Azure / Azure/azure-powershell
Import-AzWebAppKeyVaultCertificate Unnecessary Warning
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 3d 14h
- Merged PRs (30d)
- 54
Description
### Description
When running the Import-AzWebAppKeyVaultCertificate cmdlet I always get the following warning even though I have the key vault permissions configured correctly and the command successfully finishes.
WARNING: Unable to verify Key Vault permissions.
WARNING: You may need to grant Microsoft.Azure.WebSites service principal the Secret:Get permission
WARNING: Find more details here: 'https://azure.github.io/AppService/2016/05/24/Deploying-Azure-Web-App-Certificate-through-Key-Vault.html
I believe I tracked it down to [this line of code](https://github.com/Azure/azure-powershell/blob/4658d70e102d193cd6d4d60e766924d55d1c3984/src/Websites/Websites/Utilities/CmdletHelpers.cs#L451) which checks for the wrong service principal to have permissions on secrets.
In that line it is looking for the application ID 'f8daea97-62e7-4026-becf-13c2ea98e8b4' to have get permissions on secrets. I'm not sure where that application ID comes from, but the correct application ID's are as follows.
AZURE_PUBLIC_WEBSITES_APP_ID = 'abfa0a7c-a6b6-4736-8310-5855508787cd'
AZURE_GOV_WEBSITES_APP_ID = '6a02c803-dafd-4136-b4c3-5a6f318b4714'
These are pulled directly from the Azure CLI implementation of this code [found here](https://github.com/Azure/azure-cli/blob/3a793a0ae1caa9a361cc626d70a6b3eec359b4d9/src/azure-cli/azure/cli/command_modules/appservice/custom.py#L2887). It is also consistent with the [App Service team blog post](https://azure.github.io/AppService/2016/05/24/Deploying-Azure-Web-App-Certificate-through-Key-Vault.html) referenced in the warning.
### Issue script & Debug output
```PowerShell
$DebugPreference='Continue';Import-AzWebAppKeyVaultCertificate -ResourceGroupName "resourceGroupName" -WebAppName "webAppName" -KeyVaultName "/subscriptions/subscription-id/resourceGroups/resourceGroupName/providers/Microsoft.KeyVault/vaults/keyVaultName" -CertName "certificateName"
```
### Environment data
```PowerShell
Name Value
---- -----
PSVersion 7.3.3
PSEdition Core
GitCommitId 7.3.3
OS Microsoft Windows 10.0.22621
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```
### Module versions
```PowerShell
ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 2.11.2 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzContext, Clear-AzDefaul…
Script 2.12.1 Az.Websites {Add-AzWebAppAccessRestrictionRule, Add-AzWebAppTrafficRouting, Edi…
```
### Error output
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.