Azure / Azure/azure-powershell

New-AzApplicationGateway doesn't support creating WAF_v2 Tier with Managed Identity

Open
#20,910 4 comments 0 reactions 0 assignees View on GitHub
act-quality-productivity-squad bug customer-reported Network - Application Gateway Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

The Identity-based parameter sets (IdentityByUserAssignedIdentityId and IdentityByIdentityObject) for New-AzApplicationGateway don't include either the FirewallPolicyId or FirewallPolicy parameters (but they do support the ForceFirewallPolicyAssociation parameter) so trying to create a WAF_v2 app gateway with a managed identity results in a ParameterBindingException (parameter set cannot be resolved...).

### Issue script & Debug output

```PowerShell
# Lots of unrelated preliminary app gw setup commands removed for brevity...
$params = @{
Name = $appGwName
ResourceGroupName = $resourceGroupName
Location = $locationName
Identity = $appGwIdentity
Sku = $appGwStandard2Sku
EnableHttp2 = $true
SSLCertificates = $tlsCertificates
SSLPolicy = $tlsPolicy
FirewallPolicy = $appGwFirewallPolicy
GatewayIpConfigurations = $appGwIpConfigs
FrontendIpConfigurations = $frontEndIpConfigs
FrontendPorts = $frontEndPorts
HttpListeners = $httpListeners
BackendAddressPools = $backEndPools
BackendHttpSettingsCollection = $backEndHttpSettings
UrlPathMaps = $urlPathMaps
RequestRoutingRules = $routingRules
Tag = $tags
}
$DebugPreference='Continue'
New-AzApplicationGateway @params

New-AzApplicationGateway : Parameter set cannot be resolved using the specified named parameters.
At Test.ps1:232 char:10
+ New-AzApplicationGateway @params
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : InvalidArgument: (:) [New-AzApplicationGateway], ParameterBindingException
+ FullyQualifiedErrorId : AmbiguousParameterSet,Microsoft.Azure.Commands.Network.NewAzureApplicationGatewayCommand
```

### Environment data

```PowerShell
Name Value
---- -----
PSVersion 5.1.22621.963
PSEdition Desktop
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0...}
BuildVersion 10.0.22621.963
CLRVersion 4.0.30319.42000
WSManStackVersion 3.0
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
```

### Module versions

```PowerShell
ModuleType Version Name ExportedCommands
---------- ------- ---- ----------------
Script 2.11.2 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefault...}
Script 4.9.1 Az.KeyVault {Add-AzKeyVaultCertificate, Add-AzKeyVaultCertificateContact, Add-AzKeyVaultKey, Add-AzKeyVaultManagedStorageAccount...}
Script 1.1.0 Az.ManagedServiceIdentity {Get-AzFederatedIdentityCredentials, Get-AzSystemAssignedIdentity, Get-AzUserAssignedIdentity, Get-AzUserAssignedIdentityAssociatedResource...}
Script 5.4.0 Az.Network {Add-AzApplicationGatewayAuthenticationCertificate, Add-AzApplicationGatewayBackendAddressPool, Add-AzApplicationGatewayBackendHttpSetting, Add...
```

### Error output

```PowerShell
Message : Parameter set cannot be resolved using the specified named parameters.
StackTrace : at System.Management.Automation.CmdletParameterBinderController.ThrowAmbiguousParameterSetException(UInt32 parameterSetFlags, MergedCommandParameterMetadata bindableParameters)
at System.Management.Automation.CmdletParameterBinderController.ValidateParameterSets(Boolean prePipelineInput, Boolean setDefault)
at System.Management.Automation.CmdletParameterBinderController.BindCommandLineParametersNoValidation(Collection`1 arguments)
at System.Management.Automation.CmdletParameterBinderController.BindCommandLineParameters(Collection`1 arguments)
at System.Management.Automation.CommandProcessor.BindCommandLineParameters()
at System.Management.Automation.CommandProcessor.Prepare(IDictionary psDefaultParameterValues)
at System.Management.Automation.CommandProcessorBase.DoPrepare(IDictionary psDefaultParameterValues)
at System.Management.Automation.Internal.PipelineProcessor.Start(Boolean incomingStream)
at System.Management.Automation.Internal.PipelineProcessor.SynchronousExecuteEnumerate(Object input)
--- End of stack trace from previous location where exception was thrown ---
at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
at System.Management.Automation.Internal.PipelineProcessor.SynchronousExecuteEnumerate(Object input)
at System.Management.Automation.PipelineOps.InvokePipeline(Object input, Boolean ignoreInput, CommandParameterInternal[][] pipeElements, CommandBaseAst[] pipeElementAsts,
CommandRedirection[][] commandRedirections, FunctionContext funcContext)
at System.Management.Automation.Interpreter.ActionCallInstruction`6.Run(InterpretedFrame frame)
at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
at System.Management.Automation.Interpreter.EnterTryCatchFinallyInstruction.Run(InterpretedFrame frame)
Exception : System.Management.Automation.ParameterBindingException
InvocationInfo : {New-AzApplicationGateway}
Line : New-AzApplicationGateway @params
```

Contributor guide

Open the contributing guide

Research direction

Start with the New-AzApplicationGateway IdentityByUserAssignedIdentityId and IdentityByIdentityObject parameter sets and reproduce the issue script using FirewallPolicy or FirewallPolicyId. Confirm that those parameters can be combined with managed identity and that creating a WAF_v2 application gateway no longer raises ParameterBindingException.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, csharp, powershell
Domain
cli, cloud, networking
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
50/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.