Invalid audience for Key Vault secret operations when using MSI

pulumi / pulumi-azure-native

Azure Native Provider

Apache License 2.0

125 stars 33 forks source link

Invalid audience for Key Vault secret operations when using MSI #2432

Open thomas11 opened 1 year ago

thomas11 commented 1 year ago

error: keyvault.BaseClient#DeleteSecret: Failure responding to request: StatusCode=401 -- Original Error: autorest/azure: Service returned an error. Status=401 Code="Unauthorized" Message="AKV10022: Invalid audience. Expected https://vault.azure.net, found: https://management.azure.com/."

When using Managed Identity (ARM_USE_MSI) with the Pulumi Automation API. See #2374 for the original report. That issue is about the same error but using az CLI authentication, which was fixed.

brucetan-displayr commented 6 months ago

Having the same error, woudl be good if this is fixed

thomas11 commented 5 months ago

I took a more in-depth look at this and unfortunately, it's due to a shortcoming in a dependency that we use that cannot be upgraded quickly. Related to #1464. We will try to schedule this workstream soon.