Unable to create backup vaults with immutability locked az backup vault create with --immutability-state Locked

[davepattie]

Describe the bug

Unable to create a backup vault with immutability Locked. The same error affects the Terraform provider so the underlying fault is with the API

Related command

az backup vault create --location eastus --name rsv-backup-test --resource-group rg-backup-test --immutability-state Locked

Errors

(UserErrorUnsupportedVaultImmutabilityStateChange) The immutable vault property for this vault is locked, hence, this setting cannot be disabled. The vault has its immutable vault property enabled and locked, and it can no longer be reverted to a non-immutable vault. Refer to the documentation to learn more: https://aka.ms/AB-ImmutableVaults-States
Code: UserErrorUnsupportedVaultImmutabilityStateChange
Message: The immutable vault property for this vault is locked, hence, this setting cannot be disabled. The vault has its immutable vault property enabled and locked, and it can no longer be reverted to a non-immutable vault. Refer to the documentation to learn more: https://aka.ms/AB-ImmutableVaults-States

Issue script & Debug output

az group create --name rg-backup-test --location eastus
az backup vault create --location eastus --name rsv-backup-test --resource-group rg-backup-test --immutability-state Locked

Expected behavior

A new vault is created with immutability locked

Environment Summary

azure-cli 2.53.1

core 2.53.1
telemetry 1.1.0

Extensions:
azure-devops 0.26.0
bastion 0.2.5
quota 0.1.0
ssh 2.0.2
virtual-wan 0.3.0

Dependencies:
msal 1.24.0b2
azure-mgmt-resource 23.1.0b2

Python location '/opt/homebrew/Cellar/azure-cli/2.53.1/libexec/bin/python'
Extensions directory '/Users/Cache/.azure/cliextensions'

Python (Darwin) 3.10.13 (main, Aug 24 2023, 12:59:26) [Clang 15.0.0 (clang-1500.0.40.1)]

Additional context

No response

[yonzhan]

Thank you for opening this issue, we will look into it.

[davepattie]

@yonzhan I see you have removed the assignment and CLI team I assume because you agree it's a problem in the rest-api. Can you point me in the right direction to raise it where it should be?

[Daya-Patil]

adding @zubairabid

[zubairabid]

Hi all, this issue was resolved in the November 2023 release of Azure CLI. Linked PR: #27743.

@yonzhan can we close the issue if @davepattie can confirm that it works in the latest CLI?

[kamfaima]

I'm still experiencing this issue—can someone confirm that it's actually resolved? I'm running Azure CLI 2.62 with Python 3.10

It happens when I run the following command:

• az backup vault create --location 'australiaeast' --name 'rsv-test-001' --resource-group 'rg-backups' --immutability-state Locked

What's interesting is that if I run the equivalent PowerShell command(New-AzRecoveryServicesVault -name 'myRsv' -ResourceGroupName 'rg-backups' -location 'australia east' -ImmutabilityState), then the autocomplete only gives Disabled and Unlocked as possible values for the -ImmutabilityState parameter. There is no Locked option. See the below screenshot as an example.

Yet when I autocomplete --immutability on Azure CLI, it gives Disabled, Unlocked and Locked.

Does this imply that it's a multi-step operation to configure immutability=locked for a RSV? One to create the RSV (default immutability=disabled), another to enable it (immutability=unlocked), and finally lock the immutability setting?

At least this is what I've found:

1. az backup vault create --location 'australiaeast' --name 'rsv-test-001' --resource-group 'rg-backups'
2. az backup vault update --name 'rsv-test-001' --resource-group 'rg-backups' --immutability-state Unlocked
3. az backup vault update --name 'rsv-test-001' --resource-group 'rg-backups' --immutability-state Locked