[App Service] az webapp config egress: Add egress configuration and connection management

src/azure-cli/azure/cli/command_modules/appservice/_constants.py

@@ -20,6 +20,9 @@
     'I1MV4', 'I2MV4', 'I3MV4', 'I4MV4', 'I5MV4'
 ]
 FUNCTIONS_VERSIONS = ['4']
+EGRESS_PROTOCOLS = ['Http', 'Postgres', 'Redis', 'Tds']
+EGRESS_AUTH_TYPES = ['Credential', 'ManagedIdentity']
+EGRESS_SOURCES = ['AppSettings', 'ConnectionStrings']
 LOGICAPPS_NODE_RUNTIME_VERSIONS = ['~14', '~16', '~18']
 FUNCTIONS_LINUX_RUNTIME_VERSION_REGEX = r"^.*\|(.*)$"
 FUNCTIONS_WINDOWS_RUNTIME_VERSION_REGEX = r"^~(.*)$"

src/azure-cli/azure/cli/command_modules/appservice/_help.py

@@ -1473,6 +1473,106 @@
 short-summary: Configure a web app.
 """
 
+helps['webapp config egress'] = """
+type: group
+short-summary: Manage virtualized backend connections for a web app.
+"""
+
+helps['webapp config egress set'] = """
+type: command
+short-summary: Set the enabled state of a web app's egress configuration.
+long-summary: |
+  Read the existing egress configuration, update its enabled state, and write it back while
+  preserving all connections and their settings, identities, and credential injection configuration.
+  --enabled is required. Use --enabled true to enable virtual connections or --enabled false to disable them.
+  Add at least one connection with "az webapp config egress connection add" before enabling or disabling egress.
+  Manage individual connections with "az webapp config egress connection add" and
+  "az webapp config egress connection remove".
+examples:
+  - name: Enable virtual connections without modifying any connection definitions.
+    text: az webapp config egress set --resource-group MyRG --name MyApp --enabled true
+  - name: Disable virtual connections for a deployment slot while preserving its connections.
+    text: az webapp config egress set --resource-group MyRG --name MyApp --slot staging --enabled false
+  - name: Enable virtual connections using the flag without a value.
+    text: az webapp config egress set --resource-group MyRG --name MyApp --enabled
+"""
+
+helps['webapp config egress show'] = """
+type: command
+short-summary: Show the egress configuration for a web app.
+examples:
+  - name: Show the enabled state and all connections.
+    text: az webapp config egress show --resource-group MyRG --name MyApp
+  - name: Show only the connections for a deployment slot.
+    text: az webapp config egress show --resource-group MyRG --name MyApp --slot staging --query properties.connections
+"""
+
+helps['webapp config egress connection'] = """
+type: group
+short-summary: Manage named connections in a web app's egress configuration.
+"""
+
+helps['webapp config egress connection add'] = """
+type: command
+short-summary: Add or replace a named egress connection.
+long-summary: |
+  Preserve other connections and the enabled state. An existing connection with the same name
+  is replaced, regardless of casing. Only the supplied connection is returned.
+  If the enabled state is missing, initialize it to Disabled. Use "az webapp config egress set
+  --enabled true" to enable virtual connections after adding a connection.
+  Setting arguments accept existing setting names, not their values. The platform validates
+  protocol and authentication combinations. Managed identities must already be assigned to the app.
+examples:
+  - name: Add a SQL connection that uses managed identity and an existing connection string.
+    text: >-
+      az webapp config egress connection add --resource-group MyRG --name MyApp
+      --connection-name orders-db --source ConnectionStrings --protocol Tds --auth ManagedIdentity
+      --value-setting OrdersDb
+  - name: Add a PostgreSQL connection composed of separate app settings.
+    text: >-
+      az webapp config egress connection add --resource-group MyRG --name MyApp
+      --connection-name postgres --source AppSettings --protocol Postgres --auth Credential
+      --host-setting PG_HOST --username-setting PG_USER --credential-setting PG_PASSWORD
+  - name: Use a user-assigned identity with a custom token scope for a deployment slot.
+    text: >-
+      az webapp config egress connection add --resource-group MyRG --name MyApp --slot staging
+      --connection-name api --protocol Http --auth ManagedIdentity --host-setting API_HOST
+      --identity-resource-id /subscriptions/00000000-0000-0000-0000-000000000000/resourceGroups/MyRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/MyIdentity
+      --identity-scope https://storage.azure.com/.default
+  - name: Inject an HTTP credential using a header format.
+    text: >-
+      az webapp config egress connection add --resource-group MyRG --name MyApp
+      --connection-name api --protocol Http --auth Credential --host-setting API_HOST
+      --credential-setting API_TOKEN --credential-header Authorization --credential-format "Bearer {value}"
+"""
+
+helps['webapp config egress connection remove'] = """
+type: command
+short-summary: Remove a named egress connection.
+long-summary: |
+  Preserve other connections and the enabled state unless the last connection is removed.
+  Removing the last connection clears the entire egress configuration, including its enabled state.
+  A warning is shown and confirmation is required only when removing the last connection.
+  Use --yes or -y to skip confirmation for automation; the warning is still shown.
+examples:
+  - name: Remove the orders database connection.
+    text: az webapp config egress connection remove --resource-group MyRG --name MyApp --connection-name orders-db
+  - name: Remove a connection from a deployment slot.
+    text: az webapp config egress connection remove --resource-group MyRG --name MyApp --slot staging --connection-name cache
+  - name: Remove the last connection without prompting for confirmation.
+    text: az webapp config egress connection remove --resource-group MyRG --name MyApp --connection-name cache --yes
+"""
+
+helps['webapp config egress connection show'] = """
+type: command
+short-summary: Show a named egress connection.
+examples:
+  - name: Show the orders database connection.
+    text: az webapp config egress connection show --resource-group MyRG --name MyApp --connection-name orders-db
+  - name: Show the setting roles for a connection in a deployment slot.
+    text: az webapp config egress connection show --resource-group MyRG --name MyApp --slot staging --connection-name cache --query settings
+"""
+
 helps['webapp config access-restriction'] = """
 type: group
 short-summary: Methods that show, set, add, and remove access restrictions on a webapp

