Skip to content

Managed Identity support for Azure queue storage input plugin #18111

@viswa

Description

@viswa

Use Case

Current mode of access to an Azure storage account with the storage queue plugin is with a shared access key. Handling the key as a secret in an environment like k8s can become more difficult than it needs to be. Also in the case of an exploiter getting hold of access keys, it not only allows them to access queue services, but also blob storage and tables. From the perspective of security and also ease in deployment, it would be a neat addition to have support for Managed Identities there.

Expected behavior

Adding optional configuration keys for managed identity and making account_key optional

# Gather Azure Storage Queue metrics
[[inputs.azure_storage_queue]]
  ## Azure Storage Account name and shared access key (optional)
  account_name = "mystorageaccount"
  account_key = "storageaccountaccesskey" # made optional

  ## Azure Managed identity (optional)
  use_managed_identity = true # could be omitted
  client_id = "<<managed-identity-client-id>>"

  ## Disable peeking age of oldest message (faster)
  # peek_oldest_message_age = true

Actual behavior

Configuration only allows for shared access key and it is required:

# Gather Azure Storage Queue metrics
[[inputs.azure_storage_queue]]
  ## Azure Storage Account name and shared access key (required)
  account_name = "mystorageaccount"
  account_key = "storageaccountaccesskey"

  ## Disable peeking age of oldest message (faster)
  # peek_oldest_message_age = true

Additional info

No response

Metadata

Metadata

Assignees

No one assigned

    Labels

    feature requestRequests for new plugin and for new features to existing plugins

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions