Azure / Azure/azure-powershell
Unable to Complete Cross Tenant Peering with ARM
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 3d 14h
- Merged PRs (30d)
- 54
Description
### Description
Similar to issues reported in [Azure CLI ](https://github.com/Azure/azure-cli/issues/16691)however different way to reproduce.
Scenario
Attempting to deploy an ARM Template as described in [Article](https://docs.microsoft.com/en-gb/azure/virtual-network/create-peering-different-subscriptions#template) which will complete a peering between two Virtual Networks in different tenants which returns an error message. The same happens in CLI when using group deployment.
The ARM Template:
`{
"$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {},
"variables": {},
"resources": [
{
"apiVersion": "2017-10-01",
"type": "Microsoft.Network/virtualNetworks/virtualNetworkPeerings",
"name": "",
"location": "",
"properties": {
"allowVirtualNetworkAccess": true,
"allowForwardedTraffic": true,
"allowGatewayTransit": false,
"useRemoteGateways": true,
"remoteVirtualNetwork": {
"id": "/subscriptions//resourceGroups//providers/Microsoft.Network/virtualNetworks/"
}
}
}
],
"outputs": {}
}`
Command being used to deploy:
`New-AzResourceGroupDeployment -Name "VirtualNetworkDeployment" -ResourceGroupName ""` -TemplateFile .\virtualNetworkPeer.json -Verbose`
### Issue script & Debug output
```PowerShell
New-AzResourceGroupDeployment : 11:34:21 - The deployment 'VirtualNetworkDeployment' failed with error(s). Showing 1 out of 1 error(s).
Status Message: The client has permission to perform action 'Microsoft.Network/virtualNetworks/peer/action' on scope
'/subscriptions//resourcegroups//providers/Microsoft.Network/virtualNetworks//virtualNetworkPeerings/', however the current tenant '' is not authorized to access linked subscription ''.
```
### Environment data
```PowerShell
Name Value
---- -----
PSVersion 5.1.19041.1320
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.19041.1320
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
```
### Module versions
```PowerShell
4.2.0
```
### Error output
```PowerShell
New-AzResourceGroupDeployment : 11:34:21 - The deployment 'VirtualNetworkDeployment' failed with error(s). Showing 1 out of 1 error(s).
Status Message: The client has permission to perform action 'Microsoft.Network/virtualNetworks/peer/action' on scope
'/subscriptions//resourcegroups//providers/Microsoft.Network/virtualNetworks//virtualNetworkPeerings/', however the current tenant '' is not authorized to access linked subscription ''.
```
Contributor guide
Research direction
Start by reproducing the deployment with .\virtualNetworkPeer.json and New-AzResourceGroupDeployment using the reported cross-tenant virtual network peering template. Trace the authorization failure for Microsoft.Network/virtualNetworks/peer/action and the linked destination subscription in Azure PowerShell module 4.2. Done means the documented cross-tenant deployment succeeds or the supported limitation and required configuration are clearly identified.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, powershell
- Domain
- cloud, networking
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100