Azure / Azure/azure-powershell

[Az.Storage] New created storage account might fail to do cross tenant object replication with Set-AzStorageObjectReplicationPolicy

Open
#22,361 1 comment 0 reactions 0 assignees View on GitHub
act-codegen-extensibility-squad External Storage
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
2d 17h
Merged PRs (30d)
51

Description

### Description

Beginning August 2023, New created storage account without set parameters "-AllowCrossTenantReplication $true" might will fail to do cross tenant object replication.

This is caused by a Storage server change:
Beginning August 2023, Azure storage will begin phased roll out of changes that disables anonymous access and cross tenant replication for all new storage accounts by default, to align with best practices for security and reduce the risk of data exfiltration.
See more details in [blog post](https://techcommunity.microsoft.com/t5/azure-storage-blog/azure-storage-updating-some-default-security-settings-on-new/ba-p/3819554).

User can identify this issue by run `Set-AzStorageObjectReplicationPolicy` with parameter `-Debug`, and see the error code from server is `"code": "CrossTenantReplicationNotAllowed"`

### Module versions
All Az.Storage module versions will be impacted.
(The change will impact all API versions. So both released Az.Storage module and coming Az.Storage module will be impacted.)

### Issue script & Debug output

```PowerShell
PS > $account = New-AzStorageAccount -ResourceGroupName $rgname -StorageAccountName $accountName -SkuName Standard_LRS -Location $location
...
PS C:\temp> Set-AzStorageObjectReplicationPolicy -ResourceGroupName $rgname -StorageAccountName $destAccountName -PolicyId default -SourceAccount $SrcAccountResourceId -Rule $rule1,$rule2 -debug
DEBUG: 17:56:41 - RSetAzureStorageAccountObjectReplicationPolicyCommand begin processing with ParameterSet 'AccountName'.

...

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
PUT

Absolute Uri:
https://management.azure.com/subscriptions/{SubscriptionID}/resourceGroups/{ResourceGroupName}/providers/Microsoft.Storage/storageAccounts/{destAccountName}/objectReplicationPolicies/default?api-version=2022-09-01

Headers:
x-ms-client-request-id : 4f75ace1-d81b-436c-8721-f92e72a0fa16
accept-language : en-US

Body:
{
"properties": {
"sourceAccount": "/subscriptions/{SubscriptionID}/resourceGroups/{ResourceGroupName}/providers/Microsoft.Storage/storageAccounts/{SourceAccountName}",
"destinationAccount": "/subscriptions/{SubscriptionID}/resourceGroups/{ResourceGroupName}/providers/Microsoft.Storage/storageAccounts/{destAccountName}",
"rules": [
{
"sourceContainer": "src1",
"destinationContainer": "dest1"
}
]
}
}

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
BadRequest

Headers:
Pragma : no-cache
x-ms-request-id : 69e1958f-e0f6-4f80-a695-e0ca9a47de7f
Strict-Transport-Security : max-age=31536000; includeSubDomains
x-ms-ratelimit-remaining-subscription-writes: 1197
x-ms-correlation-request-id : 5ec27a82-759d-4442-918b-f9a95fdbd568
x-ms-routing-request-id : SOUTHEASTASIA:20230718T095733Z:5ec27a82-759d-4442-918b-f9a95fdbd568
X-Content-Type-Options : nosniff
Cache-Control : no-cache
Date : Tue, 18 Jul 2023 09:57:32 GMT
Server : Microsoft-Azure-Storage-Resource-Provider/1.0,Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0

Body:
{
"error": {
"code": "CrossTenantReplicationNotAllowed",
"message": "Cross tenant object replication is disallowed on the storage account. Source account and destination account belong to different Azure Active Directory tenants."
}
}

DEBUG: 17:56:46 - [ConfigManager] Got [False] from [EnableDataCollection], Module = [], Cmdlet = [].
Set-AzStorageObjectReplicationPolicy : Operation returned an invalid status code 'BadRequest'
At line:1 char:1
+ Set-AzStorageObjectReplicationPolicy -ResourceGroupName $rgname -Stor ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : CloseError: (:) [Set-AzStorageObjectReplicationPolicy], ErrorResponseException
+ FullyQualifiedErrorId : Microsoft.Azure.Commands.Management.Storage.RSetAzureStorageAccountObjectReplicationPolicyCommand

DEBUG: 17:56:48 - [ConfigManager] Got nothing from [DisplayBreakingChangeWarning], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: 17:56:48 - [ConfigManager] Got nothing from [DisplayRegionIdentified], Module = [], Cmdlet = []. Returning default value [True].
DEBUG: AzureQoSEvent: Module: Az.Storage:5.8.1; CommandName: Set-AzStorageObjectReplicationPolicy; PSVersion: 5.1.19041.3031; IsSuccess: False; Duration: 00:00:07.0080181; Exception: Operation returned an invalid status code 'BadRequest';
DEBUG: 17:56:48 - RSetAzureStorageAccountObjectReplicationPolicyCommand end processing.
```

### Workaround
For new Storage Account, users can workaround it by set `-AllowCrossTenantReplication $true ` in create storage account.
Set to true if required. Otherwise, we recommend setting it to false to follow best security practices
```PowerShell
New-AzStorageAccount -ResourceGroupName $rgname -StorageAccountName $accountName -SkuName Standard_LRS -Location $location -AllowCrossTenantReplication $true
```
For existing Storage Account, users can workaround it by updating storage account with `-AllowCrossTenantReplication $true `.
Set to true if required. Otherwise, we recommend setting it to false to follow best security practices
```PowerShell
Set-AzStorageAccount -ResourceGroupName $rgname -StorageAccountName $accountName -AllowCrossTenantReplication $true
```

Contributor guide

Open the contributing guide

Research direction

The issue names New-AzStorageAccount, Set-AzStorageAccount, and Set-AzStorageObjectReplicationPolicy but does not identify source files or tests. Start by reproducing the CrossTenantReplicationNotAllowed response with the shown commands and inspect how -AllowCrossTenantReplication is handled. Done should be defined as an agreed module or documentation change that addresses the new-account behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.