Azure/azure-powershell

[Az.Resources] Get-AzDenyAssignment -DenyAssignmentName $name returns empty while it exists when operate list action.

Offen

#16.410 geöffnet am 16.11.2021

Auf GitHub ansehenContributor Guide
 (2 Kommentare) (1 Reaktion) (2 zugewiesene Personen)PowerShell (3.744 Forks)batch import
Authorizationact-identity-squadbuggood first issue

Repository-Metriken

Stars
 (4.102 Sterne)
PR-Merge-Metriken
 (Durchschn. Merge 10T 2h) (45 gemergte PRs in 30 T)

Beschreibung

Description

issue: Get-AzDenyAssignment -DenyAssignmentName $name returns empty while it exists while operate list action.

expected result: Get-AzDenyAssignment -DenyAssignmentName $name returns correctly.

Issue script & Debug output

$assignments = Get-AzDenyAssignment
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions/{subscriptions}/providers/Microsoft.Authorization/denyAssignments?api-version=2018-07-01-preview

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK
Body:
{
  "value": [
    {
      "properties": {
        "denyAssignmentName": "5184754b-6c52-436a-90a5-cae79bfbfea1",
        "description": "Deny assignment for ResourceGroup default",
        "permissions": [
          {
            "actions": [
              "*"
            ],
            "notActions": [
              "Microsoft.Storage/storageAccounts/privateEndpointConnectionsApproval/action",
              "Microsoft.Storage/storageAccounts/privateEndpointConnections/*",
              "Microsoft.Storage/storageAccounts/privateLinkResources/read",
              "Microsoft.EventHub/namespaces/privateEndpointConnectionsApproval/action",
              "Microsoft.EventHub/namespaces/privateEndpointConnections/*",
              "Microsoft.EventHub/namespaces/privateLinkResources/read",
              "Microsoft.Resources/deployments/validate/action",
              "Microsoft.Insights/DiagnosticSettings/*",
              "Microsoft.Insights/ExtendedDiagnosticSettings/*",
              "Microsoft.Security/*/action"
            ],
            "dataActions": [
              "*"
            ],
            "notDataActions": []
          }
        ],
        "scope": "/subscriptions/{subscriptions}/resourcegroups/x",
        "doNotApplyToChildScopes": false,
        "principals": [
          {
            "id": "00000000-0000-0000-0000-000000000000",
            "type": "SystemDefined"
          }
        ],
        "excludePrincipals": [
          {
            "id": "6ad9a4db-7591-4960-8b4c-69b1ce99c6d7",
            "type": "ServicePrincipal"
          },
          {
            "id": "4d712a4e-1897-4dd0-845f-452a5b82844e",
            "type": "ServicePrincipal"
          }
        ],
        "isSystemProtected": true,
        "createdOn": "2021-09-23T06:00:27.8908295Z",
        "updatedOn": "2021-09-23T06:00:27.6252699Z",
        "createdBy": "4d712a4e-1897-4dd0-845f-452a5b82844e",
        "updatedBy": "4d712a4e-1897-4dd0-845f-452a5b82844e"
      },
      "id": "/subscriptions/{subscriptions}/resourcegroups/x/providers/Microsoft.Authorization/denyAssignments/5184754b-6c52-436a-90a5-cae79bfbfea1",
      "type": "Microsoft.Authorization/denyAssignments",
      "name": "5184754b-6c52-436a-90a5-cae79bfbfea1"
    },
    {
      "properties": {
        "denyAssignmentName": "StoragePool Resource Provider Management Lock for MSP_bez-rg_bez-diskpool_eastus",
        "description": "Locks the Disk Pool managed resource group to all users, groups and service principals except the Storage Pool Resource Provider",
        "permissions": [
          {
            "actions": [
              "*"
            ],
            "notActions": [
              "*/read"
            ],
            "dataActions": [
              "*"
            ],
            "notDataActions": [
              "*/read"
            ]
          }
        ],
        "scope": "/subscriptions/{subscriptions}/resourcegroups/MSP_bez-rg_bez-diskpool_eastus",
        "doNotApplyToChildScopes": false,
        "principals": [
          {
            "id": "00000000-0000-0000-0000-000000000000",
            "type": "SystemDefined"
          }
        ],
        "excludePrincipals": [
          {
            "id": "5741a1ff-751d-4ad7-bcd1-dfe3c998fd11",
            "type": "ServicePrincipal"
          }
        ],
        "isSystemProtected": true,
        "createdOn": "2021-10-12T07:20:25.3813964Z",
        "updatedOn": "2021-10-12T07:20:25.0375574Z",
        "createdBy": "09f10f07-08cf-4ab7-be0f-e9ae3d72b9ad",
        "updatedBy": "09f10f07-08cf-4ab7-be0f-e9ae3d72b9ad"
      },
      "id": "/subscriptions/{subscriptions}/resourcegroups/MSP_bez-rg_bez-diskpool_eastus/providers/Microsoft.Authorization/denyAssignments/cf0159c5-be61-4b7f-b84c-7128046ca334",
