Azure / Azure/azure-cli

`storage account network-rule remove` fails to remove subnet but cli returns success and exit code 0

Open
#18,399 1 comment 0 reactions 2 assignees Claimed by @evelyn-ys View on GitHub
act-codegen-extensibility-squad feature-request Storage
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

**Command Name**
`az storage account network-rule remove`

**Errors:**
No errors. The command succeeds and the CLI reports success.
The network rule removal does not occur though. The request technically fails.

## To Reproduce:

* create a Resource Group which a snakeCase or CamelCase name. It's important that the RG name is a mix of upper/lower chars.
* create a Storage Account
* configure its default network access rule to `deny`
* create a vNet and a Subnet.
* add a storage endpoint to the Subnet
* Update the Storage Account network access rules to allow the Subnet access to the SA.

* run the following command with the necessary variables in the parameters.
`az storage account network-rule remove --resource-group {} --account-name {} --subnet {} --debug`

Test 1:
* with the Resource ID in the `--subnet` parameter, use the correct casing for the RG name in the ID. Note that the Azure CLI returns that the command is successful.
* Use the ARM GUI and inspect the network access rules for the SA.
* Witness that the Subnet resource is still listed with access.

Test 2:
* with the Resource ID in the `--subnet` parameter, use all lower case for the RG name in the ID. Note that the Azure CLI returns that the command is successful.
* Use the ARM GUI and inspect the network access rules for the SA.
* Witness that the Subnet resource has been removed.

## Expected Behavior

Well, thats a good question. Since the same network-rule removal command works with a keyvault, regardless of the casing used in the Resource Group name in the Subnet Resource ID, you could argue that the command for a storage account should also work.

BUT, you can also argue that the network-rule removal command for the storage account should FAIL because the lowered RG name in the Subnet Resource ID is incorrect. If you agree with this then the Azure CLI should report that failure and not respond that the command was successful.

Feels like there are two errors here.

* something, somewhere is munging the casing of the Resource Group name in the Subnet Resource ID.
* The Azure CLI is reporting a command was successful when in fact it wasnt.

## Environment Summary
```
macOS-11.4-x86_64-i386-64bit
Python 3.8.10
Installer: HOMEBREW

azure-cli 2.24.2

Extensions:
azure-devops 0.18.0
resource-graph 1.1.0
subscription 0.1.4
account 0.2.1
db-up 0.1.13

```
## Additional Context

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.