Azure / Azure/azure-cli-extensions

image-copy-extension: LinkedAuthorizationFailed when using subscription name in the target-subscription option

Open
#3,402 1 comment 0 reactions 1 assignee Claimed by @zhoxing-ms View on GitHub
Compute extension/image-copy feature-request
Dominant language
Python
Stars
454
Forks
1.7k
Avg merge
2d 19h
Merged PRs (30d)
64

Description

### Extension name (the extension in question)

image-copy-extension

### Description of issue (in as much detail as possible)

When `az image copy` is used with `--target-subscription ` the following error occurs in the step "Creating snapshot in target region from the copied blob":

```
cli.azure.cli.core.azclierror: (LinkedAuthorizationFailed) The client has permission to perform action
'Microsoft.Storage/storageAccounts/listKeys/action' on scope '', however
the linked subscription '' was not found.
```

A bit of digging into the rest of the error message shows that the parameter passed to `az snapshot create --source-storage-account-id` is a resource ID but contains the subscription name, not the ID, in the resource ID path.

The issue seems to be here:

https://github.com/Azure/azure-cli-extensions/blob/bfd2ba660db1d9fda2257f1c274a25d1b698797c/src/image-copy/azext_imagecopy/create_target.py#L116-L119

where the `target_subscription` is used in the `get_storage_account_id_from_blob_path` function which expects to be handed a subscription ID:

https://github.com/Azure/azure-cli-extensions/blob/bfd2ba660db1d9fda2257f1c274a25d1b698797c/src/image-copy/azext_imagecopy/cli_utils.py#L77

### Suggested fix

Change the `get_storage_account_id_from_blob_path` function to look up the ID for a subscription when it doesn't appear to already be an ID.

https://github.com/Azure/azure-cli-extensions/blob/bfd2ba660db1d9fda2257f1c274a25d1b698797c/src/image-copy/azext_imagecopy/cli_utils.py#L77

### Alternate fix

Look up the subscription ID from the name before passing it into `get_storage_account_id_from_blob_path`

### Really cheezy fix

Change the documentation so it says that only a subscription ID may be used with `--target-subscription`

### Workaround

When using this extension and `--target-subscription`, only use numeric subscription IDs.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.