Create an Azure storage account

None.

To create an Azure storage account by using PowerShell, make sure you install the latest Azure Az PowerShell module. See Install the Azure PowerShell module.

You can sign in to Azure and run Azure CLI commands in one of two ways:

• Run CLI commands from within the Azure portal, in Azure Cloud Shell.
• Install the CLI and run CLI commands locally.

Use Azure Cloud Shell

Azure Cloud Shell is a free Bash shell that you can run directly within the Azure portal. The Azure CLI is preinstalled and configured to use with your account. Select the Cloud Shell button on the menu in the upper-right section of the Azure portal:

The button launches an interactive shell that you can use to run the steps outlined in this how-to article:

Install the Azure CLI locally

You can also install and use the Azure CLI locally. If you plan to use Azure CLI locally, make sure you install the latest version of the Azure CLI. See Install the Azure CLI.

None.

None.

The Azure Developer CLI (azd) is an open-source, command-line tool that streamlines provisioning and deploying resources to Azure by using a template system. azd is available for several development environments, including the following options:

• Locally via CLI by installing azd.
• GitHub Codespaces environments.
• The Azure portal by using Cloud Shell.

  Note

  The azd template includes a .devcontainer that already has azd installed. You can skip the installation step if you plan to use a devcontainer either locally or in an environment like Codespaces.

• You need an Azure account with an active subscription. You can create an account for free.

• Install and configure Terraform

Sign in to the Azure portal.

Sign in to your Azure subscription by using the Connect-AzAccount command and follow the on-screen directions to authenticate.

Connect-AzAccount

To launch Azure Cloud Shell, sign in to the Azure portal.

To log in to your local installation of the CLI, run the az sign-in command:

az login

N/A

N/A

If you plan to use azd via Cloud Shell:

• Sign in to the Azure portal.

• Launch Cloud Shell by selecting the corresponding icon. azd is automatically available in Cloud Shell and authenticates by using the account you used to sign in to the Azure portal.

  

To sign in to a local installation of azd or Codespaces environment, run the azd auth sign-in command:

    azd auth login

azd opens a browser window that you can use to sign in to Azure.

Authenticate Terraform to Azure

To create an Azure storage account by using the Azure portal, follow these steps:

1. From the left portal menu, select Storage accounts to display a list of your storage accounts. If you don't see the portal menu, select the menu button to toggle it on.

   

2. On the Storage accounts page, select Create.

   

The Create a storage account page organizes options for your new storage account into tabs. The following image shows these tabs.

Basics tab

On the Basics tab, enter the essential information for your storage account. After you complete the Basics tab, you can choose to further customize your new storage account by setting options on the other tabs, or you can select Review + create to accept the default options and proceed to validate and create the account.

The following table describes the fields on the Basics tab.

Advanced tab

On the Advanced tab, you can configure additional options and modify default settings for your new storage account. Some of these options you can configure after creating the storage account, while others require configuration at the time of creation.

The following table describes the fields on the Advanced tab.

Networking tab

On the Networking tab, you can configure network connectivity and routing preference settings for your new storage account. You can also configure these options after creating the storage account.

The following table describes the fields on the Networking tab.

Data protection tab

On the Data protection tab, you can configure data protection options for blob data in your new storage account. You can also configure these options after creating the storage account. For an overview of data protection options in Azure Storage, see Data protection overview.

The following table describes the fields on the Data protection tab.

Security tab

On the Security tab, you can configure options that relate to security.

The following table describes the fields on the Security tab.

Encryption tab

On the Encryption tab, you can configure options that relate to how your data is encrypted when it's persisted to the cloud. Some of these options can be configured only when you create the storage account.

The following table describes the fields on the Encryption tab.

Tags tab

On the Tags tab, specify Resource Manager tags to help organize your Azure resources. For more information, see Tag resources, resource groups, and subscriptions for logical organization.

Review + create tab

When you go to the Review + create tab, Azure validates the storage account settings that you choose. If validation passes, you can create the storage account.

If validation fails, the portal indicates which settings you need to modify.

To create a general-purpose v2 storage account with PowerShell, first create a new resource group by calling the New-AzResourceGroup command:

$resourceGroup = "<resource-group>"
$location = "<location>"
New-AzResourceGroup -Name $resourceGroup -Location $location

If you're not sure which region to specify for the -Location parameter, retrieve a list of supported regions for your subscription by using the Get-AzLocation command:

Get-AzLocation | select Location

Next, create a standard general-purpose v2 storage account with read-access geo-redundant storage (RA-GRS) by using the New-AzStorageAccount command. Remember that the name of your storage account must be unique across Azure, so replace the placeholder value in brackets with your own unique value:

New-AzStorageAccount -ResourceGroupName $resourceGroup `
  -Name <account-name> `
  -Location $location `
  -SkuName Standard_RAGRS `
  -Kind StorageV2 `
  -AllowBlobPublicAccess $false `
  -MinimumTlsVersion TLS1_2

To create an account with Azure DNS zone endpoints (preview), follow these steps:

1. Register for the preview as described in Azure DNS zone endpoints (preview).

2. Make sure you have the latest version of PowerShellGet installed.

   Install-Module PowerShellGet -Repository PSGallery -Force
   

3. Close and reopen the PowerShell console.

4. Install version 4.4.2-preview or later of the Az.Storage PowerShell module. You might need to uninstall other versions of the PowerShell module. For more information about installing Azure PowerShell, see Install Azure PowerShell with PowerShellGet.

   Install-Module Az.Storage -Repository PsGallery -RequiredVersion 4.4.2-preview -AllowClobber -AllowPrerelease -Force
   

Next, create the account, specifying AzureDnsZone for the -DnsEndpointType parameter. After the account is created, you can see the service endpoints by getting the PrimaryEndpoints and SecondaryEndpoints properties for the storage account.

$rgName = "<resource-group>"
$accountName = "<storage-account>"

$account = New-AzStorageAccount -ResourceGroupName $rgName `
          -Name $accountName `
          -SkuName Standard_RAGRS `
          -Location <location> `
          -Kind StorageV2 `
          -AllowBlobPublicAccess $false `
          -MinimumTlsVersion TLS1_2 `
          -DnsEndpointType AzureDnsZone

$account.PrimaryEndpoints
$account.SecondaryEndpoints

To enable a hierarchical namespace for the storage account to use Azure Data Lake Storage, set the EnableHierarchicalNamespace parameter to $True on the call to the New-AzStorageAccount command.

The following table shows which values to use for the SkuName and Kind parameters to create a particular type of storage account with the desired redundancy configuration.

To create a general-purpose v2 storage account with Azure CLI, first create a new resource group by calling the az group create command.

az group create \
  --name storage-resource-group \
  --location eastus

If you're not sure which region to specify for the --location parameter, retrieve a list of supported regions for your subscription by using the az account list-locations command.

az account list-locations \
  --query "[].{Region:name}" \
  --out table

Next, create a standard general-purpose v2 storage account with read-access geo-redundant storage by using the az storage account create command. Remember that the name of your storage account must be unique across Azure, so replace the placeholder value in brackets with your own unique value:

az storage account create \
  --name <account-name> \
  --resource-group storage-resource-group \
  --location eastus \
  --sku Standard_RAGRS \
  --kind StorageV2 \
  --min-tls-version TLS1_2 \
  --allow-blob-public-access false

To create an account with Azure DNS zone endpoints (preview), first register for the preview as described in Azure DNS zone endpoints (preview). Next, install the preview extension for the Azure CLI if it's not already installed:

az extension add --name storage-preview

Next, create the account, specifying AzureDnsZone for the --dns-endpoint-type parameter. After the account is created, you can see the service endpoints by getting the PrimaryEndpoints property of the storage account.

az storage account create \
    --name <account-name> \
    --resource-group <resource-group> \
    --location <location> \
    --min-tls-version TLS1_2 \
    --allow-blob-public-access false \
    --dns-endpoint-type AzureDnsZone

After the account is created, you can return the service endpoints by getting the primaryEndpoints and secondaryEndpoints properties for the storage account.

az storage account show \
    --resource-group <resource-group> \
    --name <account-name> \
    --query '[primaryEndpoints, secondaryEndpoints]'

To enable a hierarchical namespace for the storage account to use Azure Data Lake Storage, set the enable-hierarchical-namespace parameter to true on the call to the az storage account create command. Creating a hierarchical namespace requires Azure CLI version 2.0.79 or later.

You can use either Azure PowerShell or Azure CLI to deploy a Bicep file to create a storage account. The Bicep file used in this how-to article is from Azure Resource Manager quickstart templates. Bicep currently doesn't support deploying a remote file. Download and save the Bicep file to your local computer, and then run the scripts.

$resourceGroupName = Read-Host -Prompt "Enter the Resource Group name"
$location = Read-Host -Prompt "Enter the location (i.e. centralus)"

New-AzResourceGroup -Name $resourceGroupName -Location "$location"
New-AzResourceGroupDeployment -ResourceGroupName $resourceGroupName -TemplateFile "main.bicep"

echo "Enter the Resource Group name:" &&
read resourceGroupName &&
echo "Enter the location (i.e. centralus):" &&
read location &&
az group create --name $resourceGroupName --location "$location" &&
az deployment group create --resource-group $resourceGroupName --template-file "main.bicep"

To learn how to modify this Bicep file or create new ones, see:

• Azure Resource Manager documentation.
• Storage account template reference.
• Additional storage account template samples.

You can use either Azure PowerShell or Azure CLI to deploy a Resource Manager template to create a storage account. The template used in this how-to article is from Azure Resource Manager quickstart templates. To run the scripts, select Try it to open the Azure Cloud Shell. To paste the script, right-click the shell, and then select Paste.

$resourceGroupName = Read-Host -Prompt "Enter the Resource Group name"
$location = Read-Host -Prompt "Enter the location (i.e. centralus)"

New-AzResourceGroup -Name $resourceGroupName -Location "$location"
New-AzResourceGroupDeployment -ResourceGroupName $resourceGroupName -TemplateUri "https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/quickstarts/microsoft.storage/storage-account-create/azuredeploy.json"

echo "Enter the Resource Group name:" &&
read resourceGroupName &&
echo "Enter the location (i.e. centralus):" &&
read location &&
az group create --name $resourceGroupName --location "$location" &&
az deployment group create --resource-group $resourceGroupName --template-uri "https://raw.githubusercontent.com/Azure/azure-quickstart-templates/master/quickstarts/microsoft.storage/storage-account-create/azuredeploy.json"

To learn how to modify this template or create new ones, see:

• Azure Resource Manager documentation.
• Storage account template reference.
• Additional storage account template samples.

The Azure Developer CLI (azd) is designed around azd templates. These templates use Bicep files, basic configurations, and automation tasks to provision and deploy resources to Azure. You can also view the source code for the template in the create a storage account quickstart repository.

Initialize and run the template for this quickstart by using the following steps:

1. Run the azd init command in a local terminal or CloudShell.

   azd init --template https://github.com/azure-samples/azd-create-storage-account
   

2. azd prompts you for an environment name, which determines the naming of provisioned resources in Azure. Enter the name azdstorage and press Enter.

   

3. Next, run the azd up command to start the template provisioning and deployment process.

   azd up
   

4. If you're not already authenticated to Azure, azd outputs a message instructing you to sign in to Azure by using the azd auth login command.

   azd auth login
   

5. After you authenticate, azd prompts you for the Azure location to provision the storage account from a list of regions. Select your desired location from the list and press Enter.

6. azd will also prompt you for a storage account type. The type is a custom parameter that was added to the azd template to add flexibility to the storage account provisioning. Choose Standard_LRS or whatever type you would like, and then press enter.

7. azd begins provisioning the storage account. The command output provides a link to the deployment in Azure and status details until the command finishes.

   

8. When the command finishes, select the link to open the Azure portal to the provisioned resource group and storage account.

   

The sample code for this article is located in the Azure Terraform GitHub repo. You can view the log file containing the test results from current and previous versions of Terraform. For more information, see articles and sample code showing how to use Terraform to manage Azure resources.

1. Create a directory to test and run the sample Terraform code, and make it the current directory.

2. Create a file named providers.tf, and insert the following code:

   terraform {
     required_providers {
       azurerm = {
         source  = "hashicorp/azurerm"
         version = "~>4.0"
       }
       random = {
         source  = "hashicorp/random"
         version = "~>3.0"
       }
     }
   }
   
   provider "azurerm" {
     features {}
   }
   

3. Create a file named main.tf, and insert the following code:

   # Create Resource Group
   resource "random_pet" "rg_name" {
     prefix = var.resource_group_name_prefix
   }
   
   resource "azurerm_resource_group" "rg" {
     location = var.resource_group_location
     name     = random_pet.rg_name.id
   }
   
   # Random String for unique naming
   resource "random_string" "name" {
     length  = 8
     special = false
     upper   = false
     lower   = true
     numeric = false
   }
   
