Azure/azure-powershell

[Az.Resources] Get-AzDenyAssignment -DenyAssignmentName $name returns empty while it exists when operate list action.

開放

#16,410 建立於 2021年11月16日

在 GitHub 查看貢獻者指南
 (2 則留言) (1 個反應) (2 位負責人)PowerShell (3,744 個分叉)batch import
Authorizationact-identity-squadbuggood first issue

倉庫指標

星標
 (4,102 顆星)
PR 合併指標
 (平均合併 10天 2小時) (30 天內合併 45 個 PR)

描述

Description

issue: Get-AzDenyAssignment -DenyAssignmentName $name returns empty while it exists while operate list action.

expected result: Get-AzDenyAssignment -DenyAssignmentName $name returns correctly.

Issue script & Debug output

$assignments = Get-AzDenyAssignment
DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions/{subscriptions}/providers/Microsoft.Authorization/denyAssignments?api-version=2018-07-01-preview

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK
Body:
{
  "value": [
    {
      "properties": {
        "denyAssignmentName": "5184754b-6c52-436a-90a5-cae79bfbfea1",
        "description": "Deny assignment for ResourceGroup default",
        "permissions": [
          {
            "actions": [
              "*"
            ],
            "notActions": [
              "Microsoft.Storage/storageAccounts/privateEndpointConnectionsApproval/action",
              "Microsoft.Storage/storageAccounts/privateEndpointConnections/*",
              "Microsoft.Storage/storageAccounts/privateLinkResources/read",
              "Microsoft.EventHub/namespaces/privateEndpointConnectionsApproval/action",
              "Microsoft.EventHub/namespaces/privateEndpointConnections/*",
              "Microsoft.EventHub/namespaces/privateLinkResources/read",
              "Microsoft.Resources/deployments/validate/action",
              "Microsoft.Insights/DiagnosticSettings/*",
              "Microsoft.Insights/ExtendedDiagnosticSettings/*",
              "Microsoft.Security/*/action"
            ],
            "dataActions": [
              "*"
            ],
            "notDataActions": []
          }
        ],
        "scope": "/subscriptions/{subscriptions}/resourcegroups/x",
        "doNotApplyToChildScopes": false,
        "principals": [
          {
            "id": "00000000-0000-0000-0000-000000000000",
            "type": "SystemDefined"
          }
        ],
        "excludePrincipals": [
          {
            "id": "6ad9a4db-7591-4960-8b4c-69b1ce99c6d7",
            "type": "ServicePrincipal"
          },
          {
            "id": "4d712a4e-1897-4dd0-845f-452a5b82844e",
            "type": "ServicePrincipal"
          }
        ],
        "isSystemProtected": true,
        "createdOn": "2021-09-23T06:00:27.8908295Z",
        "updatedOn": "2021-09-23T06:00:27.6252699Z",
        "createdBy": "4d712a4e-1897-4dd0-845f-452a5b82844e",
        "updatedBy": "4d712a4e-1897-4dd0-845f-452a5b82844e"
      },
      "id": "/subscriptions/{subscriptions}/resourcegroups/x/providers/Microsoft.Authorization/denyAssignments/5184754b-6c52-436a-90a5-cae79bfbfea1",
      "type": "Microsoft.Authorization/denyAssignments",
      "name": "5184754b-6c52-436a-90a5-cae79bfbfea1"
    },
    {
      "properties": {
        "denyAssignmentName": "StoragePool Resource Provider Management Lock for MSP_bez-rg_bez-diskpool_eastus",
        "description": "Locks the Disk Pool managed resource group to all users, groups and service principals except the Storage Pool Resource Provider",
        "permissions": [
          {
            "actions": [
              "*"
            ],
            "notActions": [
              "*/read"
            ],
            "dataActions": [
              "*"
            ],
            "notDataActions": [
              "*/read"
            ]
          }
        ],
        "scope": "/subscriptions/{subscriptions}/resourcegroups/MSP_bez-rg_bez-diskpool_eastus",
        "doNotApplyToChildScopes": false,
        "principals": [
          {
            "id": "00000000-0000-0000-0000-000000000000",
            "type": "SystemDefined"
          }
        ],
        "excludePrincipals": [
          {
            "id": "5741a1ff-751d-4ad7-bcd1-dfe3c998fd11",
            "type": "ServicePrincipal"
          }
        ],
        "isSystemProtected": true,
        "createdOn": "2021-10-12T07:20:25.3813964Z",
        "updatedOn": "2021-10-12T07:20:25.0375574Z",
        "createdBy": "09f10f07-08cf-4ab7-be0f-e9ae3d72b9ad",
        "updatedBy": "09f10f07-08cf-4ab7-be0f-e9ae3d72b9ad"
      },
      "id": "/subscriptions/{subscriptions}/resourcegroups/MSP_bez-rg_bez-diskpool_eastus/providers/Microsoft.Authorization/denyAssignments/cf0159c5-be61-4b7f-b84c-7128046ca334",
      "type": "Microsoft.Authorization/denyAssignments",
