az network watcher flow-log configure/show does not work as expected by passing in NSG ID

[zwswim]

Describe the bug
A clear and concise description of what the bug is.
By passing nsg ID, the following command returns error: The Resource 'Microsoft.Network/networkSecurityGroups/classicnsgWestCEUAP_wezheng' under resource group 'juzEastUS2EUAPAG' was not found

In the error returned, the resource provider is Microsoft.Network, which is different from the one, "Microsoft.ClassicNetwork", passed in. The guess that the provider is hardcode instead of parsed from the NSG ID the client passed in.

Btw, another potential bug is: it looks like that I have to pass in the optional parameter --subscription, since I already set the required param NSG with the nsg resource id. If I do not have the --subscription there, it give me "resource group not found" error

To Reproduce
Steps to reproduce the behavior.

1> Create a classic nsg under Azure networkwatcher team test subscription 96e68903-0a56-4819-9987-8d08ad6a1f99

2> run CTL command:
az network watcher flow-log configure --nsg /subscriptions/96e68903-0a56-4819-9987-8d08ad6a1f99/resourceGroups/juzEastUS2EUAPAG/providers/Microsoft.ClassicNetwork/networkSecurityGroups/classicnsgWestCEUAP_wezheng --subscription 96e68903-0a56-4819-9987-8d08ad6a1f99 --enabled true --storage-account /subscriptions/96e68903-0a56-4819-9987-8d08ad6a1f99/resourceGroups/FlowAnalysisTest/providers/Microsoft.Storage/storageAccounts/flowanalysistestdiag145

Expected behavior
Since I set required parameter NSG ID, all the information such as Subscription and provider should be get from the NSG id.

Environment summary
Install Method (e.g. pip, interactive script, apt-get, Docker, MSI, edge build) / CLI version (az --version) / OS version / Shell Type (e.g. bash, cmd.exe, Bash on Windows)

CLI version: 2.0

Additional context
Similar problem for network watcher flow-log show

[tjprescott]

As far as needing to pass --subscription, that is definitely a bug. CLI 2.0 doesn't support classic resources, but I'll see if there's a quick fix to make that work.

[tjprescott]

PR merged. Will be in Ignite release.

[rem-aj]

Hello @tjprescott I notice this issue is closed since last summer, however I am still experiencing this issue currently, passing in subscription ID as a workaround doesnt fix it either.

$ az network watcher flow-log configure --resource-group XXX--enabled true --nsg XXX--storage-account XXX
ResourceNotFound - The Resource 'Microsoft.Storage/storageAccounts/XXX' under resource group 'XXX' was not found.

It is true that the storage account does not exist under the resource group, as I'm using the resource group where the NSG is actually in, even if I switch the resource group to the one where the storage account is, it still fails with the exact same error.

I'm using 2.0.71 * for az-cli version currently which is a recent version.

[tjprescott]

@myronfanqiu fyi

[haroldrandom]

It the bug still?

[haroldrandom]

As for the different provoder for network, I found it's been fixed.

As for the wanted behavior "all the information such as Subscription and provider should be get from the NSG id", it's been fixed too.

[haroldrandom]

@rem-aj There is an implicit restriction in flow-log.

Firstly, only one watcher can be existed per subscription and region. One watcher can have many flow logs, they are in the same resource group (a default created one named "NetworkWatcherRG") and same location.

Secondly, all the related sub-resources NSG, storage account, workspace can be in differenct resource group but are required in the same location of flow log per subscription.

So it doesn't matter which resource group they are in, but region is.

In the logic we implemented, we didn't count subscription in, it has no effect.
The resoruce group is used to assemble the ID when user provide name for NSG, storage account and workspace. While configure and user provides NSG ID, we will take the location of NSD as identify to find Network Watche.

The solution is to make your storage account be in the same region of NSG.

BTW, a new command is developing az network watcher flow-log will do the same job which will give more intuition on usgae.
#12350.