This PR implements the StorageAccountFirewall option to allow users to configure whether storage accounts have public or private networking access.

Changes Made

Core Implementation

• Bicep Template: Added storageAccountFirewall parameter with @allowed(['public', 'private']) validation and default value of 'private'
• Storage Configuration: Updated storage account module to use publicNetworkAccess: storageAccountFirewall == 'public' ? 'Enabled' : 'Disabled'
• PowerShell Functions: Added StorageAccountFirewall parameter to:
  • Invoke-AzBootstrap.ps1
  • Add-AzBootstrapEnvironment.ps1
  • New-AzBicepDeployment.ps1

Parameter Resolution Logic

Implements the priority order specified in the issue:

1. Global config file first: Checks ~/.azbootstrap-globals.jsonc for "storageAccountFirewall" setting
2. Command line parameter: Uses explicit -StorageAccountFirewall parameter if provided
3. Default value: Falls back to "private" for security

Interactive Mode Support

• Added prompt for storage account firewall setting with validation
• Provides clear options: [private/public, default: private]
• Validates user input and falls back to default for invalid entries

Configuration Examples

Global config file (~/.azbootstrap-globals.jsonc):

{
    "storageAccountFirewall": "private",
    "defaultLocation": "eastus"
}

Command line usage:

# Explicit parameter
Invoke-AzBootstrap -StorageAccountFirewall "public" -TemplateRepoUrl "terraform" -TargetRepoName "my-project"

# Will use global config or default to "private"
Invoke-AzBootstrap -TemplateRepoUrl "terraform" -TargetRepoName "my-project"

Testing

• Parameter Validation: Tests ensure only "public" and "private" values are accepted
• Configuration Resolution: Tests verify proper priority order (global config > CLI param > default)
• Interactive Mode: Updated existing tests to include the new parameter
• Module Loading: All existing functionality remains intact

Documentation

• Updated README.md with usage examples showing the new parameter
• Added global configuration documentation with the new setting
• Fixed existing parameter name inconsistency in examples

Security Considerations

The default value is "private" to ensure storage accounts are created with restricted network access by default, requiring explicit opt-in for public access.

Fixes #61.

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.