Azure / Azure/azure-rest-api-specs

managed HSM purge deleted key LRO operation can not be terminated correctly

Open
#27,138 0 comments 0 reactions 0 assignees View on GitHub
KeyVault Service Attention
Dominant language
TypeSpec
Stars
3.1k
Forks
5.9k
Avg merge
2d 22h
Merged PRs (30d)
444

Description

After the purge operation is POSTed, the polling operation will always return a `202` status code. Consequently, the SDK cannot terminate the polling process in even 40 minutes.

```http
POST https://management.azure.com/subscriptions/xxxx/providers/Microsoft.KeyVault/locations/westeurope/deletedManagedHSMs/xxx
/purge?api-version=2023-02-01 HTTP/2.0
content-type: application/json; charset=utf-8
user-agent: Go/go1.21.4 (amd64-linux) go-autorest/v14.2.1 hashicorp/go-azure-sdk/managedhsms/2023-02-01 HashiCorp Terraform/1.3.7 (+https://www.terraform.io) Terraform Plugin SDK/2.10.1 terraform-provider-azurerm/dev pid-222c6c49-1b0a-5959-a213-6608f9eb8820
authorization: Bearer xxx
x-ms-correlation-request-id: 2bafbe1b-c81d-bc96-dce6-91141aaa7879
content-length: 0
accept-encoding: gzip

HTTP/2.0 202
cache-control: no-cache
pragma: no-cache
expires: -1
location: https://management.azure.com/subscriptions/xxx/providers/Microsoft.KeyVault/locations/westeurope/managedHsmOperationResults/xxx?api-version=2023-02-01&t=638386289284351712&c=xxx-wr9PTxA&h=5wX6VNUvzTrGN_OfiJzmn3S10gSc_1phib_rUQpcLQI
x-ms-client-request-id: af369dcc-e532-47e8-b379-10e6fb658a0e
x-ms-keyvault-service-version: 1.5.1018.0
x-ms-request-id: a9760c18-4526-4a28-ba3f-91fafcde634c
x-content-type-options: nosniff
strict-transport-security: max-age=31536000; includeSubDomains
x-ms-ratelimit-remaining-subscription-writes: 1199
server: Microsoft-IIS/10.0
x-aspnet-version: 4.0.30319
x-ms-correlation-request-id: 2bafbe1b-c81d-bc96-dce6-91141aaa7879
x-ms-routing-request-id: JAPANEAST:20231220T002848Z:8f7debc5-739b-48f4-88cb-0e65787e9bd9
date: Wed, 20 Dec 2023 00:28:47 GMT
content-length: 0
```

UPDATE:

It appears that I need to call the `purge` request twice in order for the managed HSM resource to be completely purged. I have tested this multiple times locally and it consistently persists. The deletedHSM exists after 5 minutes after the first purge call. but if call `purge` twice, the deletedHSM got purged within about 3 minutes.

Contributor guide

Open the contributing guide

Research direction

Read the managed HSM 2023-02-01 REST API definition and inspect the purge POST and managedHsmOperationResults polling URLs shown in the report. Reproduce the request sequence, then compare the documented long-running-operation contract with the observed responses; done means the purge operation reaches a definitive terminal response after one request.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
api, cloud, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.