Azure / Azure/azure-powershell
Disable-AzRecoveryServicesBackupProtection pretends the vault is immutable when it's not
- Dominant language
- C#
- Stars
- 4.8k
- Forks
- 4.3k
- Avg merge
- 3d 14h
- Merged PRs (30d)
- 54
Description
### Description
Disable-AzRecoveryServicesBackupProtection says my vault is immutable when it's not!
> Disable-AzRecoveryServicesBackupProtection: The Vault and Bakcup Item is in Immutable state where destructive operations are not supported. The Vault and Backup Item is immutable, hence operation is denied. Refer to the documentation to learn more: https://aka.ms/AB-ImmutableVaults-States

### Issue script & Debug output
```PowerShell
$RecoverySVName = "infra-dev-vault"
$RecoverySVResourceGroupName = "rg-infra-dev"
$targetVaultId = (Get-AzRecoveryServicesVault -ResourceGroupName $recoverySVResourceGroupName -Name $RecoverySVName).Id
$bkpItem = Get-AzRecoveryServicesBackupItem -BackupManagementType AzureVM -WorkloadType AzureVM -Name S0103954ocsi1a -VaultId $targetVaultId
Disable-AzRecoveryServicesBackupProtection -Item $bkpItem -VaultId $targetVaultId -RetainRecoveryPointsAsPerPolicy -Force
```
Got this error:
> Disable-AzRecoveryServicesBackupProtection: The Vault and Bakcup Item is in Immutable state where destructive operations are not supported. The Vault and Backup Item is immutable, hence operation is denied. Refer to the documentation to learn more: https://aka.ms/AB-ImmutableVaults-States
```
### Environment data
```PowerShell
Name Value
---- -----
PSVersion 7.4.1
PSEdition Core
GitCommitId 7.4.1
OS Microsoft Windows 10.0.22000
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```
### Module versions
```PowerShell
ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 2.15.1 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzConte…
Script 7.1.1 Az.Compute {Add-AzImageDataDisk, Add-AzVhd, Add-AzVMAddition…
Script 7.4.0 Az.Network {Add-AzApplicationGatewayAuthenticationCertificat…
Script 6.7.1 Az.RecoveryServices {Add-AzRecoveryServicesAsrReplicationProtectedIte…
```
### Error output
```PowerShell
RequestId : 16d21045-8946-455b-b67e-6d8e41253221
Message : The Vault and Bakcup Item is in Immutable state where destructive operations are not supported. The
Vault and Backup Item is immutable, hence operation is denied. Refer to the documentation to learn
more: https://aka.ms/AB-ImmutableVaults-States
ServerMessage : UserErrorOperationDeniedOnImmutableItem: The Vault and Bakcup Item is in Immutable state where
destructive operations are not supported. The Vault and Backup Item is immutable, hence operation is
denied. Refer to the documentation to learn more: https://aka.ms/AB-ImmutableVaults-States
(System.Collections.Generic.List`1[Microsoft.Rest.Azure.CloudError])
ServerResponse : {BadRequest}
RequestMessage : {PUT https://management.azure.com/subscriptions//resourceGroups/rg
-infra-dev/providers/Microsoft.RecoveryServices/vaults/infra-dev-vault/backupFabrics/Azure/protectionC
ontainers/IaasVMContainer%3Biaasvmcontainerv2%3B%3BS0103954ocsi1a/protectedItems/VM%
3Biaasvmcontainerv2%3B%3BS0103954ocsi1a?api-version=2023-04-01}
InvocationInfo : {Disable-AzRecoveryServicesBackupProtection}
Line : Disable-AzRecoveryServicesBackupProtection -Item $bkpItem -VaultId $targetVaultId
-RetainRecoveryPointsAsPerPolicy -Force
Position : At C:\Git\Remove-NxAzVM.ps1:94 char:9
+ Disable-AzRecoveryServicesBackupProtection -Item $bkpItem -Va …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
StackTrace : at Microsoft.Azure.Management.RecoveryServices.Backup.ProtectedItemsOperations.CreateOrUpdateWithHt
tpMessagesAsync(String vaultName, String resourceGroupName, String fabricName, String containerName,
String protectedItemName, ProtectedItemResource parameters, Dictionary`2 customHeaders,
CancellationToken cancellationToken)
HistoryId : 9
```
Contributor guide
Research direction
Start with Disable-AzRecoveryServicesBackupProtection in C:\Git\Remove-NxAzVM.ps1 at line 94 and reproduce the PUT request shown in the error output. Compare the vault and backup-item immutability state with the command's rejection, then verify that the command reports the actual state and handles a non-immutable vault correctly.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, powershell
- Domain
- backend, cloud
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100