Get-AzKeyVaultSecret -VaultName mykvname -Name mysecretname -IncludeVersions fails if 'current' version is disabled. #14740
Labels
bug
This issue requires a change to an existing behavior in the product in order to be resolved.
customer-reported
KeyVault
Milestone
Description
If you have a Key Vault secret with multiple versions and the "Current" version is disabled, the cmdlet Get-AzKeyVaultSecret is unable to list the versions of the secret. It throws an error message
Get-AzKeyVaultSecret: Operation returned an invalid status code 'Forbidden'
I assume this is because the cmdlet is trying to "Get" the value of the current version and is unable to and stops running in stead of carrying on to list the versions when the -IncludeVersions parameter is set.
I think this is a bug because I should still be able to list the versions of the secret regardless of weather or not I can get the value of the current version.
I propose that if the -IncludeVersions parameter is set, the cmdlet should ignore the "Forbidden" error on the "Get Secret" request, and only throw an error if there is an issue running the second request.
Either that, or we just don't "Get Secret" in the first place and only list the versions.
If none of those options are available due to backwards compatibility, perhaps the "-Force" parameter could be used to ignore the forbidden error on the Get Secret request.
Steps to reproduce
The following script will reproduce the error 'Operation returned an invalid status code 'Forbidden''
Environment data
Module versions
Debug output
Error output
The text was updated successfully, but these errors were encountered: