confusing, it could be remedied by specifying an additional name field or by renaming the current name field to "RoleID". This would also help if we allow to search the available role assignments of an object.

This is from the SupportsCreating interface docs. Define accepts a "String name" field:

Begins a definition for a new resource.
This is the beginning of the builder pattern used to create top level resources in Azure. The final method completing the definition and starting the actual resource creation process in Azure is Creatable.create().
Note that the Creatable.create() method is only available at the stage of the resource definition that has the minimum set of input parameters specified. If you do not see Creatable.create() among the available methods, it means you have not yet specified all the required input settings. Input settings generally begin with the word "with", for example: .withNewResourceGroup() and return the next stage of the resource definition, as an interface in the "fluent interface" style.
Params:
name – the name of the new resource
Returns:
the first stage of the new resource definition

And finally, I have noticed that you can only assign a system-managed identity to a storage account via the SDK. It would be useful if we could assign a user-managed identity without having to resort to calling the REST API via an HTTP client request.

StorageAccount newStorageAccount = azureResourceManager.storageAccounts().define(storageAccountName)
                    .withRegion(Region.EUROPE_WEST)
                    .withNewResourceGroup(rgName)
                    .withSystemAssignedManagedServiceIdentity()
                    .disableBlobPublicAccess()
                    .create();

Thank you for sparing the time to hear my ideas! Let me know if I'm wrong somewhere.

[weidongxu-microsoft]

I think SDK supports .roleAssignments().listByScope(storageAccount.id()) to query the role assignments on the resource.

However, the name = GUID/UUID on role assignment is backend behavior. If one use a different pattern (like human-readable name), backend would reject it. Currently there is nothing SDK can do about it.
Maybe set and check the description property?

For user-managed identity in storage account, it can be supported. Would you create an issue in https://github.com/Azure/azure-sdk-for-java/issues ?

[kobaltoxid]

Hello, thanks for the feedback. I'll open an issue regarding the second part of my question.

Regarding the first part, I managed to find a workaround, but since some time has passed, I can't seem to recall the details.
Nevertheless, thank you for sparing the time.