Repository: rclone/rclone
File: backend/azureblob/azureblob.go (Go)

Code before:

// Register with Fs
func init() {
	fs.Register(&fs.RegInfo{
		Name:        "azureblob",
		Description: "Microsoft Azure Blob Storage",
		NewFs:       NewFs,
		Options: []fs.Option{{
			Name: "account",
			Help: "Storage Account Name.\n\nLeave blank to use SAS URL or Emulator.",
		}, {
			Name: "service_principal_file",
			Help: `Path to file containing credentials for use with a service principal.

Leave blank normally. Needed only if you want to use a service principal instead of interactive login.

    $ az ad sp create-for-rbac --name "<name>" \
      --role "Storage Blob Data Owner" \
      --scopes "/subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>/blobServices/default/containers/<container>" \
      > azure-principal.json

See ["Create an Azure service principal"](https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli) and ["Assign an Azure role for access to blob data"](https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-rbac-cli) pages for more details.
`,
		}, {
			Name: "use_env_creds",
			Help: `Pull credentials from AZURE_TENANT_ID and AZURE_CLIENT_{ID,SECRET} env vars a la EnvironmentCredential.`,
			Default: false,
		}, {
			Name: "key",
			Help: "Storage Account Key.\n\nLeave blank to use SAS URL or Emulator.",
		}, {
			Name: "sas_url",
			Help: "SAS URL for container level access only.\n\nLeave blank if using account/key or Emulator.",
		}, {
			Name: "use_msi",
			Help: `Use a managed service identity to authenticate (only works in Azure).

When true, use a [managed service identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/)
to authenticate to Azure Storage instead of a SAS token or account key.

If the VM(SS) on which this program is running has a system-assigned identity, it will
be used by default. If the resource has no system-assigned but exactly one user-assigned identity,
the user-assigned identity will be used by default. If the resource has multiple user-assigned
identities, the identity to use must be explicitly specified using exactly one of the msi_object_id,
msi_client_id, or msi_mi_res_id parameters.`,
			Default: false,
		}, {
			Name:     "msi_object_id",
			Help:     "Object ID of the user-assigned MSI to use, if any.\n\nLeave blank if msi_client_id or msi_mi_res_id specified.",
			Advanced: true,
		}, {

Review comment (security):
What does "env vars a la EnvironmentCredential" mean? I'm not sure what `EnvironmentCredential` is - is that a bit of Azure jargon? I  found the reference - I think we should try to make that a bit clearer.

Note that the first line of this `Help` is used for the help text of the command line option, so I suggest you shorten the first line, then put more explanation in subsequent lines.

Maybe something like this (adapted from the s3 env_auth)

```go
Help: `Read credentials from runtime (environment variables).

Only applies if service_principal_file is blank. ???Maybe we should be checking the other auth too???

Pull credentials from AZURE_TENANT_ID and AZURE_CLIENT_{ID,SECRET} environment vars.

See EnvironmentCredential in the Azure docs for more info.
```

Code after:

// Register with Fs
func init() {
	fs.Register(&fs.RegInfo{
		Name:        "azureblob",
		Description: "Microsoft Azure Blob Storage",
		NewFs:       NewFs,
		Options: []fs.Option{{
			Name: "account",
			Help: "Storage Account Name.\n\nLeave blank to use SAS URL or Emulator.",
		}, {
			Name: "service_principal_file",
			Help: `Path to file containing credentials for use with a service principal.

Leave blank normally. Needed only if you want to use a service principal instead of interactive login.

    $ az ad sp create-for-rbac --name "<name>" \
      --role "Storage Blob Data Owner" \
      --scopes "/subscriptions/<subscription>/resourceGroups/<resource-group>/providers/Microsoft.Storage/storageAccounts/<storage-account>/blobServices/default/containers/<container>" \
      > azure-principal.json

See ["Create an Azure service principal"](https://docs.microsoft.com/en-us/cli/azure/create-an-azure-service-principal-azure-cli) and ["Assign an Azure role for access to blob data"](https://docs.microsoft.com/en-us/azure/storage/common/storage-auth-aad-rbac-cli) pages for more details.
`,
		}, {
			Name: "env_auth",
			Help: `Read credentials from runtime (environment variables).

Pull credentials from AZURE_TENANT_ID and AZURE_CLIENT_{ID,SECRET} environment vars.
See EnvironmentCredential in the Azure docs for more info.

Other authentication methods will, if specified, override this flag.`,
			Default: false,
		}, {
			Name: "key",
			Help: "Storage Account Key.\n\nLeave blank to use SAS URL or Emulator.",
		}, {
			Name: "sas_url",
			Help: "SAS URL for container level access only.\n\nLeave blank if using account/key or Emulator.",
		}, {
			Name: "use_msi",
			Help: `Use a managed service identity to authenticate (only works in Azure).

When true, use a [managed service identity](https://docs.microsoft.com/en-us/azure/active-directory/managed-identities-azure-resources/)
to authenticate to Azure Storage instead of a SAS token or account key.

If the VM(SS) on which this program is running has a system-assigned identity, it will
be used by default. If the resource has no system-assigned but exactly one user-assigned identity,
the user-assigned identity will be used by default. If the resource has multiple user-assigned
identities, the identity to use must be explicitly specified using exactly one of the msi_object_id,
msi_client_id, or msi_mi_res_id parameters.`,
			Default: false,