src/azure-cli/azure/cli/command_modules/appservice/_params.py

@@ -20,7 +20,7 @@
 from ._completers import get_hostname_completion_list
 from ._constants import (FUNCTIONS_VERSIONS, LOGICAPPS_NODE_RUNTIME_VERSIONS, WINDOWS_OS_NAME, LINUX_OS_NAME,
                          DEPLOYMENT_STORAGE_AUTH_TYPES, UPDATE_STRATEGY_TYPES, ISOLATED_V4_SKUS,
-                         FLEX_REGISTRY_AUTH_TYPES)
+                         EGRESS_PROTOCOLS, EGRESS_AUTH_TYPES, EGRESS_SOURCES, FLEX_REGISTRY_AUTH_TYPES)
 
 from ._validators import (validate_timeout_value, validate_site_create, validate_asp_create,
                           validate_ase_create, validate_ip_address,
@@ -929,6 +929,31 @@ def load_arguments(self, _):
                            scope))
             c.argument('setting_names', nargs='+', help="space-separated {} names".format(scope))
 
+    with self.argument_context('webapp config egress set') as c:
+        c.argument('enabled', arg_type=get_three_state_flag(), required=True,
+                   help='Enable virtual connections with true or disable them with false.')
+
+    with self.argument_context('webapp config egress connection') as c:
+        c.argument('connection_name', help='Name of the egress connection. Names are case-insensitive.')
+
+    with self.argument_context('webapp config egress connection remove') as c:
+        c.argument('yes', options_list=['--yes', '-y'], action='store_true',
+                   help='Do not prompt for confirmation when removing the last connection.')
+
+    with self.argument_context('webapp config egress connection add') as c:
+        c.argument('protocol', arg_type=get_enum_type(EGRESS_PROTOCOLS), help='Backend protocol.')
+        c.argument('auth', arg_type=get_enum_type(EGRESS_AUTH_TYPES), help='Backend authentication strategy.')
+        c.argument('source', arg_type=get_enum_type(EGRESS_SOURCES),
+                   help='Source of the referenced settings. Defaults to AppSettings.')
+        c.argument('host_setting', help='Name of the setting containing the backend host, not the host value.')
+        c.argument('credential_setting', help='Name of the setting containing the credential, not the credential value.')
+        c.argument('username_setting', help='Name of the setting containing the username, not the username value.')
+        c.argument('value_setting', help='Name of the setting containing the complete connection string or URL.')
+        c.argument('identity_resource_id', help='Resource ID of a user-assigned identity already assigned to the app. By default, use the system-assigned identity.')
+        c.argument('identity_scope', help='Scope used to acquire a managed identity token for the backend connection.')
+        c.argument('credential_header', help='HTTP header used to inject a standalone credential, for example Authorization.')
+        c.argument('credential_format', help='HTTP credential header format, for example "Bearer {value}". Requires --credential-header.')
+
     with self.argument_context('webapp config connection-string') as c:
         c.argument('connection_string_type', options_list=['--connection-string-type', '-t'],
                    help='connection string type', arg_type=get_enum_type(ConnectionStringType))

