Unable to add SCM access restriction on Flex Consumption SKU via Azure CLI
- Dominant language
- Python
- Stars
- 4.6k
- Forks
- 3.5k
- Avg merge
- 3d 2h
- Merged PRs (30d)
- 60
Description
### Describe the bug
The Azure CLI command `az functionapp config access-restriction add` fails when executed against an Azure Function App deployed using the Flex Consumption SKU. This appears to be a bug or unsupported scenario in the CLI, as the same command succeeds without issue on Consumption SKU Function Apps. Execution fails with error
`Operation returned an invalid status 'Bad Request'`
### Related command
`az functionapp config access-restriction add --resource-group $RG_NAME -n $FA_FLEX --rule-name $RULE_NAME --action Allow --ip-address 192.168.0.0/27 --priority 250 --scm-site true`
### Errors
Operation returned an invalid status 'Bad Request'
### Issue script & Debug output
Content: {"Code":"BadRequest","Message":"The following list of 5 site configuration properties (Site.SiteConfig.FtpsState, Site.SiteConfig.Use32BitWorkerProcess, Site.SiteConfig.PreWarmedInstanceCount, Site.SiteConfig.NetFrameworkVersion, Site.SiteConfig.FunctionsRuntimeScaleMonitoringEnabled) for Flex Consumption sites is invalid. Please remove or rename them before retrying.","Target":null,"Details":[{"Message":"The following list of 5 site configuration properties (Site.SiteConfig.FtpsState, Site.SiteConfig.Use32BitWorkerProcess, Site.SiteConfig.PreWarmedInstanceCount, Site.SiteConfig.NetFrameworkVersion, Site.SiteConfig.FunctionsRuntimeScaleMonitoringEnabled) for Flex Consumption sites is invalid. Please remove or rename them before retrying."},{"Code":"BadRequest"},{"ErrorEntity":{"ExtendedCode":"51021","MessageTemplate":"{0} is invalid. {1}","Parameters":["The following list of 5 site configuration properties (Site.SiteConfig.FtpsState, Site.SiteConfig.Use32BitWorkerProcess, Site.SiteConfig.PreWarmedInstanceCount, Site.SiteConfig.NetFrameworkVersion, Site.SiteConfig.FunctionsRuntimeScaleMonitoringEnabled) for Flex Consumption sites","Please remove or rename them before retrying."],"Code":"BadRequest","Message":"The following list of 5 site configuration properties (Site.SiteConfig.FtpsState, Site.SiteConfig.Use32BitWorkerProcess, Site.SiteConfig.PreWarmedInstanceCount, Site.SiteConfig.NetFrameworkVersion, Site.SiteConfig.FunctionsRuntimeScaleMonitoringEnabled) for Flex Consumption sites is invalid. Please remove or rename them before retrying."}}],"Innererror":null}
### Expected behavior
I expect the access-restriction to be created and the rule summary output as follows:
```
[
{
"action": "Allow",
"description": null,
"headers": null,
"ipAddress": "192.168.0.0/27",
"name": "testingRule",
"priority": 250,
"subnetMask": null,
"subnetTrafficTag": null,
"tag": "Default",
"vnetSubnetResourceId": null,
"vnetTrafficTag": null
},
{
"action": "Deny",
"description": "Deny all access",
"headers": null,
"ipAddress": "Any",
"name": "Deny all",
"priority": 2147483647,
"subnetMask": null,
"subnetTrafficTag": null,
"tag": null,
"vnetSubnetResourceId": null,
"vnetTrafficTag": null
}
]
```
### Environment Summary
azure-cli 2.72.0
core 2.72.0
telemetry 1.1.0
Extensions:
application-insights 1.2.2
bastion 1.3.1
logic 1.1.0
ml 2.36.1
quota 1.0.0
Dependencies:
msal 1.32.3
azure-mgmt-resource 23.1.1
Python location 'C:\Program Files\Microsoft SDKs\Azure\CLI2\python.exe'
Config directory 'C:\Users\user\.azure'
Extensions directory 'C:\Users\user\.azure\cliextensions'
Python (Windows) 3.12.8 (tags/v3.12.8:2dc476b, Dec 3 2024, 19:30:04) [MSC v.1942 64 bit (AMD64)]
Legal docs and information: aka.ms/AzureCliLegal
Your CLI is up-to-date.
### Additional context
Full Reproduction with Consumption App & Flex App side-by-side. Run on PowerShell prompt
```
$RG_NAME = "functionAppTest"
$SA_NAME = "functionapptestsa123"
$FA_FLEX = "testingAZCLIFlex"
$FA_NAME = "testingAZCLIConsumption"
$RULE_NAME = "testingRule"
az group create --name $RG_NAME --location "westus"
az storage account create --resource-group $RG_NAME --name $SA_NAME --sku Standard_LRS --output none
az functionapp create --resource-group $RG_NAME -n $FA_FLEX --storage-account $SA_NAME --flexconsumption-location "westus" --runtime python --runtime-version "3.11" --output none
az functionapp create --resource-group $RG_NAME -n $FA_NAME --storage-account $SA_NAME --consumption-plan-location westus --runtime python --runtime-version "3.11" --os-type Linux --output none
az functionapp config access-restriction add --resource-group $RG_NAME -n $FA_NAME --rule-name $RULE_NAME --action Allow --ip-address 192.168.0.0/27 --priority 250 --scm-site true
az functionapp config access-restriction add --resource-group $RG_NAME -n $FA_FLEX --rule-name $RULE_NAME --action Allow --ip-address 192.168.0.0/27 --priority 250 --scm-site true
```
Contributor guide
Assessment
This issue has not been assessed yet.