403 after adding options.SelectSnapshot about appconfiguration HOT 15 CLOSED

@jayaraut

I am not able to reproduce this issue, but I want to try to pin down what the problem could be.

First, are you able to run the following with Azure CLI?

az login
az account set -s "<Target subscription id>"
az role definition list -n "App Configuration Data Owner"

If so, can you confirm the output has the following?

    "permissions": [
      {
        "actions": [],
        "condition": null,
        "conditionVersion": null,
        "dataActions": [
          "Microsoft.AppConfiguration/configurationStores/*/read",
          "Microsoft.AppConfiguration/configurationStores/*/write",
          "Microsoft.AppConfiguration/configurationStores/*/delete",
          "Microsoft.AppConfiguration/configurationStores/*/action"
        ],

from appconfiguration.

I believe I know what the issue is, and I suspect it is server side. I don't expect this will be an issue if you are deployed to Azure and running with a managed identity. But indeed, if what I suspect it is true the setup you have described will be broken.

I will attempt to reproduce to confirm and if I do confirm I can discuss details of resolution.

Edit:
Just want to mention, I don't believe this would have ever worked. I don't expect it's a regression.

from appconfiguration.

I have confirmed the issue. This occurs when using a visual studio login to access snapshots. This occurs when running in visual studio and using either VisualStudioCredential or DefaultAzureCredential (only while running in visual studio) for authentication.

This is not a regression, but rather this specific scenario was never enabled. A service update will be made to enable this scenario.

To work around this issue that can occur when running from visual studio, AzureCliCredential can be used. This does require downloading and logging in to the Azure CLI.

from appconfiguration.

Hey @jimmyca15 , I work with @jayaraut , just wanted to say thank you for your quick work on this. We just started implementing Azure App Configuration at our org and this will help immensely in our developers' workflows. Have a great weekend!

from appconfiguration.

This should be fixed now.

from appconfiguration.

Thanks, this is working now!

from appconfiguration.

@vsarunov When a role is added it can take ~15 minutes for the role to propagate. Can you confirm that it's still occurring to rule out the possibility of the role not being propagated yet?

from appconfiguration.

I'm experiencing the same issue. It's been half a day since the snapshot was created, and the roles for Azure Data Reader and Azure Data Owner have been added for quite some time.

from appconfiguration.

@jayaraut

So you also are able to successfully read settings if you remove SelectSnapshot, but adding SelectSnapshot causes failure?

from appconfiguration.

Yes, I am able to read from the azure app config but when I created snapshot and wanted to read the same using SelectSnapshot it is breaking with 403 exception.

from appconfiguration.

I have the permissions you mentioned above.

from appconfiguration.

@jayaraut Are you running this in Visual Studio / VS Code? Or is this deployed to Azure and running with a managed identity?

from appconfiguration.

I am currently running it in visual studio using my visual studio identity. But I have managed identity for deployed code. Both managed identity and my visual studio login identity have same App Configuration Data Owner role.

from appconfiguration.

@jimmyca15 , can you please let us know under this thread when the service update is completed enabling this scenario as I want to use DefaultAzureCredential in my code.

from appconfiguration.

Yes.

from appconfiguration.