Repository: Azure/azure-cli-extensions

Issue:
az cli application-insights api-key creates with wrong permissions
### Extension name: **application-insights**

### Description of issue

The default behavior of creating an api-key with the az cli application-insights extension is that it will add full permissions if  None is supplied.
If i would like to create a read only or write only api-key, then i cant seem to do it with the az cli. 

1) `az monitor app-insights api-key create --read-properties ReadTelemetry ..` 
would always result in WriteAnnotations as well, because nothing is provided for --write-properties and the default is WriteAnnotations

2) `az monitor app-insights api-key create --write-properties WriteAnnotations  .. `
would always result in ReadTelemetry and  AuthenticateSDKControlChannel as well, because nothing is provided for --read-properties and the default is 'ReadTelemetry', 'AuthenticateSDKControlChannel'.

My assumption and as it seems to behave everywhere else is that i need to say the permission set i want or if i supply no read and write permissions, then default is all. IF i supply my permission set, then only that will be used. 

I believe the bug is here:
https://github.com/Azure/azure-cli-extensions/blob/master/src/application-insights/azext_applicationinsights/custom.py

Line 142-145:
```
    if read_properties is None:
        read_properties = ['ReadTelemetry', 'AuthenticateSDKControlChannel']
    if write_properties is None:
        write_properties = ['WriteAnnotations']
```



Discussion:
add to S173
> ### Extension name: **application-insights**
> ### Description of issue
> The default behavior of creating an api-key with the az cli application-insights extension is that it will add full permissions if None is supplied.
> If i would like to create a read only or write only api-key, then i cant seem to do it with the az cli.
> 
> 1. `az monitor app-insights api-key create --read-properties ReadTelemetry ..`
>    would always result in WriteAnnotations as well, because nothing is provided for --write-properties and the default is WriteAnnotations
> 2. `az monitor app-insights api-key create --write-properties WriteAnnotations  .. `
>    would always result in ReadTelemetry and  AuthenticateSDKControlChannel as well, because nothing is provided for --read-properties and the default is 'ReadTelemetry', 'AuthenticateSDKControlChannel'.
> 
> My assumption and as it seems to behave everywhere else is that i need to say the permission set i want or if i supply no read and write permissions, then default is all. IF i supply my permission set, then only that will be used.
> 
> I believe the bug is here:
> https://github.com/Azure/azure-cli-extensions/blob/master/src/application-insights/azext_applicationinsights/custom.py
> 
> Line 142-145:
> 
> ```
>     if read_properties is None:
>         read_properties = ['ReadTelemetry', 'AuthenticateSDKControlChannel']
>     if write_properties is None:
>         write_properties = ['WriteAnnotations']
> ```

@melborp Hi. You could use `--read-properties '""' --write-properties '""'` to remove all permissions.  I would add one more example at least. 
@MyronFanQiu I tested with the '""' value and it does work with it. Thank you. 

I still believe its wrong to set default permissions for writing, when i am supplying permissions for reading and nothing for writing. 

Further, In the az powershell module they dont separate read and write permissions and the appinsights api key creation in portal doesnt separate it either. Its just a list of permissions. I wonder if that would simplify the usage. 
> @MyronFanQiu I tested with the '""' value and it does work with it. Thank you.
> 
> I still believe its wrong to set default permissions for writing, when i am supplying permissions for reading and nothing for writing.
> 
> Further, In the az powershell module they dont separate read and write permissions and the appinsights api key creation in portal doesnt separate it either. Its just a list of permissions. I wonder if that would simplify the usage.

Agree that we should not set default permission for writing. But they have been there for a long time. Removing permission would be a breaking change. I would add example first and add warning about the incoming breaking change. Then open another issue to track this one. Thanks for your suggestion.
@MyronFanQiu makes sense to take it in steps to handle the breaking change and the workaround is working. 

Resolving patch:
diff --git a/src/application-insights/azext_applicationinsights/_help.py b/src/application-insights/azext_applicationinsights/_help.py
--- a/src/application-insights/azext_applicationinsights/_help.py
+++ b/src/application-insights/azext_applicationinsights/_help.py
@@ -154,14 +154,17 @@
         short-summary: Name of the API key to create.
       - name: --read-properties
         type: list
-        short-summary: A space seperated list of names of read Roles for this API key to inherit. Possible values include ReadTelemetry and AuthenticateSDKControlChannel.
+        short-summary: A space seperated list of names of read Roles for this API key to inherit. Possible values include ReadTelemetry, AuthenticateSDKControlChannel and "".
       - name: --write-properties
         type: list
-        short-summary: A space seperated list of names of write Roles for this API key to inherit. Possible values include WriteAnnotations.
+        short-summary: A space seperated list of names of write Roles for this API key to inherit. Possible values include WriteAnnotations and "".
     examples:
       - name: Create a component with kind web and location.
         text: |
           az monitor app-insights api-key create --api-key cli-demo --read-properties ReadTelemetry -g demoRg --app testApp
+      - name: Create a component with kind web and location without any permission
+        text: |
+          az monitor app-insights api-key create --api-key cli-demo --read-properties '""' --write-properties '""' -g demoRg --app testApp
 """
 
 helps['monitor app-insights metrics'] = """
diff --git a/src/application-insights/azext_applicationinsights/custom.py b/src/application-insights/azext_applicationinsights/custom.py
--- a/src/application-insights/azext_applicationinsights/custom.py
+++ b/src/application-insights/azext_applicationinsights/custom.py
@@ -143,6 +143,7 @@ def create_api_key(cmd, client, application, resource_group_name, api_key, read_
         read_properties = ['ReadTelemetry', 'AuthenticateSDKControlChannel']
     if write_properties is None:
         write_properties = ['WriteAnnotations']
+        logger.warning('Set write permission to "WriteAnnotations". This default permission will be removed in the future.')
     linked_read_properties, linked_write_properties = get_linked_properties(cmd.cli_ctx, application, resource_group_name, read_properties, write_properties)
     api_key_request = APIKeyRequest(name=api_key,
                                     linked_read_properties=linked_read_properties,
diff --git a/src/application-insights/setup.py b/src/application-insights/setup.py
--- a/src/application-insights/setup.py
+++ b/src/application-insights/setup.py
@@ -8,7 +8,7 @@
 from codecs import open
 from setuptools import setup, find_packages
 
-VERSION = "0.1.8"
+VERSION = "0.1.9"
 
 CLASSIFIERS = [
     'Development Status :: 4 - Beta',


Test patch: