[PowerShell] Grant-FinOpsHubBlobAccess

[flanakin]

📝 Scenario

As a hub admin, I need to grant users access to blob storage in order to connect to Power BI reports

💎 Solution

Create an Grant-FinOpsHubBlobAccess command that assigns access to read/update storage blob data.

Synopsis

Grants storage blob access to a user, group, or service principal.

Syntax

# Grant access to an object ID
Grant-FinOpsHubBlobAccess `
    [-HubName] <string> `
    [-ResourceGroupName <string>] `
    -ObjectId <string> `
    [-Access <string>]

# Grant access via an email address lookup
Grant-FinOpsHubBlobAccess `
    [-HubName] <string> `
    [-ResourceGroupName <string>] `
    -Mail <string> `
    [-Access <string>]

# Grant access to the current user
Grant-FinOpsHubBlobAccess `
    [-HubName] <string> `
    [-ResourceGroupName <string>] `
    -CurrentUser `
    [-Access <string>]

Description

The Grant-FinOpsHubBlobAccess command grants the specified user, group, or service principal access to the storage account in the hub instance. Access is only granted using the built-in Storage Blob Data roles.

Parameters

Parameter	Description
-HubName	Required. Name of the hub instance.
-ResourceGroupName	Optional. Name of the resource group where the hub is deployed.
-ObjectId	Optional. Unique ID of the user, group, or service principal to grant access to.
-Mail	Optional. Email address to look up the user's object ID. Ignored if ObjectId is specified.
-CurrentUser	Optional. Indicates that the current user should be granted access. Ignored if ObjectId is specified.
-Access	Optional. Level of blob data access to grant to the specified user, group, or service principal. Allowed values: Reader, Contributor, Owner. Default: Reader.

ℹ️ Additional info

Each -Access value maps to the corresponding storage blob data role:

• Storage Blob Data Reader
• Storage Blob Data Contributor
• Storage Blob Data Owner

🙋‍♀️ Ask for the community

We could use your help:

1. Please vote this issue up (👍) to prioritize it.
2. Do you feel this is needed given it's a fairly standard RBAC operation (albeit hard to discover)?
3. Do we need an -ObjectType parameter? Description: "Indicates the type of the object ID specified. Allowed values: User, Group, ServicePrincipal. Default: User."
4. Leave comments to help us solidify the vision.