Azure / Azure/azure-powershell

Disable-AzRecoveryServicesBackupProtection pretends the vault is immutable when it's not

Open
#24,298 11 comments 0 reactions 0 assignees View on GitHub
act-observability-squad bug customer-reported Recovery Services Backup Service Attention
Dominant language
C#
Stars
4.8k
Forks
4.3k
Avg merge
3d 14h
Merged PRs (30d)
54

Description

### Description

Disable-AzRecoveryServicesBackupProtection says my vault is immutable when it's not!

> Disable-AzRecoveryServicesBackupProtection: The Vault and Bakcup Item is in Immutable state where destructive operations are not supported. The Vault and Backup Item is immutable, hence operation is denied. Refer to the documentation to learn more: https://aka.ms/AB-ImmutableVaults-States

![image](https://github.com/Azure/azure-powershell/assets/137691/d56b605d-5a2f-4137-8391-a6e1ac74765a)

### Issue script & Debug output

```PowerShell
$RecoverySVName = "infra-dev-vault"
$RecoverySVResourceGroupName = "rg-infra-dev"
$targetVaultId = (Get-AzRecoveryServicesVault -ResourceGroupName $recoverySVResourceGroupName -Name $RecoverySVName).Id
$bkpItem = Get-AzRecoveryServicesBackupItem -BackupManagementType AzureVM -WorkloadType AzureVM -Name S0103954ocsi1a -VaultId $targetVaultId
Disable-AzRecoveryServicesBackupProtection -Item $bkpItem -VaultId $targetVaultId -RetainRecoveryPointsAsPerPolicy -Force
```

Got this error:
> Disable-AzRecoveryServicesBackupProtection: The Vault and Bakcup Item is in Immutable state where destructive operations are not supported. The Vault and Backup Item is immutable, hence operation is denied. Refer to the documentation to learn more: https://aka.ms/AB-ImmutableVaults-States
```

### Environment data

```PowerShell
Name Value
---- -----
PSVersion 7.4.1
PSEdition Core
GitCommitId 7.4.1
OS Microsoft Windows 10.0.22000
Platform Win32NT
PSCompatibleVersions {1.0, 2.0, 3.0, 4.0…}
PSRemotingProtocolVersion 2.3
SerializationVersion 1.1.0.1
WSManStackVersion 3.0
```

### Module versions

```PowerShell
ModuleType Version PreRelease Name ExportedCommands
---------- ------- ---------- ---- ----------------
Script 2.15.1 Az.Accounts {Add-AzEnvironment, Clear-AzConfig, Clear-AzConte…
Script 7.1.1 Az.Compute {Add-AzImageDataDisk, Add-AzVhd, Add-AzVMAddition…
Script 7.4.0 Az.Network {Add-AzApplicationGatewayAuthenticationCertificat…
Script 6.7.1 Az.RecoveryServices {Add-AzRecoveryServicesAsrReplicationProtectedIte…
```

### Error output

```PowerShell
RequestId : 16d21045-8946-455b-b67e-6d8e41253221
Message : The Vault and Bakcup Item is in Immutable state where destructive operations are not supported. The
Vault and Backup Item is immutable, hence operation is denied. Refer to the documentation to learn
more: https://aka.ms/AB-ImmutableVaults-States
ServerMessage : UserErrorOperationDeniedOnImmutableItem: The Vault and Bakcup Item is in Immutable state where
destructive operations are not supported. The Vault and Backup Item is immutable, hence operation is
denied. Refer to the documentation to learn more: https://aka.ms/AB-ImmutableVaults-States
(System.Collections.Generic.List`1[Microsoft.Rest.Azure.CloudError])
ServerResponse : {BadRequest}
RequestMessage : {PUT https://management.azure.com/subscriptions//resourceGroups/rg
-infra-dev/providers/Microsoft.RecoveryServices/vaults/infra-dev-vault/backupFabrics/Azure/protectionC
ontainers/IaasVMContainer%3Biaasvmcontainerv2%3B%3BS0103954ocsi1a/protectedItems/VM%
3Biaasvmcontainerv2%3B%3BS0103954ocsi1a?api-version=2023-04-01}
InvocationInfo : {Disable-AzRecoveryServicesBackupProtection}
Line : Disable-AzRecoveryServicesBackupProtection -Item $bkpItem -VaultId $targetVaultId
-RetainRecoveryPointsAsPerPolicy -Force

Position : At C:\Git\Remove-NxAzVM.ps1:94 char:9
+ Disable-AzRecoveryServicesBackupProtection -Item $bkpItem -Va …
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
StackTrace : at Microsoft.Azure.Management.RecoveryServices.Backup.ProtectedItemsOperations.CreateOrUpdateWithHt
tpMessagesAsync(String vaultName, String resourceGroupName, String fabricName, String containerName,
String protectedItemName, ProtectedItemResource parameters, Dictionary`2 customHeaders,
CancellationToken cancellationToken)
HistoryId : 9
```

Contributor guide

Open the contributing guide

Research direction

Start with Disable-AzRecoveryServicesBackupProtection in C:\Git\Remove-NxAzVM.ps1 at line 94 and reproduce the PUT request shown in the error output. Compare the vault and backup-item immutability state with the command's rejection, then verify that the command reports the actual state and handles a non-immutable vault correctly.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, powershell
Domain
backend, cloud
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.