Open odegroot opened 1 year ago
Thank you for your feedback. This has been routed to the support team for assistance.
route to CXP team
@odegroot I am not able to reproduce this issue. I have checked with both Azure CLI 2.45 and 2.46 versions, and I am not getting any errors.
Using
--debug
parameters also did not give any error messages.
Is this cmd giving the same error message when you are using outside of the devops pipeline for you?
Yes. When I run the same command from my laptop, not from a devops pipeline, I get the same error.
Details below (identifiers redacted).
Authenticate to the tenant.
$AdoSpApplicationIdAcc = '00000000-0000-0000-0000-000000000000'
$AdoSpCred = Get-Credential -UserName $AdoSpApplicationIdAcc
$TenantAcc = 'mytenant.onmicrosoft.com'
az login --service-principal -u $AdoSpCred.UserName -p $AdoSpCred.GetNetworkCredential().Password --tenant $TenantAcc
Create a brand new subscription, and connect to it.
az account alias create --name 'temporary-alias' --billing-scope /providers/Microsoft.Billing/billingAccounts/00000000/enrollmentAccounts/000000 --display-name delete-me-01 --workload DevTest
az login --service-principal -u $AdoSpCred.UserName -p $AdoSpCred.GetNetworkCredential().Password --tenant $TenantAcc
az account set --subscription delete-me-01
az account show
Create the security contact.
az security contact create --debug --name 'foo-example.com' --email 'foo@example.com' --alert-notifications On --alerts-admins Off
Creation succeeds, but the command errors out:
cli.knack.cli: Command arguments: ['security', 'contact', 'create', '--debug', '--name', 'foo-example.com', '--email', 'foo@example.com', '--alert-notifications', 'On', '--alerts-admins', 'Off']
cli.knack.cli: __init__ debug log:
Enable color in terminal.
cli.knack.cli: Event: Cli.PreExecute []
cli.knack.cli: Event: CommandParser.OnGlobalArgumentsCreate [<function CLILogging.on_global_arguments at 0x0259B538>, <function OutputProducer.on_global_arguments at 0x02767CD0>, <function CLIQuery.on_global_arguments at 0x02787928>]
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableCreate []
cli.azure.cli.core: Modules found from index for 'security': ['azure.cli.command_modules.security']
cli.azure.cli.core: Loading command modules:
cli.azure.cli.core: Name Load Time Groups Commands
cli.azure.cli.core: security 0.007 48 104
cli.azure.cli.core: Total (1) 0.007 48 104
cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
cli.azure.cli.core: Loading extensions:
cli.azure.cli.core: Name Load Time Groups Commands Directory
cli.azure.cli.core: Total (0) 0.000 0 0
cli.azure.cli.core: Loaded 48 groups, 104 commands.
cli.azure.cli.core: Found a match in the command table.
cli.azure.cli.core: Raw command : security contact create
cli.azure.cli.core: Command table: security contact create
cli.knack.cli: Event: CommandInvoker.OnPreCommandTableTruncate [<function AzCliLogging.init_command_file_logging at 0x049562B0>]
cli.knack.cli: Event: CommandInvoker.OnPreArgumentLoad [<function register_global_subscription_argument.<locals>.add_subscription_parameter at 0x0497E2B0>]
cli.knack.cli: Event: CommandInvoker.OnPostArgumentLoad []
cli.knack.cli: Event: CommandInvoker.OnPostCommandTableCreate [<function register_ids_argument.<locals>.add_ids_arguments at 0x0498E1D8>, <function register_cache_arguments.<locals>.add_cache_arguments at 0x0498E3D0>]
cli.knack.cli: Event: CommandInvoker.OnCommandTableLoaded []
cli.knack.cli: Event: CommandInvoker.OnPreParseArgs []
cli.knack.cli: Event: CommandInvoker.OnPostParseArgs [<function OutputProducer.handle_output_argument at 0x02767D18>, <function CLIQuery.handle_query_parameter at 0x02787970>, <function register_ids_argument.<locals>.parse_ids_arguments at 0x0498E388>]
cli.azure.cli.core.commands.client_factory: Getting management service client client_type=SecurityCenter
cli.azure.cli.core.auth.persistence: build_persistence: location='C:\\Users\\me\\.azure\\service_principal_entries.bin', encrypt=True
cli.azure.cli.core.auth.persistence: build_persistence: location='C:\\Users\\me\\.azure\\msal_token_cache.bin', encrypt=True
cli.azure.cli.core.auth.binary_cache: load: C:\Users\me\.azure\msal_http_cache.bin
urllib3.util.retry: Converted retries value: 1 -> Retry(total=1, connect=None, read=None, redirect=None, status=None)