      "name": "cf0159c5-be61-4b7f-b84c-7128046ca334"
    },
    {
      "properties": {
        "denyAssignmentName": "b2db6b8f-ad9a-4bda-8faf-c6b4d8356e7a",
        "description": "Deny assignment for ResourceGroup default",
        "permissions": [
          {
            "actions": [
              "*"
            ],
            "notActions": [
              "Microsoft.Storage/storageAccounts/privateEndpointConnectionsApproval/action",
              "Microsoft.Storage/storageAccounts/privateEndpointConnections/*",
              "Microsoft.Storage/storageAccounts/privateLinkResources/read",
              "Microsoft.EventHub/namespaces/privateEndpointConnectionsApproval/action",
              "Microsoft.EventHub/namespaces/privateEndpointConnections/*",
              "Microsoft.EventHub/namespaces/privateLinkResources/read",
              "Microsoft.Resources/deployments/validate/action",
              "Microsoft.Insights/DiagnosticSettings/*",
              "Microsoft.Insights/ExtendedDiagnosticSettings/*",
              "Microsoft.Security/*/action"
            ],
            "dataActions": [
              "*"
            ],
            "notDataActions": []
          }
        ],
        "scope": "/subscriptions/{subscriptions}/resourcegroups/managed-rg-fypurview",
        "doNotApplyToChildScopes": false,
        "principals": [
          {
            "id": "00000000-0000-0000-0000-000000000000",
            "type": "SystemDefined"
          }
        ],
        "excludePrincipals": [
          {
            "id": "1f348023-24b0-4d80-ab40-31ef7623c709",
            "type": "ServicePrincipal"
          },
          {
            "id": "4d712a4e-1897-4dd0-845f-452a5b82844e",
            "type": "ServicePrincipal"
          }
        ],
        "isSystemProtected": true,
        "createdOn": "2021-09-28T03:24:28.2671712Z",
        "updatedOn": "2021-09-28T03:24:27.9078023Z",
        "createdBy": "4d712a4e-1897-4dd0-845f-452a5b82844e",
        "updatedBy": "4d712a4e-1897-4dd0-845f-452a5b82844e"
      },
      "id": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourcegroups/managed-rg-fypurview/providers/Microsoft.Authorization/denyAssignments/b2db6b8f-ad9a-4bda-8faf-c6b4d8356e7a",
      "type": "Microsoft.Authorization/denyAssignments",
      "name": "b2db6b8f-ad9a-4bda-8faf-c6b4d8356e7a"
    },
    {
      "properties": {
        "denyAssignmentName": "7dbf8247-b1ed-440f-8324-8ceef880fa9e",
        "description": "Deny assignment for ResourceGroup default",
        "permissions": [
          {
            "actions": [
              "*"
            ],
            "notActions": [
              "Microsoft.Storage/storageAccounts/privateEndpointConnectionsApproval/action",
              "Microsoft.Storage/storageAccounts/privateEndpointConnections/*",
              "Microsoft.Storage/storageAccounts/privateLinkResources/read",
              "Microsoft.EventHub/namespaces/privateEndpointConnectionsApproval/action",
              "Microsoft.EventHub/namespaces/privateEndpointConnections/*",
              "Microsoft.EventHub/namespaces/privateLinkResources/read",
              "Microsoft.Resources/deployments/validate/action",
              "Microsoft.Insights/DiagnosticSettings/*",
              "Microsoft.Insights/ExtendedDiagnosticSettings/*",
              "Microsoft.Security/*/action"
            ],
            "dataActions": [
              "*"
            ],
            "notDataActions": []
          }
        ],
        "scope": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourcegroups/managed-rg-purview-msyyc",
        "doNotApplyToChildScopes": false,
        "principals": [
          {
            "id": "00000000-0000-0000-0000-000000000000",
            "type": "SystemDefined"
          }
        ],
        "excludePrincipals": [
          {
            "id": "c5c7034d-fd51-48ea-afdd-bb1aac5813e6",
            "type": "ServicePrincipal"
          },
          {
            "id": "4d712a4e-1897-4dd0-845f-452a5b82844e",
            "type": "ServicePrincipal"
          }
        ],
        "isSystemProtected": true,
        "createdOn": "2021-08-23T01:56:13.2120781Z",
        "updatedOn": "2021-09-16T03:45:47.4533902Z",
        "createdBy": "4d712a4e-1897-4dd0-845f-452a5b82844e",
        "updatedBy": "4d712a4e-1897-4dd0-845f-452a5b82844e"
      },
      "id": "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourcegroups/managed-rg-purview-msyyc/providers/Microsoft.Authorization/denyAssignments/7dbf8247-b1ed-440f-8324-8ceef880fa9e",
      "type": "Microsoft.Authorization/denyAssignments",
      "name": "7dbf8247-b1ed-440f-8324-8ceef880fa9e"
    }
  ]
}


DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
POST

Absolute Uri:
https://graph.windows.net/54826b22-38d6-4fb2-bad9-b7b93a3e9c5a/getObjectsByObjectIds?api-version=1.6

Headers:
x-ms-client-request-id        : 6290fc57-89ee-490d-b8e3-cdee769c64e3
Accept-Language               : en-US

Body:
{
  "objectIds": [
    "6ad9a4db-7591-4960-8b4c-69b1ce99c6d7",
    "4d712a4e-1897-4dd0-845f-452a5b82844e",
    "5741a1ff-751d-4ad7-bcd1-dfe3c998fd11",
    "1f348023-24b0-4d80-ab40-31ef7623c709",
    "c5c7034d-fd51-48ea-afdd-bb1aac5813e6"
  ],
  "includeDirectoryObjectReferences": true
}


DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Body:
{
  "odata.metadata": "https://graph.windows.net/54826b22-38d6-4fb2-bad9-b7b93a3e9c5a/$metadata#directoryObjects",
  "value": [
    {
      "odata.type": "Microsoft.DirectoryServices.ServicePrincipal",
      "objectType": "ServicePrincipal",
      "objectId": "1f348023-24b0-4d80-ab40-31ef7623c709",
      "deletionTimestamp": null,
      "accountEnabled": true,
      "addIns": [],
      "alternativeNames": [
        "isExplicit=False",
        "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourcegroups/fypurview/providers/Microsoft.Purview/accounts/fypurview"
      ],
      "appDisplayName": null,
      "appId": "417e76dd-1492-4910-8121-22c0320b3412",
      "applicationTemplateId": null,
      "appOwnerTenantId": null,
      "appRoleAssignmentRequired": false,
      "appRoles": [],
      "displayName": "fypurview",
      "errorUrl": null,
      "homepage": null,
      "informationalUrls": null,
      "keyCredentials": [
        {
          "customKeyIdentifier": "E8264C24B1B90A3B1CB7002D8E85A830E8692272",
          "endDate": "2021-12-27T03:19:00Z",
          "keyId": "41f41e79-fe09-4074-985a-856920e3234f",
          "startDate": "2021-09-28T03:19:00Z",
          "type": "AsymmetricX509Cert",
          "usage": "Verify",
          "value": null
        }
      ],
      "logoutUrl": null,
      "notificationEmailAddresses": [],
      "oauth2Permissions": [],
      "passwordCredentials": [],
      "preferredSingleSignOnMode": null,
      "preferredTokenSigningKeyEndDateTime": null,
      "preferredTokenSigningKeyThumbprint": null,
      "publisherName": null,
      "replyUrls": [],
      "samlMetadataUrl": null,
      "samlSingleSignOnSettings": null,
      "servicePrincipalNames": [
        "417e76dd-1492-4910-8121-22c0320b3412",
        "https://identity.azure.net/LAa6VKqDUTQcwrFMKOfyvQUd6qAzheHXKd8n4MNir0g="
      ],
      "servicePrincipalType": "ManagedIdentity",
      "signInAudience": null,
      "tags": [],
      "tokenEncryptionKeyId": null
    },
    {
      "odata.type": "Microsoft.DirectoryServices.ServicePrincipal",
      "objectType": "ServicePrincipal",
      "objectId": "c5c7034d-fd51-48ea-afdd-bb1aac5813e6",
      "deletionTimestamp": null,
      "accountEnabled": true,
      "addIns": [],
      "alternativeNames": [
        "isExplicit=False",
        "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourcegroups/python-sdk-test/providers/Microsoft.Purview/accounts/purview-msyyc"
