When using CLI auth, the provider should warn about mismatched Azure environments #3274
Assignees
Labels
area/auth
impact/usability
Something that impacts users' ability to use the product easily and intuitively
kind/enhancement
Improvements or new features
resolution/fixed
This issue was fixed
Comments
thomas11
added
kind/enhancement
thomas11
added a commit
that referenced
this issue
May 14, 2024
Quoting the code comment: CLI authentication can only use the environment that the CLI is configured for. Fail early if that's not the one from config, to avoid obscure errors about missing subscriptions or endpoints later. Resolves #3274 Sample shell session: ``` ❯ pulumi config -s gov | rg environ azure-native:environment usgovernment ❯ az account show | rg environ "environmentName": "AzureCloud", ❯ PATH=$HOME/pulumi/pan/bin:$PATH pulumi up -s gov Previewing update (gov) Type Name Plan Info + pulumi:pulumi:Stack azn-3268-env-gov create 3 warnings └─ azure-native:resources:ResourceGroup resourceGroup 1 error Diagnostics: azure-native:resources:ResourceGroup (resourceGroup): error: The configured Azure environment 'usgovernment' does not match the determined environment 'public'. When authenticating using the Azure CLI, the configured environment needs to match the one shown by 'az account show'. You can change environments using 'az cloud set --name <environment>'. ```
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Prompted by #3268.
Azure has different clouds or "environments" like public and usgovernment. The environment of a Pulumi program cab be configured via
azure-native:environment. However, when using the Azure CLI to authenticate, the provider will always use the environment we're logged in to, viaaz login.This is somewhat unavoidable, since otherwise, Pulumi would need to change the CLI configuration. Both the subscription and the auth token are, to my knowledge, separate per cloud. Our authentication library uses
az account showto determine the currently active subscription (fromaz login), and then takes the cloud from the subscription as well.Therefore,
azure-native:environmenthas no effect when using the CLI to authenticate. For all other auth methods, this problem should not exist since there's no local state lookup likeaz account show, everything is explicitly configured.We should warn or error when the configured environment is different from the one
azis logged into.The text was updated successfully, but these errors were encountered: