Azure / Azure/azure-cli-extensions
image-copy-extension: LinkedAuthorizationFailed when using subscription name in the target-subscription option
- Dominant language
- Python
- Stars
- 454
- Forks
- 1.7k
- Avg merge
- 2d 19h
- Merged PRs (30d)
- 64
Description
### Extension name (the extension in question)
image-copy-extension
### Description of issue (in as much detail as possible)
When `az image copy` is used with `--target-subscription ` the following error occurs in the step "Creating snapshot in target region from the copied blob":
```
cli.azure.cli.core.azclierror: (LinkedAuthorizationFailed) The client has permission to perform action
'Microsoft.Storage/storageAccounts/listKeys/action' on scope '', however
the linked subscription '' was not found.
```
A bit of digging into the rest of the error message shows that the parameter passed to `az snapshot create --source-storage-account-id` is a resource ID but contains the subscription name, not the ID, in the resource ID path.
The issue seems to be here:
https://github.com/Azure/azure-cli-extensions/blob/bfd2ba660db1d9fda2257f1c274a25d1b698797c/src/image-copy/azext_imagecopy/create_target.py#L116-L119
where the `target_subscription` is used in the `get_storage_account_id_from_blob_path` function which expects to be handed a subscription ID:
https://github.com/Azure/azure-cli-extensions/blob/bfd2ba660db1d9fda2257f1c274a25d1b698797c/src/image-copy/azext_imagecopy/cli_utils.py#L77
### Suggested fix
Change the `get_storage_account_id_from_blob_path` function to look up the ID for a subscription when it doesn't appear to already be an ID.
https://github.com/Azure/azure-cli-extensions/blob/bfd2ba660db1d9fda2257f1c274a25d1b698797c/src/image-copy/azext_imagecopy/cli_utils.py#L77
### Alternate fix
Look up the subscription ID from the name before passing it into `get_storage_account_id_from_blob_path`
### Really cheezy fix
Change the documentation so it says that only a subscription ID may be used with `--target-subscription`
### Workaround
When using this extension and `--target-subscription`, only use numeric subscription IDs.
Contributor guide
Assessment
This issue has not been assessed yet.