Azure / Azure/azure-powershell

Import-AzWebAppKeyVaultCertificate Unnecessary Warning

Open
#21,138 8 comments 0 reactions 1 assignee Claimed by @Kotasudhakarreddy View on GitHub
act-observability-squad App Services bug customer-reported Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
3d 14h
Merged PRs (30d)
54

Description

### Description

When running the Import-AzWebAppKeyVaultCertificate cmdlet I always get the following warning even though I have the key vault permissions configured correctly and the command successfully finishes.

WARNING: Unable to verify Key Vault permissions.
WARNING: You may need to grant Microsoft.Azure.WebSites service principal the Secret:Get permission
WARNING: Find more details here: 'https://azure.github.io/AppService/2016/05/24/Deploying-Azure-Web-App-Certificate-through-Key-Vault.html

I believe I tracked it down to [this line of code](https://github.com/Azure/azure-powershell/blob/4658d70e102d193cd6d4d60e766924d55d1c3984/src/Websites/Websites/Utilities/CmdletHelpers.cs#L451) which checks for the wrong service principal to have permissions on secrets.

In that line it is looking for the application ID 'f8daea97-62e7-4026-becf-13c2ea98e8b4' to have get permissions on secrets. I'm not sure where that application ID comes from, but the correct application ID's are as follows.

AZURE_PUBLIC_WEBSITES_APP_ID = 'abfa0a7c-a6b6-4736-8310-5855508787cd'
AZURE_GOV_WEBSITES_APP_ID = '6a02c803-dafd-4136-b4c3-5a6f318b4714'

These are pulled directly from the Azure CLI implementation of this code [found here](https://github.com/Azure/azure-cli/blob/3a793a0ae1caa9a361cc626d70a6b3eec359b4d9/src/azure-cli/azure/cli/command_modules/appservice/custom.py#L2887). It is also consistent with the [App Service team blog post](https://azure.github.io/AppService/2016/05/24/Deploying-Azure-Web-App-Certificate-through-Key-Vault.html) referenced in the warning.

### Issue script & Debug output

```PowerShell
$DebugPreference='Continue';Import-AzWebAppKeyVaultCertificate -ResourceGroupName "resourceGroupName" -WebAppName "webAppName" -KeyVaultName "/subscriptions/subscription-id/resourceGroups/resourceGroupName/providers/Microsoft.KeyVault/vaults/keyVaultName" -CertName "certificateName"
```

### Environment data

```PowerShell
Name Value
---- -----
PSVersion 7.3.3
PSEdition Core
GitCommitId 7.3.3
OS Microsoft Windows 10.0.22621
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 2.11.2 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefaul…
Script 2.12.1 Az.Websites {Add-AzWebAppAccessRestrictionRule, Add-AzWebAppTrafficRouting, Edi…
```

### Error output

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.