Az storage blob copy start failed

[Sridhart97]

This is autogenerated. Please review and update as needed.

Describe the bug

Command Name
az storage blob copy start

Errors:

The command failed with an unexpected error. Here is the traceback:


'CommandResultItem' object is not iterable
Traceback (most recent call last):
  File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-install-qdpilz60\knack\knack\cli.py", line 212, in invoke
  File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-install-qdpilz60\knack\knack\output.py", line 132, in out
  File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-install-qdpilz60\knack\knack\output.py", line 38, in format_json
TypeError: 'CommandResultItem' object is not iterable

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

• Put any pre-requisite steps here...
• az storage blob copy start --verbose --account-key {} --account-name {} --destination-blob {} --destination-container {} --source-uri {}

Expected Behavior

Environment Summary

Windows-10-10.0.18362-SP0
Python 3.6.6
Shell: cmd.exe

azure-cli 2.0.69

Additional Context

+++++++++++++++++++++++++++++ENVIORNMENT+++++++++++++++
C:\Sridhar>az --version
azure-cli 2.0.69

command-modules-nspkg 2.0.3
core 2.0.69
nspkg 3.0.4
telemetry 1.0.3

[Sridhart97]

C:\Program Files (x86)\Microsoft SDKs\Azure\AzCopy>az storage blob copy start --account-key d+LndZKnWuMkPpPBSakB99GcKVlzV/Nlg2JETapPtsCNP1AjVBZ+DHFMANNUqc8MEUwX12k5nV99JnS0SmgIAA== --account-name sasneuprdarch01 --destination-blob vm-archive --destination-container WEB-AZu-002 --source-uri https://md-z1jtvlgqwlxw.blob.core.windows.net/421tblncdgxg/abcd?sv=2017-04-17

You do not have the required permissions needed to perform this operation.
Depending on your operation, you may need to be assigned one of the following roles:
"Storage Blob Data Contributor (Preview)"
"Storage Blob Data Reader (Preview)"
"Storage Queue Data Contributor (Preview)"
"Storage Queue Data Reader (Preview)"

If you want to use the old authentication method and allow querying for the right account key, please use the "--auth-mode" parameter and "key" value.

The command failed with an unexpected error. Here is the traceback:

'CommandResultItem' object is not iterable
Traceback (most recent call last):
File "C:\Users\VSSADM1\AppData\Local\Temp\pip-install-qdpilz60\knack\knack\cli.py", line 212, in invoke
File "C:\Users\VSSADM1\AppData\Local\Temp\pip-install-qdpilz60\knack\knack\output.py", line 132, in out
File "C:\Users\VSSADM~1\AppData\Local\Temp\pip-install-qdpilz60\knack\knack\output.py", line 38, in format_json
TypeError: 'CommandResultItem' object is not iterable

To open an issue, please run: 'az feedback'

I am one of the administrator in my Azure subscription, still I am unable to execute****

[Kroev]

@Sridhart97 or anyone else with sufficient rights:
Please edit or delte the comment above since the account key seems to be in plain text

[Juliehzl]

Please confirm you have the read permission for source resource https://md-z1jtvlgqwlxw.blob.core.windows.net/421tblncdgxg/abcd?sv=2017-04-17. In addition, the string behind ? should be a valid sas token for resource https://md-z1jtvlgqwlxw.blob.core.windows.net/421tblncdgxg/abcd.

[Juliehzl]

Also note that please check firewall setting.

[Juliehzl]

@Sridhart97 What about your problem now?

[yonzhan]

@Sridhart97 was your issue resolved ?

[marrobi]

I'm getting the same issues with az storage blob upload . Using a script I have used many times before, last time successfully a couple of months ago, but today it won't work. Tried on multiple machines, different Azure subscriptions all the same. Tried with connection string, SAS token and key, and they all fail with the blob upload command. If use the same token/connection string in storage explorer it connects and can upload data. So feel something must have changed in the CLI.

You do not have the required permissions needed to perform this operation.
Depending on your operation, you may need to be assigned one of the following roles:
    "Storage Blob Data Contributor"
    "Storage Blob Data Reader"
    "Storage Queue Data Contributor"
    "Storage Queue Data Reader"

If you want to use the old authentication method and allow querying for the right account key, please use the "--auth-mode" parameter and "key" value.
                
The command failed with an unexpected error. Here is the traceback:

'CommandResultItem' object is not iterable
Traceback (most recent call last):
  File "/opt/az/lib/python3.6/site-packages/knack/cli.py", line 212, in invoke
    self.output.out(cmd_result, formatter=formatter, out_file=out_file)
  File "/opt/az/lib/python3.6/site-packages/knack/output.py", line 132, in out
    output = formatter(obj)
  File "/opt/az/lib/python3.6/site-packages/knack/output.py", line 38, in format_json
    input_dict = dict(result) if hasattr(result, '__dict__') else result
TypeError: 'CommandResultItem' object is not iterable

[yonzhan]

@Juliehzl please help with this issue.

[Juliehzl]

Please try with azure cli 2.0.77. It can throw correct error message for your operation and check your command according to error message. Hope it can help you and I will close it now. If you still have problems, feel free to create a new one.

[marrobi]

So I hit this and switched to az storage blob upload-batch, which has worked fine for the last month, then today I am getting Authentication failure. This may be caused by either invalid account key, connection string or sas token value provided for your storage account. I updated the cli to 2.0.77, but no change.

This is actually happening when trying to create a container.

The bit of the script in question looks like:

az group create --name $storageRg --location $location

az storage account create \
    --resource-group $storageRg \
    --location $location \
    --sku Standard_LRS \
    --kind StorageV2 \
    --name $storageAccountName

connection=$(az storage account show-connection-string \
    --resource-group $storageRg \
    --name $storageAccountName \
    --query connectionString)
    
az storage container create \
    --name $templateContainer \
    --connection-string $connection

There is something odd happening here.

Thanks.

[marrobi]

Using --debug, get:

azure.multiapi.storage.v2018_11_09.common.storageclient : Client-Request-ID=e4378b6c-1699-11ea-95c4-00155dc3f99e Retry policy did not allow for a retry: Server-Timestamp=Thu, 05 Dec 2019 09:46:53 GMT, Server-Request-ID=69b57144-201e-0013-1450-ab5a4d000000, HTTP status code=403, Exception=Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature. ErrorCode: AuthenticationFailed<?xml version="1.0" encoding="utf-8"?><Error><Code>AuthenticationFailed</Code><Message>Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.RequestId:69b57144-201e-0013-1450-ab5a4d000000Time:2019-12-05T09:46:54.0601128Z</Message><AuthenticationErrorDetail>Request date header too old: 'Wed, 04 Dec 2019 13:28:00 GMT'</AuthenticationErrorDetail></Error>.
cli.azure.cli.core.util : 
Authentication failure. This may be caused by either invalid account key, connection string or sas token value provided for your storage account.
                    

Authentication failure. This may be caused by either invalid account key, connection string or sas token value provided for your storage account.

So:

<AuthenticationErrorDetail>Request date header too old: 'Wed, 04 Dec 2019 13:28:00 GMT'</AuthenticationErrorDetail>

Given I am running this all at once, not sure how this can be an issue.

[marrobi]

Interesting, using WSL, the time is incorrect:

[marrobi]

Believed root cause: microsoft/WSL#4245