      ],
      "appDisplayName": null,
      "appId": "04731df8-6338-427f-8dcd-5fc7dab100bc",
      "applicationTemplateId": null,
      "appOwnerTenantId": null,
      "appRoleAssignmentRequired": false,
      "appRoles": [],
      "displayName": "purview-msyyc",
      "errorUrl": null,
      "homepage": null,
      "informationalUrls": null,
      "keyCredentials": [
        {
          "customKeyIdentifier": "CAA6460397F6B872F240783BA61A797A5FAAD827",
          "endDate": "2021-11-21T01:51:00Z",
          "keyId": "1c0232ab-ddf8-4d6c-808b-8947374ff2ca",
          "startDate": "2021-08-23T01:51:00Z",
          "type": "AsymmetricX509Cert",
          "usage": "Verify",
          "value": null
        }
      ],
      "logoutUrl": null,
      "notificationEmailAddresses": [],
      "oauth2Permissions": [],
      "passwordCredentials": [],
      "preferredSingleSignOnMode": null,
      "preferredTokenSigningKeyEndDateTime": null,
      "preferredTokenSigningKeyThumbprint": null,
      "publisherName": null,
      "replyUrls": [],
      "samlMetadataUrl": null,
      "samlSingleSignOnSettings": null,
      "servicePrincipalNames": [
        "04731df8-6338-427f-8dcd-5fc7dab100bc",
        "https://identity.azure.net/YGNMfhhJAmytOXj+hQmkuLjh8NKFpWUsowsdfZDyQss="
      ],
      "servicePrincipalType": "ManagedIdentity",
      "signInAudience": null,
      "tags": [],
      "tokenEncryptionKeyId": null
    },
    {
      "odata.type": "Microsoft.DirectoryServices.ServicePrincipal",
      "objectType": "ServicePrincipal",
      "objectId": "4d712a4e-1897-4dd0-845f-452a5b82844e",
      "deletionTimestamp": null,
      "accountEnabled": true,
      "addIns": [],
      "alternativeNames": [],
      "appDisplayName": "Azure Purview",
      "appId": "73c2949e-da2d-457a-9607-fcc665198967",
      "applicationTemplateId": null,
      "appOwnerTenantId": "f8cdef31-a31e-4b4a-93e4-5f571e91255a",
      "appRoleAssignmentRequired": false,
      "appRoles": [
        {
          "allowedMemberTypes": [
            "Application"
          ],
          "description": "Allows the application to call Purview APIs without a signed-in user",
          "displayName": "Purview Application API Access",
          "id": "8d48872e-7710-4001-bfd0-7dac15c28f69",
          "isEnabled": true,
          "value": "Purview.ApplicationAccess"
        }
      ],
      "displayName": "Azure Purview",
      "errorUrl": null,
      "homepage": null,
      "informationalUrls": {
        "termsOfService": null,
        "support": null,
        "privacy": null,
        "marketing": null
      },
      "keyCredentials": [],
      "logoutUrl": "https://projectbabylon.azure-test.com",
      "notificationEmailAddresses": [],
      "oauth2Permissions": [
        {
          "adminConsentDescription": "Allows the application to call Purview APIs on behalf of a user",
          "adminConsentDisplayName": "Purview Delegated API Access",
          "id": "817468d0-81dd-4cb5-94ac-07ca133fbbf6",
          "isEnabled": true,
          "type": "User",
