Help/Param updates and minor tweaks/fixes

src/azure-cli/azure/cli/command_modules/iot/_help.py

@@ -402,6 +402,9 @@
   - name: Create an IoT Hub with the standard pricing tier S1 and 4 partitions, in the 'westus' region, with tags.
     text: >
         az iot hub create --resource-group MyResourceGroup --name MyIotHub --location westus --tags a=b c=d
+  - name: Create an IoT Hub with a system-assigned identity, and assign a role and scope to a storage account for the created system identity.
+    text: >
+        az iot hub create --resource-group MyResourceGroup --name MyIotHub --location westus --assign-identity [system] --role "Storage Blob Data Contributor" --scopes {resourceId}
 """
 
 helps['iot hub delete'] = """
@@ -428,6 +431,44 @@
         az iot hub devicestream show -n MyIotHub
 """
 
+helps['iot hub identity'] = """
+type: group
+short-summary: Manage identities of an Azure IoT hub.
+"""
+
+helps['iot hub identity assign'] = """
+type: command
+short-summary: Assign identities to an IoT Hub
+examples:
+  - name: Assign a user-assigned identity to an IoT Hub
+    text: >
+        az iot hub identity assign --name MyIoTHub --resource-group MyResourceGroup --identities {resourceId}
+  - name: Assign a system-assigned identity to an IoT Hub and assign a role to that identity.
+    text: >
+        az iot hub identity assign --name MyIoTHub --resource-group MyResourceGroup --identities [system] --role "Storage Blob Data Contributor" --scopes {resourceId}
+"""
+
+helps['iot hub identity show'] = """
+type: command
+short-summary: Show the identity properties of an IoT Hub
+examples:
+  - name: Show identity properties of an IoT Hub
+    text: >
+        az iot hub identity show --name MyIoTHub --resource-group MyResourceGroup
+"""
+
+helps['iot hub identity remove'] = """
+type: command
+short-summary: Remove identities from an IoT Hub
+examples:
+  - name: Remove a user-assigned identity to an IoT Hub
+    text: >
+        az iot hub identity remove --name MyIoTHub --resource-group MyResourceGroup --identities {resourceId}
+  - name: Remove a system-assigned identity from an IoT Hub.
+    text: >
+        az iot hub identity remove --name MyIoTHub --resource-group MyResourceGroup --identities [system]
+"""
+
 helps['iot hub list'] = """
 type: command
 short-summary: List IoT hubs.
@@ -781,7 +822,7 @@
         az iot hub update --name MyIoTHub --feedback-max-delivery-count 20 --feedback-lock-duration 100 --feedback-ttl 4
   - name: Update the IoT Hub file upload settings
     text: >
-        az iot hub update -n MyIoTHub --fileupload-sas-ttl 5 --fileupload-storage-auth-type identityBased
+        az iot hub update -n MyIoTHub --fileupload-sas-ttl 5 --fileupload-storage-auth-type identityBased --fileupload-storage-identity [system]
   - name: Update the IoT Hub file upload notification settings
     text: >
         az iot hub update -n MyIoTHub --fileupload-notification-max-delivery-count 50

src/azure-cli/azure/cli/command_modules/iot/_params.py

@@ -180,7 +180,8 @@ def load_arguments(self, _):  # pylint: disable=too-many-statements
                         ' between 1 and 24 hours.')
         c.argument('fileupload_storage_identity',
                    options_list=['--fileupload-storage-identity', '--fsi'],
-                   help='The managed identity to use for file upload authentication.')
+                   help="The managed identity to use for file upload authentication. Use '[system]' to "
+                        "refer to the system-assigned identity or a resource ID to refer to a user-assigned identity.")
         c.argument('min_tls_version', options_list=['--min-tls-version', '--mintls'],
                    type=str, help='Specify the minimum TLS version to support for this hub. Can be set to'
                                   ' "1.2" to have clients that use a TLS version below 1.2 to be rejected.')

src/azure-cli/azure/cli/command_modules/iot/custom.py

@@ -654,6 +654,7 @@ def setter(hub):
         else:
             hub.identity.type = IdentityType.user_assigned.value if hub.identity.user_assigned_identities else IdentityType.none.value
 
+        # TODO - remove if not necessary
         hub.identity.user_assigned_identities = hub.identity.user_assigned_identities or None
         poller = client.iot_hub_resource.begin_create_or_update(resource_group_name, hub_name, hub, {'IF-MATCH': hub.etag})
         return LongRunningOperation(cmd.cli_ctx)(poller)
@@ -819,8 +820,7 @@ def iot_hub_routing_endpoint_create(cmd, client, hub_name, endpoint_name, endpoi
                                     identity=None):
     resource_group_name = _ensure_resource_group_name(client, resource_group_name, hub_name)
     hub = iot_hub_get(cmd, client, hub_name, resource_group_name)
-
-    if identity and authentication_type != AuthenticationType.IDENTITY_BASED:
+    if identity and authentication_type.lower() != AuthenticationType.IdentityBased.value:
         raise CLIError("In order to use an identity for authentication, you must select --auth-type as 'identityBased'")
 
     if EndpointType.EventHub.value == endpoint_type.lower():
@@ -881,8 +881,11 @@ def iot_hub_routing_endpoint_create(cmd, client, hub_name, endpoint_name, endpoi
                 identity=ManagedIdentity(user_assigned_identity=identity) if identity not in [IdentityType.none.value, SYSTEM_IDENTITY] else None
             )
         )
-    return client.iot_hub_resource.begin_create_or_update(resource_group_name, hub_name, hub, {'IF-MATCH': hub.etag})
 
+    # TODO : remove if not necessary
+    hub.identity.user_assigned_identities = hub.identity.user_assigned_identities or None
+
+    return client.iot_hub_resource.begin_create_or_update(resource_group_name, hub_name, hub, {'IF-MATCH': hub.etag})
 
 def iot_hub_routing_endpoint_list(cmd, client, hub_name, endpoint_type=None, resource_group_name=None):
     resource_group_name = _ensure_resource_group_name(client, resource_group_name, hub_name)