msal.authority: openid_config = {'token_endpoint': 'https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/oauth2/v2.0/token', 'token_endpoint_auth_methods_supported': ['client_secret_post', 'private_key_jwt', 'client_secret_basic'], 'jwks_uri': 'https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/discovery/v2.0/keys', 'response_modes_supported': ['query', 'fragment', 'form_post'], 'subject_types_supported': ['pairwise'], 'id_token_signing_alg_values_supported': ['RS256'], 'response_types_supported': ['code', 'id_token', 'code id_token', 'id_token token'], 'scopes_supported': ['openid', 'profile', 'email', 'offline_access'], 'issuer': 'https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/v2.0', 'request_uri_parameter_supported': False, 'userinfo_endpoint': 'https://graph.microsoft.com/oidc/userinfo', 'authorization_endpoint': 'https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/oauth2/v2.0/authorize', 'device_authorization_endpoint': 'https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/oauth2/v2.0/devicecode', 'http_logout_supported': True, 'frontchannel_logout_supported': True, 'end_session_endpoint': 'https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/oauth2/v2.0/logout', 'claims_supported': ['sub', 'iss', 'cloud_instance_name', 'cloud_instance_host_name', 'cloud_graph_host_name', 'msgraph_host', 'aud', 'exp', 'iat', 'auth_time', 'acr', 'nonce', 'preferred_username', 'name', 'tid', 'ver', 'at_hash', 'c_hash', 'email'], 'kerberos_endpoint': 'https://login.microsoftonline.com/00000000-0000-0000-0000-000000000000/kerberos', 'tenant_region_scope': 'EU', 'cloud_instance_name': 'microsoftonline.com', 'cloud_graph_host_name': 'graph.windows.net', 'msgraph_host': 'graph.microsoft.com', 'rbac_url': 'https://pas.windows.net'}
msal.application: Broker enabled? False
msal.application: Region to be used: None
cli.azure.cli.core.auth.credential_adaptor: CredentialAdaptor.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={}
cli.azure.cli.core.auth.msal_authentication: ServicePrincipalCredential.get_token: scopes=('https://management.core.windows.net//.default',), kwargs={}
msal.application: Cache hit an AT
msal.telemetry: Generate or reuse correlation_id: 09458350-fe82-4816-847c-2fe9efe19771
cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Security/securityContacts/foo-example.com?api-version=2017-08-01-preview'
cli.azure.cli.core.sdk.policies: Request method: 'PUT'
cli.azure.cli.core.sdk.policies: Request headers:
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json'
cli.azure.cli.core.sdk.policies: 'Content-Length': '110'
cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': 'e6872ed9-cd77-11ed-bcda-5c80b672992f'
cli.azure.cli.core.sdk.policies: 'CommandName': 'security contact create'
cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--debug --name --email --alert-notifications --alerts-admins'
cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.46.0 (MSI) azsdk-python-azure-mgmt-security/3.0.0 Python/3.10.10 (Windows-10-10.0.22000-SP0)'
cli.azure.cli.core.sdk.policies: 'Authorization': '*****'
cli.azure.cli.core.sdk.policies: Request body:
cli.azure.cli.core.sdk.policies: {"properties": {"email": "foo@example.com", "phone": "", "alertNotifications": "On", "alertsToAdmins": "Off"}}
urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
urllib3.connectionpool: https://management.azure.com:443 "PUT /subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Security/securityContacts/foo-example.com?api-version=2017-08-01-preview HTTP/1.1" 201 368
cli.azure.cli.core.sdk.policies: Response status: 201
cli.azure.cli.core.sdk.policies: Response headers:
cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
cli.azure.cli.core.sdk.policies: 'Content-Length': '368'
cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
cli.azure.cli.core.sdk.policies: 'Expires': '-1'
cli.azure.cli.core.sdk.policies: 'x-ms-ratelimit-remaining-subscription-resource-requests': '249'
cli.azure.cli.core.sdk.policies: 'api-supported-versions': '2017-08-01-preview'
cli.azure.cli.core.sdk.policies: 'Server': 'Kestrel'
cli.azure.cli.core.sdk.policies: 'x-ms-request-id': '6dca2ac5-b0f9-4746-8fc2-0425bc427c75'
cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': '6dca2ac5-b0f9-4746-8fc2-0425bc427c75'
cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'WESTEUROPE:20230328T145038Z:6dca2ac5-b0f9-4746-8fc2-0425bc427c75'
cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'
cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'
cli.azure.cli.core.sdk.policies: 'Date': 'Tue, 28 Mar 2023 14:50:37 GMT'
cli.azure.cli.core.sdk.policies: Response content:
cli.azure.cli.core.sdk.policies: {"properties":{"alertNotifications":"On","alertsToAdmins":"Off","email":"foo@example.com","phone":""},"id":"/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Security/securityContacts/foo-example.com","name":"foo-example.com","type":"Microsoft.Security/securityContacts","etag":"\"1600ddf5-0000-0d00-0000-6422febe0000\"","location":"West Europe"}
