[Storage] az storage account create/update: Add --allow-shared-key-access-for-blob, --allow-shared-key-access-for-file, --allow-shared-key-access-for-table, --allow-shared-key-access-for-queue

src/azure-cli/azure/cli/command_modules/storage/_params.py

@@ -190,8 +190,39 @@ def load_arguments(self, _):  # pylint: disable=too-many-locals, too-many-statem
 
     allow_shared_key_access_type = CLIArgumentType(
         arg_type=get_three_state_flag(), options_list=['--allow-shared-key-access', '-k'],
+        arg_group='Shared Key Access',
         help='Indicate whether the storage account permits requests to be authorized with the account access key via '
-             'Shared Key. If false, then all requests, including shared access signatures, must be authorized with '
+             'Shared Key to the blob service. If false, then all requests, including shared access signatures, must be authorized with '
+             'Azure Active Directory (Azure AD). The default value is null, which is equivalent to true.')
+
+    allow_shared_key_access_for_blob_type = CLIArgumentType(
+        arg_type=get_three_state_flag(), options_list=['--allow-shared-key-access-for-blob', '--shared-key-blob'],
+        arg_group='Shared Key Access',
+        help='Indicate whether the storage account permits requests to the blob service to be authorized with the '
+             'account access key via Shared Key. '
+             'If false, then all requests, including shared access signatures, must be authorized with '
+             'Azure Active Directory (Azure AD). The default value is null, which is equivalent to true.')
+    allow_shared_key_access_for_file_type = CLIArgumentType(
+        arg_type=get_three_state_flag(), options_list=['--allow-shared-key-access-for-file', '--shared-key-file'],
+        arg_group='Shared Key Access',
+        help='Indicate whether the storage account permits requests to the file service to be authorized with the '
+             'account access key via Shared Key. '
+             'If false, then all requests, including shared access signatures, must be authorized with '
+             'Azure Active Directory (Azure AD). The default value is null, which is equivalent to true.')
+    allow_shared_key_access_for_table_type = CLIArgumentType(
+        arg_type=get_three_state_flag(), options_list=['--allow-shared-key-access-for-table', '--shared-key-table'],
+        arg_group='Shared Key Access',
+        help='Indicate whether the storage account permits requests to the table service be authorized with the '
+             'account access key via Shared Key. '
+             'If false, then all requests, including shared access signatures, must be authorized with '
+             'Azure Active Directory (Azure AD). The default value is null, which is equivalent to true.')
+
+    allow_shared_key_access_for_queue_type = CLIArgumentType(
+        arg_type=get_three_state_flag(), options_list=['--allow-shared-key-access-for-queue', '--shared-key-queue'],
+        arg_group='Shared Key Access',
+        help='Indicate whether the storage account permits requests to the queue service be authorized with the '
+             'account access key via Shared Key. '
+             'If false, then all requests, including shared access signatures, must be authorized with '
              'Azure Active Directory (Azure AD). The default value is null, which is equivalent to true.')
 
     sas_expiration_period_type = CLIArgumentType(
@@ -450,6 +481,10 @@ def load_arguments(self, _):  # pylint: disable=too-many-locals, too-many-statem
         c.argument('allowed_copy_scope', arg_type=get_enum_type(t_allowed_copy_scope),
                    help='Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the '
                         'same VNet.')
+        c.argument('allow_shared_key_access_for_blob', allow_shared_key_access_for_blob_type)
+        c.argument('allow_shared_key_access_for_file', allow_shared_key_access_for_file_type)
+        c.argument('allow_shared_key_access_for_table', allow_shared_key_access_for_table_type)
+        c.argument('allow_shared_key_access_for_queue', allow_shared_key_access_for_queue_type)
 
     with self.argument_context('storage account private-endpoint-connection',
                                resource_type=ResourceType.MGMT_STORAGE) as c:
@@ -556,6 +591,10 @@ def load_arguments(self, _):  # pylint: disable=too-many-locals, too-many-statem
         c.argument('allowed_copy_scope', arg_type=get_enum_type(t_allowed_copy_scope),
                    help='Restrict copy to and from Storage Accounts within an AAD tenant or with Private Links to the '
                         'same VNet.')
+        c.argument('allow_shared_key_access_for_blob', allow_shared_key_access_for_blob_type)
+        c.argument('allow_shared_key_access_for_file', allow_shared_key_access_for_file_type)
+        c.argument('allow_shared_key_access_for_table', allow_shared_key_access_for_table_type)
+        c.argument('allow_shared_key_access_for_queue', allow_shared_key_access_for_queue_type)
 
     for scope in ['storage account create', 'storage account update']:
         with self.argument_context(scope, arg_group='Customer managed key',

