This is autogenerated. Please review and update as needed.
Describe the bug
When applying access restrictions to web app from a subnet in a different subscription you receive error when using azure-cli. Works correctly when using arm template deployment or portal.
Consider the following setup:
WebApp Subscription: subscription-app
WebApp Resourcegroup: resourcegroup-app
WebApp Name: app
Vnet Subscription: subscription-vnet
Vnet Resourcegroup: resourcegroup-vnet
Vnet Name: vnet
Subnet Name: subnet
Command Name
az webapp config access-restriction add -g "resourcegroup-app" -n "app" --rule-name "allow" --action Allow --subnet "/subscriptions/{subscription-vnet}/resourceGroups/{resourcegroup-vnet}/providers/Microsoft.Network/virtualNetworks/{vnet}/subnets/{subnet}" --priority 100 --scm-site false
Errors:
Using least-access:
(AuthorizationFailed) The client 'fdxxx' with object id 'fdxxx' does not have authorization to perform action 'Microsoft.Network/virtualNetworks/subnets/read' over scope '/subscriptions/{**subscription-app**}/resourceGroups/{resourcegroup-vnet}/providers/Microsoft.Network/virtualNetworks/{vnet}/subnets/{subnet}' or the scope is invalid. If access was recently granted, please refresh your credentials.
Using full-access to both subscriptions:
(ResourceGroupNotFound) Resource group 'resourcegroup-vnet' could not be found.
To Reproduce:
In two different subscriptions create a web app and a vnet. Add access restriction on the web app using the following command:
az loginaz account set --subscription subscription-appaz webapp config access-restriction add -g "resourcegroup-app" -n "app" --rule-name "allow" --action Allow --subnet "/subscriptions/{subscription-vnet}/resourceGroups/{resourcegroup-vnet}/providers/Microsoft.Network/virtualNetworks/{vnet}/subnets/{subnet}" --priority 100 --scm-site false
Expected Behavior
An access restriction is added to the web app that has a reference to the subnet in the other subscription.
Environment Summary
Windows-10-10.0.19041-SP0
Python 3.6.8
Installer: MSI
azure-cli 2.19.1
Additional Context
This is autogenerated. Please review and update as needed.
Describe the bug
When applying access restrictions to web app from a subnet in a different subscription you receive error when using azure-cli. Works correctly when using arm template deployment or portal.
Consider the following setup:
WebApp Subscription: subscription-app
WebApp Resourcegroup: resourcegroup-app
WebApp Name: app
Vnet Subscription: subscription-vnet
Vnet Resourcegroup: resourcegroup-vnet
Vnet Name: vnet
Subnet Name: subnet
Command Name
az webapp config access-restriction add -g "resourcegroup-app" -n "app" --rule-name "allow" --action Allow --subnet "/subscriptions/{subscription-vnet}/resourceGroups/{resourcegroup-vnet}/providers/Microsoft.Network/virtualNetworks/{vnet}/subnets/{subnet}" --priority 100 --scm-site falseErrors:
To Reproduce:
In two different subscriptions create a web app and a vnet. Add access restriction on the web app using the following command:
az loginaz account set --subscription subscription-appaz webapp config access-restriction add -g "resourcegroup-app" -n "app" --rule-name "allow" --action Allow --subnet "/subscriptions/{subscription-vnet}/resourceGroups/{resourcegroup-vnet}/providers/Microsoft.Network/virtualNetworks/{vnet}/subnets/{subnet}" --priority 100 --scm-site falseExpected Behavior
An access restriction is added to the web app that has a reference to the subnet in the other subscription.
Environment Summary
Additional Context