src/azure-cli/azure/cli/command_modules/appservice/aaz/latest/web/__cmd_group.py

@@ -0,0 +1,20 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+#
+# Code generated by aaz-dev-tools
+# --------------------------------------------------------------------------------------------
+
+# pylint: skip-file
+# flake8: noqa
+
+from azure.cli.core.aaz import *
+
+
+class __CMDGroup(AAZCommandGroup):
+    """Manage Web
+    """
+    pass
+
+
+__all__ = ["__CMDGroup"]

src/azure-cli/azure/cli/command_modules/appservice/aaz/latest/web/__init__.py

@@ -0,0 +1,11 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+#
+# Code generated by aaz-dev-tools
+# --------------------------------------------------------------------------------------------
+
+# pylint: skip-file
+# flake8: noqa
+
+from .__cmd_group import *

src/azure-cli/azure/cli/command_modules/appservice/aaz/latest/web/site/__cmd_group.py

@@ -0,0 +1,20 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+#
+# Code generated by aaz-dev-tools
+# --------------------------------------------------------------------------------------------
+
+# pylint: skip-file
+# flake8: noqa
+
+from azure.cli.core.aaz import *
+
+
+class __CMDGroup(AAZCommandGroup):
+    """Manage Site
+    """
+    pass
+
+
+__all__ = ["__CMDGroup"]

src/azure-cli/azure/cli/command_modules/appservice/aaz/latest/web/site/__init__.py

@@ -0,0 +1,11 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+#
+# Code generated by aaz-dev-tools
+# --------------------------------------------------------------------------------------------
+
+# pylint: skip-file
+# flake8: noqa
+
+from .__cmd_group import *

src/azure-cli/azure/cli/command_modules/appservice/aaz/latest/web/site/config/__cmd_group.py

@@ -0,0 +1,20 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+#
+# Code generated by aaz-dev-tools
+# --------------------------------------------------------------------------------------------
+
+# pylint: skip-file
+# flake8: noqa
+
+from azure.cli.core.aaz import *
+
+
+class __CMDGroup(AAZCommandGroup):
+    """Manage Config
+    """
+    pass
+
+
+__all__ = ["__CMDGroup"]

src/azure-cli/azure/cli/command_modules/appservice/aaz/latest/web/site/config/__init__.py

@@ -0,0 +1,11 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+#
+# Code generated by aaz-dev-tools
+# --------------------------------------------------------------------------------------------
+
+# pylint: skip-file
+# flake8: noqa
+
+from .__cmd_group import *

src/azure-cli/azure/cli/command_modules/appservice/aaz/latest/web/site/config/egress/__cmd_group.py

@@ -0,0 +1,20 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+#
+# Code generated by aaz-dev-tools
+# --------------------------------------------------------------------------------------------
+
+# pylint: skip-file
+# flake8: noqa
+
+from azure.cli.core.aaz import *
+
+
+class __CMDGroup(AAZCommandGroup):
+    """Manage Egress
+    """
+    pass
+
+
+__all__ = ["__CMDGroup"]

src/azure-cli/azure/cli/command_modules/appservice/aaz/latest/web/site/config/egress/__init__.py

@@ -0,0 +1,13 @@
+# --------------------------------------------------------------------------------------------
+# Copyright (c) Microsoft Corporation. All rights reserved.
+# Licensed under the MIT License. See License.txt in the project root for license information.
+#
+# Code generated by aaz-dev-tools
+# --------------------------------------------------------------------------------------------
+
+# pylint: skip-file
+# flake8: noqa
+
+from .__cmd_group import *
+from ._create import *
+from ._show import *