      "type": "Microsoft.Authorization/denyAssignments",
      "name": "cf0159c5-be61-4b7f-b84c-7128046ca334"
    },
    {
      "properties": {
        "denyAssignmentName": "b2db6b8f-ad9a-4bda-8faf-c6b4d8356e7a",
        "description": "Deny assignment for ResourceGroup default",
        "permissions": [
          {
            "actions": [
              "*"
            ],
            "notActions": [
              "Microsoft.Storage/storageAccounts/privateEndpointConnectionsApproval/action",
              "Microsoft.Storage/storageAccounts/privateEndpointConnections/*",
              "Microsoft.Storage/storageAccounts/privateLinkResources/read",
              "Microsoft.EventHub/namespaces/privateEndpointConnectionsApproval/action",
              "Microsoft.EventHub/namespaces/privateEndpointConnections/*",
              "Microsoft.EventHub/namespaces/privateLinkResources/read",
              "Microsoft.Resources/deployments/validate/action",
              "Microsoft.Insights/DiagnosticSettings/*",
              "Microsoft.Insights/ExtendedDiagnosticSettings/*",
              "Microsoft.Security/*/action"
            ],
            "dataActions": [
              "*"
            ],
            "notDataActions": []
          }
        ],
        "scope": "/subscriptions/{subscriptions}/resourcegroups/managed-rg-fypurview",
        "doNotApplyToChildScopes": false,
        "principals": [
          {
            "id": "00000000-0000-0000-0000-000000000000",
            "type": "SystemDefined"
          }
        ],
        "excludePrincipals": [
          {
            "id": "1f348023-24b0-4d80-ab40-31ef7623c709",
            "type": "ServicePrincipal"
          },
          {
            "id": "4d712a4e-1897-4dd0-845f-452a5b82844e",
            "type": "ServicePrincipal"
          }
        ],
        "isSystemProtected": true,
        "createdOn": "2021-09-28T03:24:28.2671712Z",
        "updatedOn": "2021-09-28T03:24:27.9078023Z",
        "createdBy": "4d712a4e-1897-4dd0-845f-452a5b82844e",
        "updatedBy": "4d712a4e-1897-4dd0-845f-452a5b82844e"
      },
      "id": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourcegroups/managed-rg-fypurview/providers/Microsoft.Authorization/denyAssignments/b2db6b8f-ad9a-4bda-8faf-c6b4d8356e7a",
      "type": "Microsoft.Authorization/denyAssignments",
      "name": "b2db6b8f-ad9a-4bda-8faf-c6b4d8356e7a"
    },
    {
      "properties": {
        "denyAssignmentName": "7dbf8247-b1ed-440f-8324-8ceef880fa9e",
        "description": "Deny assignment for ResourceGroup default",
        "permissions": [
          {
            "actions": [
              "*"
            ],
            "notActions": [
              "Microsoft.Storage/storageAccounts/privateEndpointConnectionsApproval/action",
              "Microsoft.Storage/storageAccounts/privateEndpointConnections/*",
              "Microsoft.Storage/storageAccounts/privateLinkResources/read",
              "Microsoft.EventHub/namespaces/privateEndpointConnectionsApproval/action",
              "Microsoft.EventHub/namespaces/privateEndpointConnections/*",
              "Microsoft.EventHub/namespaces/privateLinkResources/read",
              "Microsoft.Resources/deployments/validate/action",
              "Microsoft.Insights/DiagnosticSettings/*",
              "Microsoft.Insights/ExtendedDiagnosticSettings/*",
              "Microsoft.Security/*/action"
            ],
            "dataActions": [
              "*"
            ],
            "notDataActions": []
          }
        ],
        "scope": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourcegroups/managed-rg-purview-msyyc",
        "doNotApplyToChildScopes": false,
        "principals": [
          {
            "id": "00000000-0000-0000-0000-000000000000",
            "type": "SystemDefined"
          }
        ],
        "excludePrincipals": [
          {
            "id": "c5c7034d-fd51-48ea-afdd-bb1aac5813e6",
            "type": "ServicePrincipal"
          },
          {
            "id": "4d712a4e-1897-4dd0-845f-452a5b82844e",
            "type": "ServicePrincipal"
          }
        ],
        "isSystemProtected": true,
        "createdOn": "2021-08-23T01:56:13.2120781Z",
        "updatedOn": "2021-09-16T03:45:47.4533902Z",
        "createdBy": "4d712a4e-1897-4dd0-845f-452a5b82844e",
        "updatedBy": "4d712a4e-1897-4dd0-845f-452a5b82844e"
      },
      "id": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourcegroups/managed-rg-purview-msyyc/providers/Microsoft.Authorization/denyAssignments/7dbf8247-b1ed-440f-8324-8ceef880fa9e",
      "type": "Microsoft.Authorization/denyAssignments",
      "name": "7dbf8247-b1ed-440f-8324-8ceef880fa9e"
    }
  ]
}


DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
POST

Absolute Uri:
https://graph.windows.net/54826b22-38d6-4fb2-bad9-b7b93a3e9c5a/getObjectsByObjectIds?api-version=1.6

Headers:
x-ms-client-request-id        : 6290fc57-89ee-490d-b8e3-cdee769c64e3
Accept-Language               : en-US

Body:
{
  "objectIds": [
    "6ad9a4db-7591-4960-8b4c-69b1ce99c6d7",
    "4d712a4e-1897-4dd0-845f-452a5b82844e",
    "5741a1ff-751d-4ad7-bcd1-dfe3c998fd11",
    "1f348023-24b0-4d80-ab40-31ef7623c709",
    "c5c7034d-fd51-48ea-afdd-bb1aac5813e6"
  ],
  "includeDirectoryObjectReferences": true
}


DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Body:
{
  "odata.metadata": "https://graph.windows.net/54826b22-38d6-4fb2-bad9-b7b93a3e9c5a/$metadata#directoryObjects",
  "value": [
    {
      "odata.type": "Microsoft.DirectoryServices.ServicePrincipal",
      "objectType": "ServicePrincipal",
      "objectId": "1f348023-24b0-4d80-ab40-31ef7623c709",
      "deletionTimestamp": null,
      "accountEnabled": true,
      "addIns": [],
      "alternativeNames": [
        "isExplicit=False",
        "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourcegroups/fypurview/providers/Microsoft.Purview/accounts/fypurview"
      ],
      "appDisplayName": null,
      "appId": "417e76dd-1492-4910-8121-22c0320b3412",
      "applicationTemplateId": null,
      "appOwnerTenantId": null,
      "appRoleAssignmentRequired": false,
      "appRoles": [],
      "displayName": "fypurview",
      "errorUrl": null,
      "homepage": null,
      "informationalUrls": null,
      "keyCredentials": [
        {
          "customKeyIdentifier": "E8264C24B1B90A3B1CB7002D8E85A830E8692272",
          "endDate": "2021-12-27T03:19:00Z",
          "keyId": "41f41e79-fe09-4074-985a-856920e3234f",
          "startDate": "2021-09-28T03:19:00Z",
          "type": "AsymmetricX509Cert",
          "usage": "Verify",
          "value": null
        }
      ],
      "logoutUrl": null,
      "notificationEmailAddresses": [],
      "oauth2Permissions": [],
      "passwordCredentials": [],
      "preferredSingleSignOnMode": null,
      "preferredTokenSigningKeyEndDateTime": null,
      "preferredTokenSigningKeyThumbprint": null,
      "publisherName": null,
      "replyUrls": [],
      "samlMetadataUrl": null,
      "samlSingleSignOnSettings": null,
      "servicePrincipalNames": [
        "417e76dd-1492-4910-8121-22c0320b3412",
        "https://identity.azure.net/LAa6VKqDUTQcwrFMKOfyvQUd6qAzheHXKd8n4MNir0g="
      ],
      "servicePrincipalType": "ManagedIdentity",
      "signInAudience": null,
      "tags": [],
      "tokenEncryptionKeyId": null
    },
    {
      "odata.type": "Microsoft.DirectoryServices.ServicePrincipal",
      "objectType": "ServicePrincipal",
      "objectId": "c5c7034d-fd51-48ea-afdd-bb1aac5813e6",
      "deletionTimestamp": null,
      "accountEnabled": true,
      "addIns": [],
      "alternativeNames": [
        "isExplicit=False",
        "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourcegroups/python-sdk-test/providers/Microsoft.Purview/accounts/purview-msyyc"