cli.azure.cli.core.azclierror: Traceback (most recent call last):
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/cli.py", line 233, in invoke
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 663, in execute
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 726, in _run_jobs_serially
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 697, in _run_job
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/__init__.py", line 333, in __call__
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/command_operation.py", line 121, in handler
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/security/custom.py", line 285, in create_security_contact
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/core/tracing/decorator.py", line 73, in wrapper_use_tracer
File "D:\a\_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/mgmt/security/v2017_08_01_preview/operations/_security_contacts_operations.py", line 473, in create
azure.core.exceptions.HttpResponseError: Operation returned an invalid status 'Created'
Content: {"properties":{"alertNotifications":"On","alertsToAdmins":"Off","email":"foo@example.com","phone":""},"id":"/subscriptions/00000000-0000-0000-0000-000000000000/providers/Microsoft.Security/securityContacts/foo-example.com","name":"foo-example.com","type":"Microsoft.Security/securityContacts","etag":"\"1600ddf5-0000-0d00-0000-6422febe0000\"","location":"West Europe"}
cli.azure.cli.core.azclierror: Operation returned an invalid status 'Created'
az_command_data_logger: Operation returned an invalid status 'Created'
cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x049563D0>]
cli.__main__: Command ran in 1.712 seconds (init: 0.373, invoke: 1.339)
@odegroot I am not able to reproduce this with your code either and getting the results as expected. Only difference which I could see is the response code is 201
for your response with error message whereas I am getting always getting 200.
Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @chlahav.
Author: | odegroot |
---|---|
Assignees: | SaurabhSharma-MSFT |
Labels: | `bug`, `Service Attention`, `Security`, `customer-reported`, `needs-team-attention`, `Auto-Assign` |
Milestone: | Backlog |
Hi, we're sending this friendly reminder because we haven't heard back from you in a while. We need more information about this issue to help address it. Please be sure to give us your input within the next 7 days. If we don't hear back from you within 14 days of this comment the issue will be automatically closed. Thank you!
@SaurabhSharma-MSFT An overzealous bot unduly closed this issue. Can you reopen it, and remove the needs-author-feedback
label please?
I've also encountered these errors when trying to create a security contact on a newly created subscription.
az security contact create --name="<name>" --email="<email>" --alert-notifications="on" --alerts-admins="off" --subscription=<subscription>
--------------------------------------------------------------------------------------------------------------------------------------------------------------------
Operation returned an invalid status 'Created'
On the first failing request I also get an 201
response, but on subsequent successful requests I get an 200
response back.
az version
-----------------------
{
"azure-cli": "2.50.0",
"azure-cli-core": "2.50.0",
"azure-cli-telemetry": "1.0.8",
}
Related command
Describe the bug
The security contact gets created successfully, but the
az
command fails nonetheless.The REST API returns HTTP status code
201 Created
. This is perfectly valid - see API docs - but the az cli still considers this a failure. It prints an error message and returns a nonzero exit code.To Reproduce
The error occurs "invalid status 'Created'" occurs sometimes, not always. I can reliably reproduce the error on a brand new subscription. There may be other triggers that I'm unaware of.
az security contact create
.After the initial failure, subsequent attempts on the same subscription work just fine, with the exact same inputs. Deleting and then recreating the security contact with the same inputs also works just fine.
Expected behavior
The az cli should treat status code
201 Created
as a success. It shouldn't print an error message.Environment summary
Azure DevOps pipeline step AzureCLI@2
Additional context
Here's the command output with
--debug
enabled. (tenant / subscription IDs redacted)