{"id":22314522,"url":"https://github.com/desuuuu/azure-storage-acl-sync","last_synced_at":"2026-05-03T19:33:54.767Z","repository":{"id":192602057,"uuid":"685096266","full_name":"Desuuuu/azure-storage-acl-sync","owner":"Desuuuu","description":"Synchronize Azure storage account IP ACL with Azure service IPs.","archived":false,"fork":false,"pushed_at":"2023-08-31T11:03:52.000Z","size":10,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-01-31T00:19:13.110Z","etag":null,"topics":["acl","azure","storage"],"latest_commit_sha":null,"homepage":"","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Desuuuu.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null}},"created_at":"2023-08-30T14:04:31.000Z","updated_at":"2023-08-31T10:34:57.000Z","dependencies_parsed_at":null,"dependency_job_id":"4b751274-bf18-44d9-8c31-6cb12e8a924f","html_url":"https://github.com/Desuuuu/azure-storage-acl-sync","commit_stats":null,"previous_names":["desuuuu/azure-storage-acl-sync"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Desuuuu%2Fazure-storage-acl-sync","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Desuuuu%2Fazure-storage-acl-sync/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Desuuuu%2Fazure-storage-acl-sync/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Desuuuu%2Fazure-storage-acl-sync/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Desuuuu","download_url":"https://codeload.github.com/Desuuuu/azure-storage-acl-sync/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":245579579,"owners_count":20638676,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["acl","azure","storage"],"created_at":"2024-12-03T22:10:17.716Z","updated_at":"2026-05-03T19:33:54.739Z","avatar_url":"https://github.com/Desuuuu.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# azure-storage-acl-sync\n\n[![Tag Badge]][Tag] [![Go Version Badge]][Go Version] [![Go Report Card Badge]][Go Report Card]\n\nSynchronize Azure storage account IP ACL with Azure service IPs.\n\n## Authentication\n\nAzure authentication is handled by the [azidentity](https://pkg.go.dev/github.com/Azure/azure-sdk-for-go/sdk/azidentity) package with `DefaultAzureCredential`. The easiest way to authenticate is using the following environment variables:\n\n\u003cdetails\u003e\n  \u003csummary\u003e\u003cb\u003eService principal with secret\u003c/b\u003e\u003c/summary\u003e\n\n  `AZURE_TENANT_ID`, `AZURE_CLIENT_ID` and `AZURE_CLIENT_SECRET`.\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\u003cb\u003eService principal with certificate\u003c/b\u003e\u003c/summary\u003e\n\n  `AZURE_TENANT_ID`, `AZURE_CLIENT_ID`, `AZURE_CLIENT_CERTIFICATE_PATH` and `AZURE_CLIENT_CERTIFICATE_PASSWORD`.\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e\u003cb\u003eUsername and password\u003c/b\u003e\u003c/summary\u003e\n\n  `AZURE_CLIENT_ID`, `AZURE_USERNAME` and `AZURE_PASSWORD`.\n\u003c/details\u003e\n\n## Permissions\n\n* `Microsoft.Network/locations/*/serviceTags/read` action on the subscription to retrieve the service IPs.\n* Writing properties on the configured storage account to update its IP ACL.\n\n\u003cdetails\u003e\n  \u003csummary\u003e\u003cb\u003eCustom role for reading service tags\u003c/b\u003e\u003c/summary\u003e\n\n  ```json\n{\n    \"Name\": \"Service Tag Reader\",\n    \"IsCustom\": true,\n    \"Description\": \"List service tags and their respective IPs.\",\n    \"Actions\": [\n        \"Microsoft.Network/locations/*/serviceTags/read\"\n    ],\n    \"NotActions\": [],\n    \"DataActions\": [],\n    \"NotDataActions\": [],\n    \"AssignableScopes\": [\n        \"/subscriptions/{subscriptionId}\"\n    ]\n}\n  ```\n\u003c/details\u003e\n\n## Options\n\n| Flag                  | Environment variable    | Default                                  | Description                                                                                                                                  |\n|:----------------------|:------------------------|:-----------------------------------------|:----------------------------------------------------------------|\n| `--subscription-id`   | `AZURE_SUBSCRIPTION_ID` | -                                        | Azure subscription ID.                                          |\n| `--services`          | `AZURE_SERVICES`        | `AzureFrontDoor.Backend`                 | Azure [services](https://learn.microsoft.com/en-us/azure/virtual-network/service-tags-overview#available-service-tags) to retrieve IPs from. |\n| `--location`          | `AZURE_LOCATION`        | `westus`                                 | Azure location to retrieve IPs for.                             |\n| `--resource-group`    | `AZURE_RESOURCE_GROUP`  | -                                        | Storage account resource group.                                 |\n| `--storage-account`   | `AZURE_STORAGE_ACCOUNT` | -                                        | Storage account name.                                           |\n| `--extra-allow-rules` | `EXTRA_ALLOW_RULES`     | `168.63.129.16` \u003cbr /\u003e `169.254.169.254` | Additional allow IP rules.                                      |\n| `--extra-deny-rules`  | `EXTRA_DENY_RULES`      | -                                        | Additional deny IP rules.                                       |\n| `--dry-run`           | `DRY_RUN`               | `false`                                  | Only print the IP rules that would be applied.                  |\n\nThe two IP addresses allowed by default are documented [here](https://learn.microsoft.com/en-us/azure/virtual-network/network-security-groups-overview#azure-platform-considerations).\n\n[Tag]: https://github.com/Desuuuu/azure-storage-acl-sync/tags\n[Tag Badge]: https://img.shields.io/github/v/tag/Desuuuu/azure-storage-acl-sync?sort=semver\n[Go Version]: /go.mod\n[Go Version Badge]: https://img.shields.io/github/go-mod/go-version/Desuuuu/azure-storage-acl-sync\n[Go Report Card]: https://goreportcard.com/report/github.com/Desuuuu/azure-storage-acl-sync\n[Go Report Card Badge]: https://goreportcard.com/badge/github.com/Desuuuu/azure-storage-acl-sync\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdesuuuu%2Fazure-storage-acl-sync","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fdesuuuu%2Fazure-storage-acl-sync","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fdesuuuu%2Fazure-storage-acl-sync/lists"}