      ],
      "appDisplayName": null,
      "appId": "04731df8-6338-427f-8dcd-5fc7dab100bc",
      "applicationTemplateId": null,
      "appOwnerTenantId": null,
      "appRoleAssignmentRequired": false,
      "appRoles": [],
      "displayName": "purview-msyyc",
      "errorUrl": null,
      "homepage": null,
      "informationalUrls": null,
      "keyCredentials": [
        {
          "customKeyIdentifier": "CAA6460397F6B872F240783BA61A797A5FAAD827",
          "endDate": "2021-11-21T01:51:00Z",
          "keyId": "1c0232ab-ddf8-4d6c-808b-8947374ff2ca",
          "startDate": "2021-08-23T01:51:00Z",
          "type": "AsymmetricX509Cert",
          "usage": "Verify",
          "value": null
        }
      ],
      "logoutUrl": null,
      "notificationEmailAddresses": [],
      "oauth2Permissions": [],
      "passwordCredentials": [],
      "preferredSingleSignOnMode": null,
      "preferredTokenSigningKeyEndDateTime": null,
      "preferredTokenSigningKeyThumbprint": null,
      "publisherName": null,
      "replyUrls": [],
      "samlMetadataUrl": null,
      "samlSingleSignOnSettings": null,
      "servicePrincipalNames": [
        "04731df8-6338-427f-8dcd-5fc7dab100bc",
        "https://identity.azure.net/YGNMfhhJAmytOXj+hQmkuLjh8NKFpWUsowsdfZDyQss="
      ],
      "servicePrincipalType": "ManagedIdentity",
      "signInAudience": null,
      "tags": [],
      "tokenEncryptionKeyId": null
    },
    {
      "odata.type": "Microsoft.DirectoryServices.ServicePrincipal",
      "objectType": "ServicePrincipal",
      "objectId": "4d712a4e-1897-4dd0-845f-452a5b82844e",
      "deletionTimestamp": null,
      "accountEnabled": true,
      "addIns": [],
      "alternativeNames": [],
      "appDisplayName": "Azure Purview",
      "appId": "73c2949e-da2d-457a-9607-fcc665198967",
      "applicationTemplateId": null,
      "appOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
      "appRoleAssignmentRequired": false,
      "appRoles": [
        {
          "allowedMemberTypes": [
            "Application"
          ],
          "description": "Allows the application to call Purview APIs without a signed-in user",
          "displayName": "Purview Application API Access",
          "id": "8d48872e-7710-4001-bfd0-7dac15c28f69",
          "isEnabled": true,
          "value": "Purview.ApplicationAccess"
        }
      ],
      "displayName": "Azure Purview",
      "errorUrl": null,
      "homepage": null,
      "informationalUrls": {
        "termsOfService": null,
        "support": null,
        "privacy": null,
        "marketing": null
      },
      "keyCredentials": [],
      "logoutUrl": "https://projectbabylon.azure-test.com",
      "notificationEmailAddresses": [],
      "oauth2Permissions": [
        {
          "adminConsentDescription": "Allows the application to call Purview APIs on behalf of a user",
          "adminConsentDisplayName": "Purview Delegated API Access",
          "id": "817468d0-81dd-4cb5-94ac-07ca133fbbf6",
          "isEnabled": true,
          "type": "User",
