Azure-docs: The storage access key management needs a further explanation

[alexandair]

"The storage access key is exposed in this file and needs to be carefully checked into source control."

What does this mean?

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 83bb7059-c6aa-522c-474a-f516e453fe4f
• Version Independent ID: 3efbdbd2-2076-5302-cc3f-0ce765bf9e71
• Content: Use an Azure Marketplace image to create a Terraform Linux virtual machine with Managed Service Identity
• Content Source: articles/terraform/terraform-vm-msi.md
• Service: unspecified
• GitHub Login: @VaijanathB
• Microsoft Alias: tarcher

[MohitGargMSFT]

@alexandair Thanks for your feedback! We will investigate and update as appropriate.

[mimckitt]

@alexandair from my understanding it is referring to this file:
cp ~/tfTemplate/remoteState.tf .

If you were to load up that file inside the VM you would see that the access key to the storage account used by the VM is visible. This can be considered a security issue and hence access to this file should be restricted to the admin.

I will close this out but if you feel there is more to discuss please let me know and we can reopen and continue.

[alexandair]

It's already clear from the current version of the article that a storage key is exposed, but the point that's missing is how to deal with that from the security point of view. It's not enough to say "your secret is exposed". Tell the user how to deal/mitigate that.

[VaijanathB]

The comment is to specify that you should not accidentally check in this Storage account key. The storage account key exposed locally to the user unless it gets checked in with other terraform configuration files and exposed publically. Since MSI is enabled on the VM, user can always access the storage accounts.

[mimckitt]

@VaijanathB thanks for clarifying! Can you consider adding more information to this doc to avoid further confusion?

[VaijanathB]

Have updated the documentation to reflect that this only a checkin warning so that users do not check this file into source control. https://github.com/MicrosoftDocs/azure-docs-pr/pull/37197

[iainfoulds]

Hi, @alexandair . The changes have merged and will publish later on this afternoon (3pm PST). Once live, can you review and let @VaijanathB know if anything additional is required, please?

[alexandair]

Sure, I'll do that.

[pronka]

Currently the terraform deployment is failing