Appconfiguration: Allow Read Only Access to Configuration Explorer in Azure Portal

[preardon]

I am currently trying to allow multiple Users to be able to view Config for our apps. it appears that in order to use Configuration Explorer you need the "Microsoft.AppConfiguration/configurationStores/ListKeys/action" action which gives the users keys to Read, Update, and Delete Configuration

I would like a way to be able to give users the ability to see what the configuration is without being able to update it

[zhenlan]

App Configuration Data Reader role is what you need to assign to users whom you only want to grant read-only access to configuration data. However, please check out the doc below as there are limitations in Azure Portal and CLI at this point.

https://docs.microsoft.com/en-us/azure/azure-app-configuration/concept-enable-rbac#built-in-rbac-roles-for-azure-app-configuration

[preardon]

@zhenlan That Role does not allow for access to "Configuration Explorer" in the Azure Portal. I use that role programmatically but for Users who use Azure Portal it does not help as stated in that Article. This was a request for an action that allows list of the read only keys for HMAC or for the portal to start supporting AAD as well as HMAC

[zhenlan]

Yes, understand the request. This is in our to-do list.

[catbusstop]

Having the ability to import/export config be separated out of the existing roles would also be really handy

[zhenlan]

To App Configuration service, the import/export is nothing but PUT and GET requests (just like any other read/write requests), so it's impossible to enforce separate permission control with the current design.

[catbusstop]

That's a shame - I don't want developers to lose the ability to update/add key values, but the number of times I have to go tidy up the store after someone accidentally exports the config back into the same store is driving me crazy!

[drago-draganov]

@catbusstop
Looks to me like a tooling issue, not access control.
What about an ability to detect that very scenario (export/import into the same store) and provide warning and/or an explicit consent?

[aullom1]

I have a few users who would really like this feature through the portal too.

[drago-draganov]

@aullom1
That's for sure! Sorry, if I wasn't precise enough. Portal is a client tool, just like CLI. Features we plan usually go to both of them. Read-Only access totally makes sense.

In case of export/import into the same store:

Access Control is service responsibility though. I wanted to start a conversation for proposal to implement export/import into the same store warning on the tooling side (Portal, CLI, etc.), since there isn't much difference in between bulk write and single write from access control/security point of view.

[zhenlan]

The latest release of Azure CLI added AAD support for App Configuration, so the read-only access can be achieved using CLI now.

The same support for Azure Portal is working in progress.

[preardon]

@zhenlan in there an ETA for the portal or a more specific github repo I can follow

[mlauttia]

The latest release of Azure CLI added AAD support for App Configuration, so the read-only access can be achieved using CLI now.

The same support for Azure Portal is working in progress.

I cannot get this working. My user has _Reader_ and _App configuration data reader_ roles and I cannot access the app configuration from Azure Portal Cloud SheIl.

My command is
az appconfig kv list --name <my_app_configuration_name> --key webApp --all

and the error message I get is
Failed to get access keys for the App Configuration "<my_app_configuration_name>". Make sure that the account that logged in has sufficient permissions to access the App Configuration store. Operation returned an invalid status code 'Forbidden'

AZ CLI version is 2.14.0

[avanigupta]

The latest release of Azure CLI added AAD support for App Configuration, so the read-only access can be achieved using CLI now.
The same support for Azure Portal is working in progress.

I cannot get this working. My user has _Reader_ and _App configuration data reader_ roles and I cannot access the app configuration from Azure Portal Cloud SheIl.

My command is
az appconfig kv list --name <my_app_configuration_name> --key webApp --all

and the error message I get is
Failed to get access keys for the App Configuration "<my_app_configuration_name>". Make sure that the account that logged in has sufficient permissions to access the App Configuration store. Operation returned an invalid status code 'Forbidden'

AZ CLI version is 2.14.0

Hi @mlauttia, in order to use AAD auth, you need to provide an additional argument --auth-mode login with your command.
So your command should be:
az appconfig kv list --name <my_app_configuration_name> --key webApp --all --auth-mode login

Alternatively, you can set your default auth mode to AAD by running this command first:
az configure --defaults appconfig_auth_mode=login

[zhenlan]

AAD authentication for App Configuration is now supported in Azure Portal. Please see the announcement below for more details.

https://github.com/Azure/AppConfiguration-Announcements/issues/15