          "userConsentDescription": "Allows the application to call Purview APIs on behalf of a user",
          "userConsentDisplayName": "Purview Delegated API Access",
          "value": "Purview.DelegatedAccess"
        }
      ],
      "passwordCredentials": [],
      "preferredSingleSignOnMode": null,
      "preferredTokenSigningKeyEndDateTime": null,
      "preferredTokenSigningKeyThumbprint": null,
      "publisherName": "Microsoft Services",
      "replyUrls": [],
      "samlMetadataUrl": null,
      "samlSingleSignOnSettings": null,
      "servicePrincipalNames": [
        "73c2949e-da2d-457a-9607-fcc665198967",
        "https://projectbabylon.azure.net",
        "https://projectbabylon.azure.net/",
        "https://purview.azure.net",
        "https://purview.azure.net/"
      ],
      "servicePrincipalType": "Application",
      "signInAudience": "AzureADMultipleOrgs",
      "tags": [],
      "tokenEncryptionKeyId": null
    },
    {
      "odata.type": "Microsoft.DirectoryServices.ServicePrincipal",
      "objectType": "ServicePrincipal",
      "objectId": "6ad9a4db-7591-4960-8b4c-69b1ce99c6d7",
      "deletionTimestamp": null,
      "accountEnabled": true,
      "addIns": [],
      "alternativeNames": [
        "isExplicit=False",
        "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourcegroups/feng-cli-rg/providers/Microsoft.Purview/accounts/feng-purview"
      ],
      "appDisplayName": null,
      "appId": "b584af5c-d3fa-4d48-983a-fc8e82bf7be2",
      "applicationTemplateId": null,
      "appOwnerTenantId": null,
      "appRoleAssignmentRequired": false,
      "appRoles": [],
      "displayName": "feng-purview",
      "errorUrl": null,
      "homepage": null,
      "informationalUrls": null,
      "keyCredentials": [
        {
          "customKeyIdentifier": "439EA9DCB1A32BCF47FCCFE65A6C3D731A42A5F8",
          "endDate": "2022-02-08T09:32:00Z",
          "keyId": "52eb8ab8-ccf5-405a-b679-6bb7482829d5",
          "startDate": "2021-11-10T09:32:00Z",
          "type": "AsymmetricX509Cert",
          "usage": "Verify",
          "value": null
        },
        {
          "customKeyIdentifier": "DC782E4CD9ACE379E3456D1AD6DE964E97EA0F2B",
          "endDate": "2021-12-22T05:55:00Z",
          "keyId": "3e01dec1-60d5-4d63-89cf-dd26312e40c9",
          "startDate": "2021-09-23T05:55:00Z",
          "type": "AsymmetricX509Cert",
          "value": null
        }
      ],
      "logoutUrl": null,
      "notificationEmailAddresses": [],
      "oauth2Permissions": [],
      "passwordCredentials": [],
      "preferredSingleSignOnMode": null,
      "preferredTokenSigningKeyEndDateTime": null,
      "preferredTokenSigningKeyThumbprint": null,
      "publisherName": null,
      "replyUrls": [],
      "samlMetadataUrl": null,
      "samlSingleSignOnSettings": null,
      "servicePrincipalNames": [
        "b584af5c-d3fa-4d48-983a-fc8e82bf7be2",
        "https://identity.azure.net/crBq8297fNewFbMt+fly7FRmjVpqr+CQyWF0PlC+fYw="
      ],
      "servicePrincipalType": "ManagedIdentity",
      "signInAudience": null,
      "tags": [],
      "tokenEncryptionKeyId": null
    }
  ]
}

