Getting an error as column 'id' requires hydrate data from getKeyVaultSecret but none is available on azure_key_vault_secret table. Closes #104 #111

anisadas · 2021-04-28T11:27:04Z

Integration test logs

Logs

SETUP: tests/azure_key_vault_secret []

PRETEST: tests/azure_key_vault_secret

TEST: tests/azure_key_vault_secret
Running terraform
data.azurerm_client_config.current: Refreshing state...
data.null_data_source.resource: Refreshing state...
azurerm_resource_group.named_test_resource: Creating...
azurerm_resource_group.named_test_resource: Creation complete after 4s [id=/subscriptions/3510ae4d-530b-497d-8f30-53b9616fc6c1/resourceGroups/turbottest12044]
azurerm_key_vault.named_test_resource: Creating...
azurerm_key_vault.named_test_resource: Still creating... [10s elapsed]
azurerm_key_vault.named_test_resource: Still creating... [20s elapsed]
azurerm_key_vault.named_test_resource: Still creating... [30s elapsed]
azurerm_key_vault.named_test_resource: Still creating... [40s elapsed]
azurerm_key_vault.named_test_resource: Still creating... [50s elapsed]
azurerm_key_vault.named_test_resource: Still creating... [1m0s elapsed]
azurerm_key_vault.named_test_resource: Still creating... [1m10s elapsed]
azurerm_key_vault.named_test_resource: Still creating... [1m20s elapsed]
azurerm_key_vault.named_test_resource: Still creating... [1m30s elapsed]
azurerm_key_vault.named_test_resource: Still creating... [1m40s elapsed]
azurerm_key_vault.named_test_resource: Still creating... [1m50s elapsed]
azurerm_key_vault.named_test_resource: Still creating... [2m0s elapsed]
azurerm_key_vault.named_test_resource: Still creating... [2m10s elapsed]
azurerm_key_vault.named_test_resource: Still creating... [2m20s elapsed]
azurerm_key_vault.named_test_resource: Still creating... [2m30s elapsed]
azurerm_key_vault.named_test_resource: Creation complete after 2m33s [id=/subscriptions/3510ae4d-530b-497d-8f30-53b9616fc6c1/resourceGroups/turbottest12044/providers/Microsoft.KeyVault/vaults/turbottest12044]
azurerm_key_vault_secret.named_test_resource: Creating...
azurerm_key_vault_secret.named_test_resource: Creation complete after 5s [id=https://turbottest12044.vault.azure.net/secrets/turbottest12044/4aa5a2cbec2e4cc3a3122e70b34d1bec]

Warning: Deprecated Resource

The null_data_source was historically used to construct intermediate values to
re-use elsewhere in configuration, the same can now be achieved using locals


Apply complete! Resources: 3 added, 0 changed, 0 destroyed.

Outputs:

location = westus
resource_aka = azure://https://turbottest12044.vault.azure.net/secrets/turbottest12044/4aa5a2cbec2e4cc3a3122e70b34d1bec
resource_aka_lower = azure://https://turbottest12044.vault.azure.net/secrets/turbottest12044/4aa5a2cbec2e4cc3a3122e70b34d1bec
resource_id = https://turbottest12044.vault.azure.net/secrets/turbottest12044/4aa5a2cbec2e4cc3a3122e70b34d1bec
resource_name = turbottest12044
secret_uri_without_version = https://turbottest12044.vault.azure.net/secrets/turbottest12044
secret_version = 4aa5a2cbec2e4cc3a3122e70b34d1bec
subscription_id = 3510ae4d-530b-497d-8f30-53b9616fc6c1

Running SQL query: test-get-query.sql
[
  {
    "content_type": "text",
    "enabled": true,
    "id": "https://turbottest12044.vault.azure.net/secrets/turbottest12044/4aa5a2cbec2e4cc3a3122e70b34d1bec",
    "name": "turbottest12044",
    "recoverable_days": 7,
    "recovery_level": "CustomizedRecoverable+Purgeable",
    "region": "westus",
    "resource_group": "turbottest12044",
    "subscription_id": "3510ae4d-530b-497d-8f30-53b9616fc6c1",
    "value": "steampipe",
    "vault_name": "turbottest12044"
  }
]
✔ PASSED

