question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Azure Key Vault creation fails when enable soft delete is set to false

See original GitHub issue

Describe the bug

Azure Key Vault creation using az keyvault gives an error when soft delete is disabled and does not create the key vault.

To Reproduce

Running the following command

az keyvault create --resource-group myrg --name mykv \
  --location westeurope --sku standard --enable-soft-delete false

returns

The property "enableSoftDelete" must be set to true.

Expected Behavior

Should create the key vault with soft delete disabled.

Environment summary

OS Name: Microsoft Windows 10 Pro OS Version: 10.0.17763 N/A Build 17763

az --version
azure-cli                          2.5.0

command-modules-nspkg              2.0.3
core                               2.5.0
nspkg                              3.0.4
telemetry                          1.0.4

Same error also in Cloud Shell environment.

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description:    Ubuntu 16.04.6 LTS
Release:        16.04
Codename:       xenial
$ az --version
azure-cli                          2.4.0 *

command-modules-nspkg              2.0.3
core                               2.4.0 *
nspkg                              3.0.4
telemetry                          1.0.4

Extensions:
application-insights               0.1.6
resource-graph                     1.0.0
azure-devops                      0.18.0

Additional Context

The reason seems to be the property softDeleteRetentionInDays in the JSON payload the az keyvault command sends to the REST API.

{
    "location": "westeurope",
    "properties": {
        "tenantId": "<removed>",
        "sku": {
            "family": "A",
            "name": "standard"
        },
        "accessPolicies": [],
        "enableSoftDelete": false,
        "softDeleteRetentionInDays": 90

      // rest of the properties removed
    }
}

Everything seems to work correctly if the key vault creation is invoked directly using the az rest command and without the property softDeleteRetentionInDays in the JSON payload.

{
    "location": "westeurope",
    "properties": {
        "tenantId": "<removed>",
        "sku": {
            "family": "A",
            "name": "standard"
        },
        "accessPolicies": [],
        "enableSoftDelete": false,
        "enableRbacAuthorization": false
    }
}
az rest \
    --method PUT \
    --uri "https://management.azure.com/subscriptions/<removed>/resourceGroups/my-resource-group/providers/Microsoft.KeyVault/vaults/my-keyvault?api-version=2019-09-01"
    --header Content-Type=application/json \
    --body <the json playload above>

Issue Analytics

  • State:closed
  • Created 3 years ago
  • Reactions:11
  • Comments:28 (2 by maintainers)

github_iconTop GitHub Comments

2reactions
jlichwacommented, May 6, 2020

@bim-msft How to workaround this issue? I am working with westeurope mainly. Change region for current my deployment is not an option for me.

It should work now. I just tested in this region.

2reactions
wolszakpcommented, May 6, 2020

@bim-msft How to workaround this issue? I am working with westeurope mainly. Change region for current my deployment is not an option for me.

Read more comments on GitHub >

github_iconTop Results From Across the Web

Soft-delete will be enabled on all key vaults - Azure
Turn on soft-delete for an existing key vault · Sign in to the Azure portal. · Search for your key vault. · Select...
Read more >
Azure key vault creation error: VaultAlreadyExists - I can't find ...
When you create an azure keyvault a soft delete feature is by default enabled which helps the customers to recover their keys and...
Read more >
Key Vault 'Enable Soft Delete' and 'Enable Purge Protection ...
Enabling soft deletion ensures that even if the key vault is deleted, the key vault and its objects remain recoverable for next 90...
Read more >
azurerm_key_vault | Resources | hashicorp/azurerm
Terraform will automatically recover a soft-deleted Key Vault during Creation ... the Key Vault to be deleted (which will happen by Azure in...
Read more >
Ensure key vault enables soft-delete - What is Bridgecrew?
Deleting a key vault without soft delete enabled permanently deletes all secrets, keys, and certificates stored in the key vault. Accidental deletion of...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found