grant-azurermsnapshotaccess returning null accesssas

[ikiris04]

Description

grant-azurermsnapshotaccess returns an object with accesssas equal to null in azurerm.compute 4.0.0 and up (including 4.6.0). Last version that works correctly is 3.4.1

Debug shows that http response contains accesssas but the cmdlet is not returning it

Script/Steps for Reproduction

#create storage snapshot
$debugpreference = 'Continue'
$returnsas=Grant-AzureRmSnapshotAccess -ResourceGroupName rgimagebuild -SnapshotName rhel7-snapshot -access read -DurationInSecond 7200
#returnsas.accesssas is null

Module Version

PS C:> Get-Module -Name azurerm -ListAvailable

Directory: C:\Program Files\WindowsPowerShell\Modules

ModuleType Version Name ExportedCommands

---

Script 5.7.0 AzureRM
Script 5.4.1 AzureRM
Script 5.1.1 AzureRM
Script 4.3.1 AzureRM
Script 4.2.0 AzureRM

PS C:> Get-Module -Name azurerm.compute -ListAvailable

Directory: C:\Program Files\WindowsPowerShell\Modules

ModuleType Version Name ExportedCommands

---

Script 4.6.0 AzureRM.Compute {Remove-AzureRmAvailabilitySet, Get-AzureRmAvailabilitySet...
Script 4.3.2 AzureRM.Compute {Remove-AzureRmAvailabilitySet, Get-AzureRmAvailabilitySet...
Script 4.1.1 AzureRM.Compute {Remove-AzureRmAvailabilitySet, Get-AzureRmAvailabilitySet...
Script 4.0.0 AzureRM.Compute {Remove-AzureRmAvailabilitySet, Get-AzureRmAvailabilitySet...
Script 3.4.1 AzureRM.Compute {Remove-AzureRmAvailabilitySet, Get-AzureRmAvailabilitySet...
Script 3.3.1 AzureRM.Compute {Remove-AzureRmAvailabilitySet, Get-AzureRmAvailabilitySet...
Script 3.2.0 AzureRM.Compute {Remove-AzureRmAvailabilitySet, Get-AzureRmAvailabilitySet...

Environment Data

PS C:> $psversiontable

Name Value

---

PSVersion 5.1.15063.966
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.15063.966
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1

Debug Output

<!-- Please run the above script with $DebugPreference = "Continue" and paste the resulting debug stream in the below code block -->


PS C:\> $debugpreference = 'Continue'
PS C:\>  Grant-AzureRmSnapshotAccess -ResourceGroupName rgimagebuild -SnapshotName rhel7-euw1-p01us-snapshot -access Rea
d -DurationInSecond 7200
DEBUG: 4:12:04 PM - GrantAzureRmSnapshotAccess begin processing with ParameterSet 'DefaultParameter'.
DEBUG: 4:12:04 PM - using account id '<redacted>'...
DEBUG: [Common.Authentication]: Authenticating using Account: '<redacted>', environment: 'AzureCloud',
tenant: '<redacted>'
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:04: 053739c3-e949-4362-b4e7-46ab4fee5684 - AcquireTokenHandlerBase: === Token Acquisition
started:
 Authority: https://login.microsoftonline.com/<redacted>/
 Resource: https://management.core.windows.net/
 ClientId: 1950a258-227b-4e31-a9cf-717495945fc2
 CacheType: Microsoft.Azure.Commands.Common.Authentication.AuthenticationStoreTokenCache (2 items)
 Authentication Target: User

DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Verbose: 1 :
DEBUG: 04/13/2018 23:12:04: 053739c3-e949-4362-b4e7-46ab4fee5684 - TokenCache: Looking up cache for a token...
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:04: 053739c3-e949-4362-b4e7-46ab4fee5684 - TokenCache: An item matching the requested resource
was found in the cache
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Verbose: 1 :
DEBUG: 04/13/2018 23:12:04: 053739c3-e949-4362-b4e7-46ab4fee5684 - TokenCache: 52.6072823133333 minutes left until
token in cache expires
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:04: 053739c3-e949-4362-b4e7-46ab4fee5684 - TokenCache: A matching item (access token or refresh
 token or both) was found in the cache
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:04: 053739c3-e949-4362-b4e7-46ab4fee5684 - AcquireTokenHandlerBase: === Token Acquisition
finished successfully. An access token was retuned:
 Access Token Hash: 4qQLj12qYWkL3roCjUOvhWcuIELOEotIV1VI9h+dyts=
 Refresh Token Hash: gp7Fs7JL2lxMtWKEUYDgMEn3YYzcsISgOvME4gk55d8=
 Expiration Time: 04/14/2018 00:04:40 +00:00
 User Hash: YajMusBtYseWr2tqUvOEfmgMR3gKk1QaGU42yWuYOBU=

DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:04:  - TokenCache: Serializing token cache with 2 items.
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:04: d4a4c3b6-8aac-47eb-b59f-9416ba7f2deb - AcquireTokenHandlerBase: === Token Acquisition
started:
 Authority: https://login.microsoftonline.com/<redacted>/
 Resource: https://management.core.windows.net/
 ClientId: 1950a258-227b-4e31-a9cf-717495945fc2
 CacheType: Microsoft.Azure.Commands.Common.Authentication.AuthenticationStoreTokenCache (2 items)
 Authentication Target: User

DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Verbose: 1 :
DEBUG: 04/13/2018 23:12:04: d4a4c3b6-8aac-47eb-b59f-9416ba7f2deb - TokenCache: Looking up cache for a token...
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:04: d4a4c3b6-8aac-47eb-b59f-9416ba7f2deb - TokenCache: An item matching the requested resource
was found in the cache
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Verbose: 1 :
DEBUG: 04/13/2018 23:12:04: d4a4c3b6-8aac-47eb-b59f-9416ba7f2deb - TokenCache: 52.6054067533333 minutes left until
token in cache expires
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:04: d4a4c3b6-8aac-47eb-b59f-9416ba7f2deb - TokenCache: A matching item (access token or refresh
 token or both) was found in the cache
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:04: d4a4c3b6-8aac-47eb-b59f-9416ba7f2deb - AcquireTokenHandlerBase: === Token Acquisition
finished successfully. An access token was retuned:
 Access Token Hash: 4qQLj12qYWkL3roCjUOvhWcuIELOEotIV1VI9h+dyts=
 Refresh Token Hash: gp7Fs7JL2lxMtWKEUYDgMEn3YYzcsISgOvME4gk55d8=
 Expiration Time: 04/14/2018 00:04:40 +00:00
 User Hash: YajMusBtYseWr2tqUvOEfmgMR3gKk1QaGU42yWuYOBU=

DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:04:  - TokenCache: Serializing token cache with 2 items.
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
POST

Absolute Uri:
https://management.azure.com/subscriptions/<redacted>/resourceGroups/rgimagebuild/providers/M
icrosoft.Compute/snapshots/rhel7-euw1-p01us-snapshot/beginGetAccess?api-version=2018-04-01

Headers:
x-ms-client-request-id        : f62fcc87-28a8-4fcf-8cf1-409eb2d8419d
accept-language               : en-US

Body:
{
  "access": "Read",
  "durationInSeconds": 7200
}

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
Accepted

Headers:
Pragma                        : no-cache
Azure-AsyncOperation          :
https://management.azure.com/subscriptions/<redacted>/providers/Microsoft.Compute/locations/w
esteurope/DiskOperations/4c3e1afc-c3cd-4f89-9f50-f2d104c3fac1?api-version=2018-04-01
x-ms-ratelimit-remaining-resource:
Microsoft.Compute/HighCostSnapshotCreateHydrate3Min;239,Microsoft.Compute/HighCostSnapshotCreateHydrate30Min;1194
Strict-Transport-Security     : max-age=31536000; includeSubDomains
x-ms-served-by                : 5749f747-ce36-45de-b2b8-3e734c5abf69_131652735666289094
x-ms-request-id               : 4c3e1afc-c3cd-4f89-9f50-f2d104c3fac1
Cache-Control                 : no-cache
Location                      :
https://management.azure.com/subscriptions/<redacted>/providers/Microsoft.Compute/locations/w
esteurope/DiskOperations/4c3e1afc-c3cd-4f89-9f50-f2d104c3fac1?monitor=true&api-version=2018-04-01
Server                        : Microsoft-HTTPAPI/2.0,Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-writes: 1199
x-ms-correlation-request-id   : f6510914-1c48-4e72-b54b-1ba37b9e1efc
x-ms-routing-request-id       : CANADAEAST:20180413T231206Z:f6510914-1c48-4e72-b54b-1ba37b9e1efc
X-Content-Type-Options        : nosniff
Date                          : Fri, 13 Apr 2018 23:12:05 GMT

Body:


DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:36: 4a2641ef-2d79-4086-a532-710aec66f235 - AcquireTokenHandlerBase: === Token Acquisition
started:
 Authority: https://login.microsoftonline.com/<redacted>/
 Resource: https://management.core.windows.net/
 ClientId: 1950a258-227b-4e31-a9cf-717495945fc2
 CacheType: Microsoft.Azure.Commands.Common.Authentication.AuthenticationStoreTokenCache (2 items)
 Authentication Target: User

DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Verbose: 1 :
DEBUG: 04/13/2018 23:12:36: 4a2641ef-2d79-4086-a532-710aec66f235 - TokenCache: Looking up cache for a token...
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:36: 4a2641ef-2d79-4086-a532-710aec66f235 - TokenCache: An item matching the requested resource
was found in the cache
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Verbose: 1 :
DEBUG: 04/13/2018 23:12:36: 4a2641ef-2d79-4086-a532-710aec66f235 - TokenCache: 52.0744087566667 minutes left until
token in cache expires
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:36: 4a2641ef-2d79-4086-a532-710aec66f235 - TokenCache: A matching item (access token or refresh
 token or both) was found in the cache
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:36: 4a2641ef-2d79-4086-a532-710aec66f235 - AcquireTokenHandlerBase: === Token Acquisition
finished successfully. An access token was retuned:
 Access Token Hash: 4qQLj12qYWkL3roCjUOvhWcuIELOEotIV1VI9h+dyts=
 Refresh Token Hash: gp7Fs7JL2lxMtWKEUYDgMEn3YYzcsISgOvME4gk55d8=
 Expiration Time: 04/14/2018 00:04:40 +00:00
 User Hash: YajMusBtYseWr2tqUvOEfmgMR3gKk1QaGU42yWuYOBU=

DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:36:  - TokenCache: Serializing token cache with 2 items.
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions/<redacted>/providers/Microsoft.Compute/locations/w
esteurope/DiskOperations/4c3e1afc-c3cd-4f89-9f50-f2d104c3fac1?api-version=2018-04-01

Headers:

Body:


DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Pragma                        : no-cache
x-ms-ratelimit-remaining-resource: Microsoft.Compute/GetOperation3Min;49998,Microsoft.Compute/GetOperation30Min;249987
Strict-Transport-Security     : max-age=31536000; includeSubDomains
x-ms-served-by                : 5749f747-ce36-45de-b2b8-3e734c5abf69_131652735666289094
x-ms-request-id               : fe025dd2-a2a7-4c9d-bea7-35a6698dc0f6
Cache-Control                 : no-cache
Server                        : Microsoft-HTTPAPI/2.0,Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-reads: 14995
x-ms-correlation-request-id   : 0166a2b8-7182-4bfa-a62e-b2e7498237ba
x-ms-routing-request-id       : CANADAEAST:20180413T231236Z:0166a2b8-7182-4bfa-a62e-b2e7498237ba
X-Content-Type-Options        : nosniff
Date                          : Fri, 13 Apr 2018 23:12:35 GMT