Running SQL query: test-list-query.sql
[
  {
    "id": "https://turbottest12044.vault.azure.net/secrets/turbottest12044/4aa5a2cbec2e4cc3a3122e70b34d1bec",
    "name": "turbottest12044"
  }
]
✔ PASSED

Running SQL query: test-not-found-query.sql
null
✔ PASSED

Running SQL query: test-turbot-query.sql
[
  {
    "akas": [
      "azure:///subscriptions/3510ae4d-530b-497d-8f30-53b9616fc6c1/resourceGroups/turbottest12044/providers/Microsoft.KeyVault/vaults/turbottest12044/secrets/turbottest12044",
      "azure:///subscriptions/3510ae4d-530b-497d-8f30-53b9616fc6c1/resourcegroups/turbottest12044/providers/microsoft.keyvault/vaults/turbottest12044/secrets/turbottest12044"
    ],
    "name": "turbottest12044",
    "tags": {
      "name": "turbottest12044"
    },
    "title": "turbottest12044"
  }
]
✔ PASSED

POSTTEST: tests/azure_key_vault_secret

TEARDOWN: tests/azure_key_vault_secret

SUMMARY:

1/1 passed.

Example query results

Results

Add example SQL query results here (please include the input queries as well)

…tSecret but none is available on azure_key_vault_secret table. Closes #104

Subhajit97 · 2021-04-29T08:55:31Z

azure/table_azure_key_vault_secret.go

+		if !*data.Attributes.Enabled {
+			return nil, nil
+		}


What will happen if someone has passed quals to make GET call, i.e. select * from azure_key_vault_secret where name = 'secret123' and vault_name = 'vault123'?

Subhajit97

@anisadas I have left a comment. Can you please verify the GET function and try to query the table with the quals required for GET call?

anisadas · 2021-04-29T09:12:07Z

@Subhajit97 I already mentioned in this issue that GET operation is not allowed on disable secret if someone tries to query select * from azure_key_vault_secret where name = 'secrettest123' and vault_name = 'vaulttest1234'; on disable secret it throws this error

Error: keyvault.BaseClient#GetSecret: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Forbidden" Message="Operation get is not allowed on a disabled secret." InnerError={"code":"SecretDisabled"}

This query works only on enable secret.

Subhajit97 · 2021-04-29T09:16:14Z

@Subhajit97 I already mentioned in this issue that GET operation is not allowed on disable secret if someone tries to query select * from azure_key_vault_secret where name = 'secrettest123' and vault_name = 'vaulttest1234'; on disable secret it throws this error
Error: keyvault.BaseClient#GetSecret: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Forbidden" Message="Operation get is not allowed on a disabled secret." InnerError={"code":"SecretDisabled"}
This query works only on enable secret.

Yes, but if someone runs a query without knowing the resource state, it should not return any error.

Error: keyvault.BaseClient#GetSecret: Failure responding to request: StatusCode=403 -- Original Error: autorest/azure: Service returned an error. Status=403 Code="Forbidden" Message="Operation get is not allowed on a disabled secret." InnerError={"code":"SecretDisabled"}

Instead of returning error, we should safely handle this error.

