AzOps - Pull fails with MissingApiVersionParameter

[CerveloRS]

Description

When running AzOps - Pull to get all policies, resources, resourcegroups, and roles on two managementgroups (and whatever is below), the pipeline fails on step Initialize with following error (some information replaced with replaced):

[06:32:35][Get-AzOpsRoleAssignment] Retrieving Role Assignments at scope /subscriptions/replaced/resourceGroups/replaced WARNING: [06:33:55][Invoke-AzOpsScriptBlock] Tried unsuccessfully 6 out of 6 times, giving up. | MissingApiVersionParameter : The api-version query parameter (?api-version=) is required for all requests. CorrelationId: 95e29d50-26aa-445e-b4e0-15a538da9302 Exception: The running command stopped because the preference variable

Steps to reproduce

1. Run AzOps Pull with attached settings.

AzOps Module version 1.8.1

settings.json.zip

[daltondhcp]

Looks like a transient issue in ARM, did it ever work before or did it start after a specific configuration change?

[daltondhcp]

After taking a closer look in the backend, it looks like it is failing on some Microsoft.Web/certificates resources that you have in some of your resource groups. Can you please try and add Microsoft.Web/certificates to the "Core.SkipResourceType" array in settings.json and try again? Microsoft.Web is a bit of uncharted territory for us in terms of pull, so hopefully excluding certificates will be enough :)

[CerveloRS]

It is not transient. The error always occurs on the same resourcegroup at:

Retrieving Role Assignments at scope /subscriptions/replaced/resourceGroups/replaced

[daltondhcp]

The roleAssignments message is unfortunately misleading, it is failing on what I mentioned above according to the correlationid. Looks very similar to #464

[CerveloRS]

It does look similar.
Added the exclusion. Now failing with correlationId 53f82858-a440-4300-8e15-94af477d66f0.
Please advise in troubleshooting the correlationids.

[daltondhcp]

The correlationIds are only for backend ARMlogs investigation, so unfortunately not something you can do on your own. We will investigate and look at a more graceful way to handle such resource provider failures.
In the meantime, you can disable resource discovery to restore pull operations without resources in RGs (roles and policies will still be included)

[CerveloRS]

Sadly the purpose of this repo and pipeline is to fetch the resources (as a backup of resources not deployed as code), but I will try some more exclusions and see if I get there.

[BenjaminEngeset]

@CerveloRS

I have the same similar issue, but for now excludeded it to be pulled. The consequence is that you don't have your state, so I have ended up blocking manual operations in the portal for these resource types.

It is not the best way if you have shared responsibility around these resource declarations, but for now it seems like the best fit.

[daltondhcp]

It does look similar. Added the exclusion. Now failing with correlationId 53f82858-a440-4300-8e15-94af477d66f0. Please advise in troubleshooting the correlationids.

The above correlationId is interestingly enough related to the same resource type (Microsoft.Web/certificates). Can you double check spelling etc?

Nevertheless, we will look at changing the way we handle these types of failures and instead throw a warning for child/auxiliary resources that cannot be exported.

[CerveloRS]

Spelling was fine.

Warning rather then fail would be a welcome change.
Maybe even as a setting so one can choose to fail or warn?