Body:
{
  "startTime": "2018-04-13T16:12:06.1866061-07:00",
  "endTime": "2018-04-13T16:12:06.4678771-07:00",
  "status": "Succeeded",
  "properties": {
    "output": {
      "accessSAS":
"https://md-qj031qp44q1c.blob.core.windows.net/bsrskqfxnpd4/abcd?sv=2017-04-17&sr=b&si=28bd26ad-ed18-459c-b7cb-c146a05f
9a49&sig=yJlhVz5r82pxgokgjh%2BUUBN378GPp1T2R8ZN52UxYGE%3D"
    }
  },
  "name": "4c3e1afc-c3cd-4f89-9f50-f2d104c3fac1"
}

DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:37: 5377100d-c534-4e7c-af04-7dec791bbbc1 - AcquireTokenHandlerBase: === Token Acquisition
started:
 Authority: https://login.microsoftonline.com/<redacted>/
 Resource: https://management.core.windows.net/
 ClientId: 1950a258-227b-4e31-a9cf-717495945fc2
 CacheType: Microsoft.Azure.Commands.Common.Authentication.AuthenticationStoreTokenCache (2 items)
 Authentication Target: User

DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Verbose: 1 :
DEBUG: 04/13/2018 23:12:37: 5377100d-c534-4e7c-af04-7dec791bbbc1 - TokenCache: Looking up cache for a token...
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:37: 5377100d-c534-4e7c-af04-7dec791bbbc1 - TokenCache: An item matching the requested resource
was found in the cache
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Verbose: 1 :
DEBUG: 04/13/2018 23:12:37: 5377100d-c534-4e7c-af04-7dec791bbbc1 - TokenCache: 52.0610018716667 minutes left until
token in cache expires
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:37: 5377100d-c534-4e7c-af04-7dec791bbbc1 - TokenCache: A matching item (access token or refresh
 token or both) was found in the cache
DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:37: 5377100d-c534-4e7c-af04-7dec791bbbc1 - AcquireTokenHandlerBase: === Token Acquisition
finished successfully. An access token was retuned:
 Access Token Hash: 4qQLj12qYWkL3roCjUOvhWcuIELOEotIV1VI9h+dyts=
 Refresh Token Hash: gp7Fs7JL2lxMtWKEUYDgMEn3YYzcsISgOvME4gk55d8=
 Expiration Time: 04/14/2018 00:04:40 +00:00
 User Hash: YajMusBtYseWr2tqUvOEfmgMR3gKk1QaGU42yWuYOBU=

DEBUG: Microsoft.IdentityModel.Clients.ActiveDirectory Information: 2 :
DEBUG: 04/13/2018 23:12:37:  - TokenCache: Serializing token cache with 2 items.
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions/<redacted>/providers/Microsoft.Compute/locations/w
esteurope/DiskOperations/4c3e1afc-c3cd-4f89-9f50-f2d104c3fac1?monitor=true&api-version=2018-04-01

Headers:

Body:


DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Pragma                        : no-cache
x-ms-ratelimit-remaining-resource: Microsoft.Compute/GetOperation3Min;49997,Microsoft.Compute/GetOperation30Min;249986
Strict-Transport-Security     : max-age=31536000; includeSubDomains
x-ms-served-by                : 5749f747-ce36-45de-b2b8-3e734c5abf69_131652735666289094
x-ms-request-id               : b6b61a42-11a2-499a-a12d-8577a182f3c8
Cache-Control                 : no-cache
Server                        : Microsoft-HTTPAPI/2.0,Microsoft-HTTPAPI/2.0
x-ms-ratelimit-remaining-subscription-reads: 14994
x-ms-correlation-request-id   : d558f23d-44e7-4574-b006-ea585014989a
x-ms-routing-request-id       : CANADAEAST:20180413T231237Z:d558f23d-44e7-4574-b006-ea585014989a
X-Content-Type-Options        : nosniff
Date                          : Fri, 13 Apr 2018 23:12:36 GMT

Body:
{
  "accessSAS":
"https://md-qj031qp44q1c.blob.core.windows.net/bsrskqfxnpd4/abcd?sv=2017-04-17&sr=b&si=28bd26ad-ed18-459c-b7cb-c146a05f
9a49&sig=yJlhVz5r82pxgokgjh%2BUUBN378GPp1T2R8ZN52UxYGE%3D"
}




DEBUG: AzureQoSEvent: CommandName - Grant-AzureRmSnapshotAccess; IsSuccess - True; Duration - 00:00:33.9046790;
Exception - ;
DEBUG: Finish sending metric.
DEBUG: 4:12:39 PM - GrantAzureRmSnapshotAccess end processing.
DEBUG: 4:12:39 PM - GrantAzureRmSnapshotAccess end processing.

