Azure Key Vault creation fails when enable soft delete is set to false
See original GitHub issueDescribe the bug
Azure Key Vault creation using az keyvault
gives an error when soft delete is disabled and does not create the key vault.
To Reproduce
Running the following command
az keyvault create --resource-group myrg --name mykv \
--location westeurope --sku standard --enable-soft-delete false
returns
The property "enableSoftDelete" must be set to true.
Expected Behavior
Should create the key vault with soft delete disabled.
Environment summary
OS Name: Microsoft Windows 10 Pro OS Version: 10.0.17763 N/A Build 17763
az --version
azure-cli 2.5.0
command-modules-nspkg 2.0.3
core 2.5.0
nspkg 3.0.4
telemetry 1.0.4
Same error also in Cloud Shell environment.
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 16.04.6 LTS
Release: 16.04
Codename: xenial
$ az --version
azure-cli 2.4.0 *
command-modules-nspkg 2.0.3
core 2.4.0 *
nspkg 3.0.4
telemetry 1.0.4
Extensions:
application-insights 0.1.6
resource-graph 1.0.0
azure-devops 0.18.0
Additional Context
The reason seems to be the property softDeleteRetentionInDays in the JSON payload the az keyvault
command sends to the REST API.
{
"location": "westeurope",
"properties": {
"tenantId": "<removed>",
"sku": {
"family": "A",
"name": "standard"
},
"accessPolicies": [],
"enableSoftDelete": false,
"softDeleteRetentionInDays": 90
// rest of the properties removed
}
}
Everything seems to work correctly if the key vault creation is invoked directly using the az rest
command and without the property softDeleteRetentionInDays in the JSON payload.
{
"location": "westeurope",
"properties": {
"tenantId": "<removed>",
"sku": {
"family": "A",
"name": "standard"
},
"accessPolicies": [],
"enableSoftDelete": false,
"enableRbacAuthorization": false
}
}
az rest \
--method PUT \
--uri "https://management.azure.com/subscriptions/<removed>/resourceGroups/my-resource-group/providers/Microsoft.KeyVault/vaults/my-keyvault?api-version=2019-09-01"
--header Content-Type=application/json \
--body <the json playload above>
Issue Analytics
- State:
- Created 3 years ago
- Reactions:11
- Comments:28 (2 by maintainers)
Top Results From Across the Web
Soft-delete will be enabled on all key vaults - Azure
Turn on soft-delete for an existing key vault · Sign in to the Azure portal. · Search for your key vault. · Select...
Read more >Azure key vault creation error: VaultAlreadyExists - I can't find ...
When you create an azure keyvault a soft delete feature is by default enabled which helps the customers to recover their keys and...
Read more >Key Vault 'Enable Soft Delete' and 'Enable Purge Protection ...
Enabling soft deletion ensures that even if the key vault is deleted, the key vault and its objects remain recoverable for next 90...
Read more >azurerm_key_vault | Resources | hashicorp/azurerm
Terraform will automatically recover a soft-deleted Key Vault during Creation ... the Key Vault to be deleted (which will happen by Azure in...
Read more >Ensure key vault enables soft-delete - What is Bridgecrew?
Deleting a key vault without soft delete enabled permanently deletes all secrets, keys, and certificates stored in the key vault. Accidental deletion of...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
It should work now. I just tested in this region.
@bim-msft How to workaround this issue? I am working with
westeurope
mainly. Change region for current my deployment is not an option for me.