          "userConsentDescription": "Allows the application to call Purview APIs on behalf of a user",
          "userConsentDisplayName": "Purview Delegated API Access",
          "value": "Purview.DelegatedAccess"
        }
      ],
      "passwordCredentials": [],
      "preferredSingleSignOnMode": null,
      "preferredTokenSigningKeyEndDateTime": null,
      "preferredTokenSigningKeyThumbprint": null,
      "publisherName": "Microsoft Services",
      "replyUrls": [],
      "samlMetadataUrl": null,
      "samlSingleSignOnSettings": null,
      "servicePrincipalNames": [
        "73c2949e-da2d-457a-9607-fcc665198967",
        "https://projectbabylon.azure.net",
        "https://projectbabylon.azure.net/",
        "https://purview.azure.net",
        "https://purview.azure.net/"
      ],
      "servicePrincipalType": "Application",
      "signInAudience": "AzureADMultipleOrgs",
      "tags": [],
      "tokenEncryptionKeyId": null
    },
    {
      "odata.type": "Microsoft.DirectoryServices.ServicePrincipal",
      "objectType": "ServicePrincipal",
      "objectId": "6ad9a4db-7591-4960-8b4c-69b1ce99c6d7",
      "deletionTimestamp": null,
      "accountEnabled": true,
      "addIns": [],
      "alternativeNames": [
        "isExplicit=False",
        "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourcegroups/feng-cli-rg/providers/Microsoft.Purview/accounts/feng-purview"
      ],
      "appDisplayName": null,
      "appId": "b584af5c-d3fa-4d48-983a-fc8e82bf7be2",
      "applicationTemplateId": null,
      "appOwnerTenantId": null,
      "appRoleAssignmentRequired": false,
      "appRoles": [],
      "displayName": "feng-purview",
      "errorUrl": null,
      "homepage": null,
      "informationalUrls": null,
      "keyCredentials": [
        {
          "customKeyIdentifier": "439EA9DCB1A32BCF47FCCFE65A6C3D731A42A5F8",
          "endDate": "2022-02-08T09:32:00Z",
          "keyId": "52eb8ab8-ccf5-405a-b679-6bb7482829d5",
          "startDate": "2021-11-10T09:32:00Z",
          "type": "AsymmetricX509Cert",
          "usage": "Verify",
          "value": null
        },
        {
          "customKeyIdentifier": "DC782E4CD9ACE379E3456D1AD6DE964E97EA0F2B",
          "endDate": "2021-12-22T05:55:00Z",
          "keyId": "3e01dec1-60d5-4d63-89cf-dd26312e40c9",
          "startDate": "2021-09-23T05:55:00Z",
          "type": "AsymmetricX509Cert",
          "value": null
        }
      ],
      "logoutUrl": null,
      "notificationEmailAddresses": [],
      "oauth2Permissions": [],
      "passwordCredentials": [],
      "preferredSingleSignOnMode": null,
      "preferredTokenSigningKeyEndDateTime": null,
      "preferredTokenSigningKeyThumbprint": null,
      "publisherName": null,
      "replyUrls": [],
      "samlMetadataUrl": null,
      "samlSingleSignOnSettings": null,
      "servicePrincipalNames": [
        "b584af5c-d3fa-4d48-983a-fc8e82bf7be2",
        "https://identity.azure.net/crBq8297fNewFbMt+fly7FRmjVpqr+CQyWF0PlC+fYw="
      ],
      "servicePrincipalType": "ManagedIdentity",
      "signInAudience": null,
      "tags": [],
      "tokenEncryptionKeyId": null
    }
  ]
}