[maddieclayton]

@hyonholee @huangpf Can you take a look at this issue?

[ikiris04]

Is there any update?

[liminany]

I have same problem,Is there any update?

[maddieclayton]

@hyonholee @huangpf Is there any update on this issue?

[hyonholee]

There is an issue with the Swagger spec and client library. We will fix it soon. Thanks.

[imaculate]

Similar problem with Grant-AzureRmDiskAccess

[jeanfrancoislarente]

This just started happening for me. Is there a workaround?

$osSAS = Grant-AzureRmSnapshotAccess -ResourceGroupName $snapshotResourceGroupName -SnapshotName $osSnapshotName -DurationInSecond $sasExpiryDuration -Access Read

I get a null AccessSAS result.

[v-tisheg]

I was getting this recently as well. None of my team was able to get it to work either. Timothy Shegrud Support Engineer Cloud & Infrastructure Solutions Customer Services & Support | Microsoft Corporation (425) 706-4408; * v-tisheg@microsoft.com<mailto:v-tisheg@microsoft.com> | Hours: Sun - Thur, 8:00am-5:00pm PST Need help outside of my working hours for a technical issue? *: AzBackup@microsoft.com<mailto:AzBackup@microsoft.com> Meeting and exceeding your expectations are my top priorities. We are interested in any feedback you might have about the service you received on this incident. Please let my Manager, Martin Rosales know what you think of the level of service provided, by contacting him via email at v-rosmar@microsoft.com<mailto:v-rosmar@microsoft.com>. [cid:image001.png@01D2DECD.52D68C60] [cid:image002.jpg@01D2DECD.52D68C60] From: J.F. Larente [mailto:notifications@github.com] Sent: Monday, May 14, 2018 9:39 AM To: Azure/azure-powershell <azure-powershell@noreply.github.com> Cc: Subscribed <subscribed@noreply.github.com> Subject: Re: [Azure/azure-powershell] grant-azurermsnapshotaccess returning null accesssas (#5956) This just started happening for me. Is there a workaround? $osSAS = Grant-AzureRmSnapshotAccess -ResourceGroupName $snapshotResourceGroupName -SnapshotName $osSnapshotName -DurationInSecond $sasExpiryDuration -Access Read I get a null AccessSAS result. — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.amrom.workers.dev%2FAzure%2Fazure-powershell%2Fissues%2F5956%23issuecomment-388881933&data=02%7C01%7Cv-tisheg%40microsoft.com%7C97916228d64840f04b3508d5b9b9322f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636619127420917418&sdata=H3TR%2FK%2Fmb%2BdZ%2FRzUTjuFTVgPVlcovRXeT%2BibCuJBjfA%3D&reserved=0>, or mute the thread<https://na01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.amrom.workers.dev%2Fnotifications%2Funsubscribe-auth%2FAjuECf_VHNBbgMMJlgAl8svqCwLERis0ks5tybMjgaJpZM4TU1Fu&data=02%7C01%7Cv-tisheg%40microsoft.com%7C97916228d64840f04b3508d5b9b9322f%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C636619127420927431&sdata=y0Q15I3gdumbtt%2BEQTHPJGt9%2B5Laay6ygonl8S7yWGc%3D&reserved=0>.

[ikiris04]

You can call az cli from within powershell to get the sas

https://docs.microsoft.com/en-us/cli/azure/snapshot

I tested this but didn’t work thron ugh the whole syntax

[praries880]

@hyonholee Is there a known workaround for the issue?

[jeanfrancoislarente]

Thanks for the workaround @ikiris04, I (temporarily) changed my script to:

$osSAS=$(az snapshot grant-access -g $snapshotResourceGroupName -n $osSnapshotName --duration-in-seconds $sasExpiryDuration -o tsv)