   # Create Storage Account
   resource "azurerm_storage_account" "sa" {
     name                     = "sa${random_string.name.result}"
     resource_group_name      = azurerm_resource_group.rg.name
     location                 = azurerm_resource_group.rg.location
     account_tier             = "Standard"
     account_replication_type = "RAGRS"
     account_kind             = "StorageV2"
     min_tls_version          = "TLS1_2"
     allow_nested_items_to_be_public = false
   }
   

4. Create a file named variables.tf, and insert the following code:

   variable "resource_group_location" {
     type        = string
     default     = "eastus"
     description = "Location of the resource group."
   }
   
   variable "resource_group_name_prefix" {
     type        = string
     default     = "rg"
     description = "Prefix of the resource group name that's combined with a random ID so name is unique in your Azure subscription."
   }
   

5. Create a file named outputs.tf, and insert the following code:

   output "resource_group_name" {
     value = azurerm_resource_group.rg.name
   }
   
   output "storage_account_name" {
     value = azurerm_storage_account.sa.name
   }
   

   Important

   If you're using the 4.x azurerm provider, you must explicitly specify the Azure subscription ID to authenticate to Azure before running the Terraform commands.

   One way to specify the Azure subscription ID without putting it in the providers block is to specify the subscription ID in an environment variable named ARM_SUBSCRIPTION_ID.

   For more information, see the Azure provider reference documentation.

6. Initialize Terraform.

   Run terraform init to initialize the Terraform deployment. This command downloads the Azure provider required to manage your Azure resources.

   terraform init -upgrade
   

   Key points:

   • The -upgrade parameter upgrades the necessary provider plugins to the newest version that complies with the configuration's version constraints.

7. Create a Terraform execution plan.

   Run terraform plan to create an execution plan.

   terraform plan -out main.tfplan
   

   Key points:

   • The terraform plan command creates an execution plan, but doesn't execute it. Instead, it determines what actions are necessary to create the configuration specified in your configuration files. This pattern allows you to verify whether the execution plan matches your expectations before making any changes to actual resources.
   • The optional -out parameter allows you to specify an output file for the plan. Using the -out parameter ensures that the plan you reviewed is exactly what is applied.

8. Apply a Terraform execution plan.

   Run terraform apply to apply the execution plan to your cloud infrastructure.

   terraform apply main.tfplan
   

   Key points:

   • The example terraform apply command assumes you previously ran terraform plan -out main.tfplan.
   • If you specified a different filename for the -out parameter, use that same filename in the call to terraform apply.
   • If you didn't use the -out parameter, call terraform apply without any parameters.

1. Go to the storage account in the Azure portal.
2. Select Delete.

To delete the storage account, use the Remove-AzStorageAccount command:

Remove-AzStorageAccount -Name <storage-account> -ResourceGroupName <resource-group>

To delete the storage account, use the az storage account delete command:

az storage account delete --name <storage-account> --resource-group <resource-group>

To delete the storage account, use either Azure PowerShell or Azure CLI.

$storageResourceGroupName = Read-Host -Prompt "Enter the resource group name"
$storageAccountName = Read-Host -Prompt "Enter the storage account name"
Remove-AzStorageAccount -Name $storageAccountName -ResourceGroupName $storageResourceGroupName

echo "Enter the resource group name:" &&
read resourceGroupName &&
echo "Enter the storage account name:" &&
read storageAccountName &&
az storage account delete --name storageAccountName --resource-group resourceGroupName

To delete the storage account, use either Azure PowerShell or Azure CLI.

$storageResourceGroupName = Read-Host -Prompt "Enter the resource group name"
$storageAccountName = Read-Host -Prompt "Enter the storage account name"
Remove-AzStorageAccount -Name $storageAccountName -ResourceGroupName $storageResourceGroupName

echo "Enter the resource group name:" &&
read resourceGroupName &&
echo "Enter the storage account name:" &&
read storageAccountName &&
az storage account delete --name storageAccountName --resource-group resourceGroupName

To delete the resource group and storage account that azd created, use the azd down command:

azd down

When you no longer need the resources created via Terraform, do the following steps:

1. Run terraform plan and specify the destroy flag.

   terraform plan -destroy -out main.destroy.tfplan
   

   Key points:

   • The terraform plan command creates an execution plan, but doesn't execute it. Instead, it determines what actions are necessary to create the configuration specified in your configuration files. This pattern allows you to verify whether the execution plan matches your expectations before making any changes to actual resources.
   • The optional -out parameter allows you to specify an output file for the plan. Using the -out parameter ensures that the plan you reviewed is exactly what is applied.

2. Run terraform apply to apply the execution plan.

   terraform apply main.destroy.tfplan