Subhajit97

LGTM

cbruno10 · 2021-04-29T21:03:08Z

azure/table_azure_key_vault_secret.go

@@ -21,7 +21,7 @@ func tableAzureKeyVaultSecret(_ context.Context) *plugin.Table {
 		Get: &plugin.GetConfig{
 			KeyColumns:        plugin.AllColumns([]string{"vault_name", "name"}),
 			Hydrate:           getKeyVaultSecret,
-			ShouldIgnoreError: isNotFoundError([]string{"ResourceNotFound", "404"}),
+			ShouldIgnoreError: isNotFoundError([]string{"ResourceNotFound", "404", "403"}),


What else can give us 403 errors from the getKeyVaultSecret function? If we have incorrect permissions, do we also get a 403 error?

yes when wrong access policy set on vault in that time also get 403 error

@anisadas Can you please try looking for the Operation get is not allowed on a disabled secret. error message instead of the 403 error code, as we don't want to ignore all permission errors for the get operation.

…issue104

Getting an error as column 'id' requires hydrate data from getKeyVaul…

3c7b540

…tSecret but none is available on azure_key_vault_secret table. Closes #104

anisadas self-assigned this Apr 28, 2021

anisadas linked an issue Apr 28, 2021 that may be closed by this pull request

Getting an error as column 'id' requires hydrate data from getKeyVaultSecret but none is available on azure_key_vault_secret table #104

Closed

anisadas mentioned this pull request Apr 28, 2021

Getting an error as column 'id' requires hydrate data from getKeyVaultSecret but none is available on azure_key_vault_secret table. Closes #104 #110

Closed

Remove extra space

a82008c

anisadas marked this pull request as ready for review April 28, 2021 14:35

anisadas requested review from Subhajit97 and LalitLab and removed request for Subhajit97 April 28, 2021 14:35

Add extra line

b41e8e3

Subhajit97 reviewed Apr 29, 2021

View reviewed changes

Subhajit97 requested changes Apr 29, 2021

View reviewed changes

anisadas added 2 commits April 29, 2021 17:49

Review changes are done

f710597

Made changes

d595d17

Subhajit97 approved these changes Apr 29, 2021

View reviewed changes

cbruno10 reviewed Apr 29, 2021

View reviewed changes

anisadas and others added 2 commits May 3, 2021 17:22

Changes are done as per review comments

01e8568

Merge branch 'main' of github.com:turbot/steampipe-plugin-azure into …

43e7ac8

…issue104

cbruno10 approved these changes May 4, 2021

View reviewed changes

cbruno10 merged commit e809b3c into main May 4, 2021

cbruno10 deleted the issue104 branch May 4, 2021 18:49

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Getting an error as column 'id' requires hydrate data from getKeyVaultSecret but none is available on azure_key_vault_secret table. Closes #104 #111

Getting an error as column 'id' requires hydrate data from getKeyVaultSecret but none is available on azure_key_vault_secret table. Closes #104 #111

anisadas commented Apr 28, 2021 •

edited

Loading

Subhajit97 Apr 29, 2021 •

edited

Loading

Subhajit97 left a comment

anisadas commented Apr 29, 2021

Subhajit97 commented Apr 29, 2021

Subhajit97 left a comment

cbruno10 Apr 29, 2021

anisadas Apr 30, 2021

cbruno10 Apr 30, 2021

Getting an error as column 'id' requires hydrate data from getKeyVaultSecret but none is available on azure_key_vault_secret table. Closes #104 #111

Getting an error as column 'id' requires hydrate data from getKeyVaultSecret but none is available on azure_key_vault_secret table. Closes #104 #111

Conversation

anisadas commented Apr 28, 2021 • edited Loading

Integration test logs

Example query results

Subhajit97 Apr 29, 2021 • edited Loading

Choose a reason for hiding this comment

Subhajit97 left a comment

Choose a reason for hiding this comment

anisadas commented Apr 29, 2021

Subhajit97 commented Apr 29, 2021

Subhajit97 left a comment

Choose a reason for hiding this comment

cbruno10 Apr 29, 2021

Choose a reason for hiding this comment

anisadas Apr 30, 2021

Choose a reason for hiding this comment

cbruno10 Apr 30, 2021

Choose a reason for hiding this comment

anisadas commented Apr 28, 2021 •

edited

Loading

Subhajit97 Apr 29, 2021 •

edited

Loading