PS C:\Users\bez> Get-AzDenyAssignment -DenyAssignmentName $assignments[0].DenyAssignmentName

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/providers/Microsoft.Authorization/denyAssignments?$filter=denyAssignmentName eq '5184754b-6c52-436a-90a5-cae79bfbfea1'&api-version=2018-07-01-preview

Body:



DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Body:
{
  "value": []
}

Environment data

Name                           Value
----                           -----
PSVersion                      6.2.4
PSEdition                      Core
GitCommitId                    6.2.4
OS                             Microsoft Windows 10.0.19043
Platform                       Win32NT
PSCompatibleVersions           {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion      2.3
SerializationVersion           1.1.0.1
WSManStackVersion              3.0

Module versions

PS C:\Users\bez> Get-Module

ModuleType Version    Name                                ExportedCommands
---------- -------    ----                                ----------------
Script     2.6.0      Az.Accounts                         {Add-AzEnvironment, Clear-AzContext, Clear-AzDefault, Conn…
Script     4.4.1      Az.Resources                        {Add-AzADGroupMember, Export-AzResourceGroup, Export-AzTem…
Manifest   6.1.0.0    Microsoft.PowerShell.Management     {Add-Content, Clear-Content, Clear-Item, Clear-ItemPropert…
Manifest   6.1.0.0    Microsoft.PowerShell.Security       {ConvertFrom-SecureString, ConvertTo-SecureString, Get-Acl…
Manifest   6.1.0.0    Microsoft.PowerShell.Utility        {Add-Member, Add-Type, Clear-Variable, Compare-Object…}
Manifest   6.1.0.0    Microsoft.WSMan.Management          {Connect-WSMan, Disable-WSManCredSSP, Disconnect-WSMan, En…
Script     2.0.0      PSReadLine                          {Get-PSReadLineKeyHandler, Get-PSReadLineOption, Remove-PS…

PS C:\Users\bez>

Error output

No response

貢獻者指南

研究方向
檢查 Az.Resources 模組中 Get AzDenyAssignment cmdlet 的實作。查看 DenyAssignmentName 參數是如何處理的，以及它是傳遞給 Azure SDK 還是用於用戶端篩選。重現問題並追蹤 HTTP 請求，看看是否發出了列表呼叫而不是按名稱取得的呼叫。與模組中類似的 cmdlet 進行比較，以確定預期模式。
技術棧
csharp
領域
backendapiauthorization
議題類型
錯誤
難度面向新貢獻者的預計實作難度，1 表示很小改動，5 表示專家級工作。
2
預計時間有經驗貢獻者完成調查、實作、測試並準備 pull request 的粗略時間範圍。
1-3 小時
活動狀態議題目前的可參與程度：新鮮、活躍、陳舊、阻塞或等待維護者輸入。
活躍
清晰度議題是否清楚說明預期改動、驗收標準和下一步。
清晰
前置要求
GitC#PowerShell
新手友善度1-100 的估計分數，表示該議題對首次貢獻者的友善程度。
65