Can't create VM from ACG image to other resource group in Azure CLI 2.43.0

This is autogenerated. Please review and update as needed.

Describe the bug

When I create the VM from ACG (Azure Compute Gallery) image version, I faced the error of “ResourceNotFound” even though resource group existing by using Azure CLI 2.43.0. As I investigated this error can be reproduce when the resource group of VM and ACG are different. If the resource group of VM and ACG is same, there is no isseu and could be deploy the VM.

Command Name az vm create

Errors:

(ResourceNotFound) The Resource 'Microsoft.Compute/galleries/<RG>/images/<Image>' under resource group '<RG>' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix
Code: ResourceNotFound
Message: The Resource 'Microsoft.Compute/galleries/<RG>/images/<Image>' under resource group '<RG>' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• Put any pre-requisite steps here…
• az vm create --resource-group {} --name {} --location {} --size {} --image {} --admin-username {} --admin-password {} --license-type {}

Using Azure CLI 2.43.0. Run the command as follows. az vm create --resource-group <RG1> --name <VM> --location <Region> --size Standard_D2s_v3 --image /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/<RG2>/providers/Microsoft.Compute/galleries/<ACG>/images/<Image>/versions/<x.x.x> --admin-username <username> --admin-password <password> --license-type Windows_Client

Expected Behavior

Deploy the VM from ACG image version

Environment Summary

Linux-5.4.0-1098-azure-x86_64-with-glibc2.35 (Cloud Shell), CBL-Mariner/Linux
Python 3.9.14
Installer: RPM

azure-cli 2.43.0

Extensions:
ai-examples 0.2.5
ml 2.11.0
ssh 1.1.3

Dependencies:
msal 1.20.0
azure-mgmt-resource 21.1.0b1

Additional Context

As I checked, the workaround is using previous Azure CLI as 2.42.0.

[jiasli]

I am able to repro.

az vm create --resource-group testrg --name crosstenantvm --image "/subscriptions/0b1f6471-1bf0-4dda-aec3-cb9272f09590/resourceGroups/john-rg/providers/Microsoft.Compute/galleries/john_gallery/images/john-linux/versions/0.25339.20792" --admin-username testuse --location westus --debug

The gallery image is retrieved twice. First time, the image is retrieved by azure.cli.command_modules.vm._validators._validate_vm_create_storage_profile:

https://github.com/Azure/azure-cli/blob/4844a757cb066ba1127dda40a165619952f31c58/src/azure-cli/azure/cli/command_modules/vm/_validators.py#L504-L506

This is correct, as it uses the subscription ID and resource group parsed from the --image resource ID.

https://github.com/Azure/azure-cli/blob/4844a757cb066ba1127dda40a165619952f31c58/src/azure-cli/azure/cli/command_modules/vm/_validators.py#L494-L496

Second time, the gallery image is retrieved by azure.cli.command_modules.vm._validators._validate_generation_version_and_trusted_launch:

https://github.com/Azure/azure-cli/blob/4844a757cb066ba1127dda40a165619952f31c58/src/azure-cli/azure/cli/command_modules/vm/_validators.py#L1335-L1337

However, it uses the current subscription ID and resource group specified by --resource-group, instead of those parsed from the --image resource ID.

Git blame shows that line was introduced by https://github.com/Azure/azure-cli/pull/24674, causing this regression.

So @yoshit333’s statement is right:

If the resource group of VM and ACG are same, there is no issue and could be deploy the VM.

An ResourceNotFound will occur if the image resides in different subscription or resource group.

[yanzhudd]

Hi @suresh-thelkar, we have raised a PR for this bug, and the private package could be found in Pipelines - Run 20221221.1 artifacts (azure.com). You could use this package to check if the fix meets expectations. Please let us know if there are any questions.