`az functionapp config access-restriction add --service-tag` is broken in 2.47.0

[stoney95]

Describe the bug

I try to add an access-restriction with the --service-tag option. This results in a failure.

Command Name az functionapp config access-restriction add

Errors:

'values'

This is all I get when running the command

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• az functionapp config access-restriction add --name {} --resource-group {} --subscription {} --rule-name {} --priority {} --action {} --service-tag {}

Expected Behavior

I can add an access-restriction with a service tag

Environment Summary

macOS-13.2.1-arm64-arm-64bit, Darwin 22.3.0
Python 3.10.11
Installer: HOMEBREW

azure-cli 2.47.0

Dependencies:
msal 1.20.0
azure-mgmt-resource 22.0.0

Additional Context

Adding other kinds of access-restrictions (e.g. IP ranges) works. Downgrading to azure-cli==2.46.0 "fixes" the bug. So, this error seems to be specific to azure-cli==2.47.0. The same error appears when installing the azure-cli with pip. We also face this error in our debian based docker image.

[yonzhan]

Thank you for opening this issue, we will look into it.

[ghost]

Thank you for your feedback. This has been routed to the support team for assistance.

[SaurabhSharma-MSFT]

@stoney95 I am unable to reproduce this issue. Please can you try running the cmdlet using --debug and share the logs. Thanks.

[SaurabhSharma-MSFT]

@stoney95 Please let us know if you are still having issues.

[SaurabhSharma-MSFT]

@stoney95 We will now proceed to close this thread as we haven't heard back. If there are further questions regarding this matter, please reopen it and we will gladly continue the discussion.

[johnnyoshika]

I have the same error. Here's my command:

az functionapp config access-restriction add `
    -g $resourceGroup `
    -n $funcAppName `
    --rule-name allow_eventgrid `
    --action Allow `
    --priority 100 `
    --service-tag AzureEventGrid `
    --debug

I can send the full debug output in a PM, but here's parts of it:

@SaurabhSharma-MSFT can you please reopen the issue?

[guytp]

Confirmed as a bug.

As above the issue is that the az cli call to '/subscriptions/XXX/providers/Microsoft.Network/locations/northeurope/serviceTags?api-version=2022-01-01' is returning an empty array and not includinng any service tags. As a result it cannot parse and bombs out before even trying to add the resource.

Command:

az functionapp config access-restriction add --resource-group $rg --name $functionAppName --action Allow --rule-name Allow-From-Front-Door --priority 100 --service-tag AzureFrontDoor.Backend --http-header x-azure-fdid=$fdid --subscription $sub --debug

I have tried this on both a North Europe and Central India vnet-connected function apps and same issue on both.

DEBUG: cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/XXX/providers/Microsoft.Network/locations/northeurope/serviceTags?api-version=2022-01-01'

DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'GET'

DEBUG: cli.azure.cli.core.sdk.policies: Request headers:

DEBUG: cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'

DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-client-request-id': 'XXX'

DEBUG: cli.azure.cli.core.sdk.policies: 'CommandName': 'functionapp config access-restriction add'

DEBUG: cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--resource-group --name --action --rule-name --priority --service-tag --http-header --subscription --debug'

DEBUG: cli.azure.cli.core.sdk.policies: 'User-Agent': 'AZURECLI/2.51.0 (MSI) (AAZ) azsdk-python-core/1.26.0 Python/3.10.10 (Windows-10-10.0.22621-SP0)'

DEBUG: cli.azure.cli.core.sdk.policies: 'Authorization': '*****'

DEBUG: cli.azure.cli.core.sdk.policies: Request body:

DEBUG: cli.azure.cli.core.sdk.policies: This request has no body

DEBUG: urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443

DEBUG: urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/XXX/providers/Microsoft.Network/locations/northeurope/serviceTags?api-version=2022-01-01 HTTP/1.1" 200 147

DEBUG: cli.azure.cli.core.sdk.policies: Response status: 200

DEBUG: cli.azure.cli.core.sdk.policies: Response headers:

DEBUG: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'

DEBUG: cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'

DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'

DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Encoding': 'gzip'

DEBUG: cli.azure.cli.core.sdk.policies: 'Expires': '-1'

DEBUG: cli.azure.cli.core.sdk.policies: 'Vary': 'Accept-Encoding'

DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-request-id': 'XXX'

DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-correlation-request-id': 'XXX'

DEBUG: cli.azure.cli.core.sdk.policies: 'x-ms-routing-request-id': 'NORTHEUROPE:20230805T190051Z:XXX'

DEBUG: cli.azure.cli.core.sdk.policies: 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains'

DEBUG: cli.azure.cli.core.sdk.policies: 'X-Content-Type-Options': 'nosniff'

DEBUG: cli.azure.cli.core.sdk.policies: 'Date': 'Sat, 05 Aug 2023 19:00:50 GMT'

DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Length': '147'

DEBUG: cli.azure.cli.core.sdk.policies: Response content:

DEBUG: cli.azure.cli.core.sdk.policies: {"value":[],"nextLink":""}

DEBUG: cli.azure.cli.core.azclierror: Traceback (most recent call last): File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\knack/invocation.py", line 113, in _validation File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/core/commands/init.py", line 859, in _validate_arg_level File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/appservice/_validators.py", line 296, in validate_service_tag File "D:\a_work\1\s\build_scripts\windows\artifacts\cli\Lib\site-packages\azure/cli/command_modules/appservice/_validators.py", line 313, in _validate_service_tag_format

KeyError: 'values'

ERROR: cli.azure.cli.core.azclierror: 'values'

ERROR: az_command_data_logger: 'values'

DEBUG: cli.knack.cli: Event: Cli.PostExecute [<function AzCliLogging.deinit_cmd_metadata_logging at 0x03F6B6A0>]

INFO: az_command_data_logger: exit code: 2

[jcontti-axa]

Was this fixed? because I have same behaviour...

{ "azure-cli": "2.51.0", "azure-cli-core": "2.51.0", "azure-cli-telemetry": "1.1.0", "extensions": { "ai-examples": "0.2.5", "ml": "2.19.1", "rdbms-connect": "1.0.4", "ssh": "2.0.1" } }

[r300mrg]

Was this fixed? I see this ticket is closed, but no comments to confirm. I'm experiencing this same issue with Azure CLI v2.60.0

Strangely, running on a Local Ubuntu VM the az functionapp config access-restriction add --service-tag command works as expected.

However, when running through a Microsoft hosted yaml pipeline deployment I get no service tag data returned and the following error and the command fails:

DEBUG: cli.azure.cli.core.sdk.policies: Response content: DEBUG: cli.azure.cli.core.sdk.policies: {"value":[],"nextLink":""} DEBUG: cli.azure.cli.core.azclierror: Traceback (most recent call last): File "/opt/az/lib/python3.11/site-packages/knack/invocation.py", line 113, in _validation self._validate_arg_level(parsed_ns) File "/opt/az/lib/python3.11/site-packages/azure/cli/core/commands/init.py", line 898, in _validate_arg_level validator(**self._build_kwargs(validator, ns)) File "/opt/az/lib/python3.11/site-packages/azure/cli/command_modules/appservice/_validators.py", line 330, in validate_service_tag _validate_service_tag_format(cmd, namespace) File "/opt/az/lib/python3.11/site-packages/azure/cli/command_modules/appservice/_validators.py", line 355, in _validate_service_tag_format for tag_full_list in service_tag_full_list["values"]:

KeyError: 'values'

ERROR: cli.azure.cli.core.azclierror: 'values'
ERROR: az_command_data_logger: 'values'

DEBUG: cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.Network/locations/westus2/serviceTags?api-version=2022-01-01'