PS C:\Users\bez> Get-AzDenyAssignment -DenyAssignmentName $assignments[0].DenyAssignmentName

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/providers/Microsoft.Authorization/denyAssignments?$filter=denyAssignmentName eq '5184754b-6c52-436a-90a5-cae79bfbfea1'&api-version=2018-07-01-preview

Body:



DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Body:
{
  "value": []
}

Environment data

Name                           Value
----                           -----
PSVersion                      6.2.4
PSEdition                      Core
GitCommitId                    6.2.4
OS                             Microsoft Windows 10.0.19043
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

PS C:\Users\bez> Get-Module

ModuleType Version    Name                                ExportedCommands
---------- -------    ----                                ----------------
Script     2.6.0      Az.Accounts                         {Add-AzEnvironment, Clear-AzContext, Clear-AzDefault, Conn…
Script     4.4.1      Az.Resources                        {Add-AzADGroupMember, Export-AzResourceGroup, Export-AzTem…
Manifest   6.1.0.0    Microsoft.PowerShell.Management     {Add-Content, Clear-Content, Clear-Item, Clear-ItemPropert…
Manifest   6.1.0.0    Microsoft.PowerShell.Security       {ConvertFrom-SecureString, ConvertTo-SecureString, Get-Acl…
Manifest   6.1.0.0    Microsoft.PowerShell.Utility        {Add-Member, Add-Type, Clear-Variable, Compare-Object…}
Manifest   6.1.0.0    Microsoft.WSMan.Management          {Connect-WSMan, Disable-WSManCredSSP, Disconnect-WSMan, En…
Script     2.0.0      PSReadLine                          {Get-PSReadLineKeyHandler, Get-PSReadLineOption, Remove-PS…

PS C:\Users\bez>

Error output

No response

Contributor Guide

Research-Richtung
Untersuchen Sie die Implementierung des Get AzDenyAssignment Cmdlets im Az.Resources Modul. Prüfen Sie, wie der Parameter DenyAssignmentName verarbeitet wird und ob er an das Azure SDK übergeben oder für clientseitiges Filtern verwendet wird. Reproduzieren Sie das Problem und verfolgen Sie die HTTP Anfragen, um festzustellen, ob ein Listenaufruf anstelle eines Aufrufs nach Namen erfolgt. Vergleichen Sie mit ähnlichen Cmdlets im Modul, um das erwartete Muster zu identifizieren.
Tech Stack
csharp
Domain
backendapiauthorization
Issue Type
Fehler
SchwierigkeitGeschätzte Implementierungsschwierigkeit für neue Contributors, von 1 für sehr kleine Änderungen bis 5 für Expertenarbeit.
2
Geschätzte ZeitEin grober Zeitrahmen, um zu recherchieren, zu implementieren, zu testen und einen Pull Request vorzubereiten.
1-3 Stunden
AktivitätsstatusWie verfügbar das Issue gerade wirkt: frisch, aktiv, stale, blockiert oder wartet auf Maintainer-Input.
Aktiv
KlarheitWie klar das Issue die erwartete Änderung, Akzeptanzkriterien und den nächsten Schritt erklärt.
Klar
Voraussetzungen
GitC#PowerShell
EinsteigerfreundlichkeitEin Score von 1 bis 100, der schätzt, wie zugänglich dieses Issue für First-Time Contributors ist.
65