Azure / Azure/azure-powershell
New-AzAppServicePlan cannot create plan for ASE in another subscription
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 2d 17h
- Merged PRs (30d)
- 51
Description
## Description
Although I understand it should be possible I cannot use the PS1 cmdlet to add a Web App plan in Sub A to a ASE in Sub B - where the user is owner in Sub B (ASE) and has RG Contributor + "Web Plan Contributor" which has "Microsoft.Web/hostingEnvironments/Join/Action" in Sub A (where plan is to be created)
## Steps to reproduce
```powershell
# In context of Sub A - where RG "begim" exists and plan should be created
New-AzAppServicePlan -ResourceGroupName "begim" -Name "begim-we-sub-ase-wap" -Location "uksouth" -Tier "Isolated" -NumberofWorkers 1 -WorkerSize "Small" -AseName "subscriptions//resourceGroups/ase-rg/providers/Microsoft.Web/hostingEnvironments/begimase" -AseResourceGroupName "ase-rg" -debug
```
Gives
Body:
{
"error": {
"code": "LinkedAuthorizationFailed",
"message": "The client 'begim@microsoft.com' with object id 'a2e62ab2-6f11-4259-a85c-ff673d5e30e8' has permission to perform action 'Microsoft.Web/serverfarms/write' on scope '/subscriptions//resourceGroups/begim/providers/Microsoft.Web/serverfarms/begim-we-sub-ase-wap'; however, it does not have permission to perform action 'Microsoft.Web/hostingEnvironments/join/action' on the linked scope(s) '/subscriptions/bb399662-54b9-4780-af25-084a0031fd81/resourcegroups/ase-rg/providers/Microsoft.Web/hostingEnvironments/subscriptions//resourceGroups/ase-rg/providers/Microsoft.Web/hostingEnvironments/begimase' or the linked scope(s) are invalid."
}
}
New-AzAppServicePlan: Operation returned an invalid status code 'Forbidden'
DEBUG: AzureQoSEvent: Module: Az.Websites:2.8.3; CommandName: New-AzAppServicePlan; PSVersion: 7.1.4; IsSuccess: False; Duration: 00:00:02.4859727; Exception: Operation returned an invalid status code 'Forbidden';
DEBUG: Finish sending metric.
DEBUG: 16:12:32 - NewAzureAppServicePlanCmdlet end processing.
## Environment data
```
Name Value
---- -----
PSVersion 7.1.4
PSEdition Core
GitCommitId 7.1.4
OS Microsoft Windows 10.0.22000
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```
## Module versions
```powershell
Directory: C:\Users\begim\Documents\PowerShell\Modules
ModuleType Version PreRelease Name PSEdition ExportedCommands
---------- ------- ---------- ---- --------- ----------------
Script 6.5.0 Az Core,Desk
```
## Debug output
```
```
## Error output
```
HistoryId: 16
Message : Operation returned an invalid status code 'Forbidden'
StackTrace : at Microsoft.Azure.Management.WebSites.AppServicePlansOperations.BeginCreateOrUpdateWithHttpMessagesAsync(String resourceGroupName, String name, AppServicePlan appServicePlan, Dictionary`2
customHeaders, CancellationToken cancellationToken)
at Microsoft.Azure.Management.WebSites.AppServicePlansOperations.CreateOrUpdateWithHttpMessagesAsync(String resourceGroupName, String name, AppServicePlan appServicePlan, Dictionary`2 customHeaders,
CancellationToken cancellationToken)
at Microsoft.Azure.Management.WebSites.AppServicePlansOperationsExtensions.CreateOrUpdateAsync(IAppServicePlansOperations operations, String resourceGroupName, String name, AppServicePlan
appServicePlan, CancellationToken cancellationToken)
at Microsoft.Azure.Management.WebSites.AppServicePlansOperationsExtensions.CreateOrUpdate(IAppServicePlansOperations operations, String resourceGroupName, String name, AppServicePlan appServicePlan)
at Microsoft.Azure.Commands.WebApps.Utilities.WebsitesClient.CreateOrUpdateAppServicePlan(String resourceGroupName, String appServicePlanName, AppServicePlan appServicePlan, String aseName, String
aseResourceGroupName)
at Microsoft.Azure.Commands.WebApps.Cmdlets.AppServicePlans.NewAzureAppServicePlanCmdlet.ExecuteCmdlet()
at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.<>c__3`1.b__3_0(T c)
at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet, Action`1 executor)
at Microsoft.WindowsAzure.Commands.Utilities.Common.CmdletExtensions.ExecuteSynchronouslyOrAsJob[T](T cmdlet)
at Microsoft.WindowsAzure.Commands.Utilities.Common.AzurePSCmdlet.ProcessRecord()
Exception : Microsoft.Azure.Management.WebSites.Models.DefaultErrorResponseException
InvocationInfo : {New-AzAppServicePlan}
Line : New-AzAppServicePlan -ResourceGroupName "begim" -Name "begim-we-sub-ase-wap" -Tier "Isolated" -NumberofWorkers 1 -WorkerSize "Small" -AseName
"subscriptions//resourceGroups/ase-rg/providers/Microsoft.Web/hostingEnvironments/begimase" -AseResourceGroupName "ase-rg" -location uksouth -debug
Position : At line:1 char:1
+ New-AzAppServicePlan -ResourceGroupName "begim" -Name "begim-we-sub-a …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
HistoryId : 16
The Azure PowerShell team is listening, please let us know how we are doing: https://aka.ms/azpssurvey?Q_CHL=ERROR.
```
Contributor guide
Assessment
This issue has not been assessed yet.