src/azure-cli/azure/cli/command_modules/storage/operations/account.py

@@ -80,7 +80,9 @@ def create_storage_account(cmd, resource_group_name, account_name, sku=None, loc
                            allow_protected_append_writes=None, public_network_access=None, dns_endpoint_type=None,
                            enable_smb_oauth=None, zones=None, zone_placement_policy=None,
                            enable_blob_geo_priority_replication=None, publish_ipv6_endpoint=None,
-                           allowed_copy_scope=None):
+                           allowed_copy_scope=None, allow_shared_key_access_for_blob=None,
+                           allow_shared_key_access_for_file=None, allow_shared_key_access_for_table=None,
+                           allow_shared_key_access_for_queue=None):
     StorageAccountCreateParameters, Kind, Sku, CustomDomain, AccessTier, Identity, Encryption, NetworkRuleSet = \
         cmd.get_models('StorageAccountCreateParameters', 'Kind', 'Sku', 'CustomDomain', 'AccessTier', 'Identity',
                        'Encryption', 'NetworkRuleSet')
@@ -270,6 +272,21 @@ def create_storage_account(cmd, resource_group_name, account_name, sku=None, loc
     if allow_shared_key_access is not None:
         params.allow_shared_key_access = allow_shared_key_access
 
+    StorageAccountSharedKeyAccessProperties = cmd.get_models('StorageAccountSharedKeyAccessProperties')
+    params.allow_shared_key_access_for_services = StorageAccountSharedKeyAccessProperties()
+
+    if allow_shared_key_access_for_blob is not None:
+        params.allow_shared_key_access_for_services.blob = {'enabled': allow_shared_key_access_for_blob}
+
+    if allow_shared_key_access_for_file is not None:
+        params.allow_shared_key_access_for_services.file = {'enabled': allow_shared_key_access_for_file}
+
+    if allow_shared_key_access_for_table is not None:
+        params.allow_shared_key_access_for_services.table = {'enabled': allow_shared_key_access_for_table}
+
+    if allow_shared_key_access_for_queue is not None:
+        params.allow_shared_key_access_for_services.queue = {'enabled': allow_shared_key_access_for_queue}
+
     if edge_zone is not None:
         ExtendedLocation, ExtendedLocationTypes = cmd.get_models('ExtendedLocation', 'ExtendedLocationTypes')
         params.extended_location = ExtendedLocation(name=edge_zone,
@@ -434,7 +451,9 @@ def update_storage_account(cmd, instance, sku=None, tags=None, custom_domain=Non
                            allow_protected_append_writes=None, public_network_access=None, upgrade_to_storagev2=None,
                            yes=None, enable_smb_oauth=None, zones=None, zone_placement_policy=None,
                            enable_blob_geo_priority_replication=None, publish_ipv6_endpoint=None,
-                           allowed_copy_scope=None):
+                           allowed_copy_scope=None, allow_shared_key_access_for_blob=None,
+                           allow_shared_key_access_for_file=None, allow_shared_key_access_for_table=None,
+                           allow_shared_key_access_for_queue=None):
     StorageAccountUpdateParameters, Sku, CustomDomain, AccessTier, Identity, Encryption, NetworkRuleSet, Kind = \
         cmd.get_models('StorageAccountUpdateParameters', 'Sku', 'CustomDomain', 'AccessTier', 'Identity', 'Encryption',
                        'NetworkRuleSet', 'Kind')
@@ -698,6 +717,23 @@ def update_storage_account(cmd, instance, sku=None, tags=None, custom_domain=Non
     if allow_shared_key_access is not None:
         params.allow_shared_key_access = allow_shared_key_access
 
+    params.allow_shared_key_access_for_services = instance.allow_shared_key_access_for_services
+    if params.allow_shared_key_access_for_services is None:
+        StorageAccountSharedKeyAccessProperties = cmd.get_models('StorageAccountSharedKeyAccessProperties')
+        params.allow_shared_key_access_for_services = StorageAccountSharedKeyAccessProperties()
+
+    if allow_shared_key_access_for_blob is not None:
+        params.allow_shared_key_access_for_services.blob = {'enabled': allow_shared_key_access_for_blob}
+
+    if allow_shared_key_access_for_file is not None:
+        params.allow_shared_key_access_for_services.file = {'enabled': allow_shared_key_access_for_file}
+
+    if allow_shared_key_access_for_table is not None:
+        params.allow_shared_key_access_for_services.table = {'enabled': allow_shared_key_access_for_table}
+
+    if allow_shared_key_access_for_queue is not None:
+        params.allow_shared_key_access_for_services.queue = {'enabled': allow_shared_key_access_for_queue}
+
     if key_expiration_period_in_days is not None:
         KeyPolicy = cmd.get_models('KeyPolicy')
         params.key_policy = KeyPolicy(key_expiration_period_in_days=key_expiration_period_in_days)