Get-AzureRmKeyVault does not return all items (ignores "nextLink" parameter) when >1000 items

[jsandersrocks]

Description

Get-AzureRmKeyVault does not return all items (ignores "nextLink" parameter) when >1000 items
Get-AzureRMKeyVault -VaultName 'MYVAULT' also does not work because internally the cmdlet calls Get-AzureRmKeyVault first and does not fine the name.

Script/Steps for Reproduction

Create > 1000 KeyVault entries in your subscription.

Call Get-AzureRmKeyVault

Module Version

Environment Data

Debug Output

DEBUG: ============================ HTTP REQUEST ============================

HTTP Method:
GET

Absolute Uri:
https://management.azure.com/subscriptions/xxxxxxxxx/resources?$filter=resourceType eq 'Microsoft.KeyVault%2Fvaults'&api-version=2016-09-01

DEBUG: ============================ HTTP RESPONSE ============================

Status Code:
OK

Headers:
Pragma                        : no-cache
x-ms-ratelimit-remaining-subscription-reads: 14930
x-ms-request-id               : 2b89964f-2835-4677-91a4-3785a1327a73
x-ms-correlation-request-id   : 2b89964f-2835-4677-91a4-3785a1327a73
x-ms-routing-request-id       : CANADACENTRAL:20180313T211117Z:2b89964f-2835-4677-91a4-3785a1327a73
Strict-Transport-Security     : max-age=31536000; includeSubDomains
X-Content-Type-Options        : nosniff
Cache-Control                 : no-cache
Date                          : Tue, 13 Mar 2018 21:11:16 GMT

Body:
{
  "value": [
    {
      "id": "/subscriptions/xxxx/resourceGroups/xxx/providers/Microsoft.KeyVault/vaults/xxx",
      "name": "xxx",
      "type": "Microsoft.KeyVault/vaults",
      "location": "xxxxx",
      "tags": {}
    },
....

 ],
  "nextLink": "https://management.azure.com/subscriptions/xxxx/resources?%24filter=resourceType+eq+%27Microsoft.KeyVault%2fvaults%27&api-version=2016-09-01&%24skiptoken=xxxxx

DEBUG: AzureQoSEvent: CommandName - Get-AzureRmKeyVault; IsSuccess - True; Duration - 00:01:39.0193248; Exception - ;
DEBUG: Finish sending metric.
DEBUG: 5:16:09 PM - GetAzureKeyVault end processing.
DEBUG: 5:16:09 PM - GetAzureKeyVault end processing.

[cormacpayne]

@maddieclayton would you mind taking a look at this?

[jsandersrocks]

Workaround:

# Get-AzureRMKeyVault only successfully processes 1000 KeyVaults due to a bug in the cmdlet
# https://github.com/Azure/azure-powershell/issues/5740 
# this is a workaround...

$subsName = "Jsanders Cases Microsoft Azure Internal Consumption"

if ([string]::IsNullOrEmpty($(Get-AzureRmContext).Account)) {Login-AzureRmAccount}

#select a subscription
Select-AzureRmSubscription -SubscriptionName $subsName

#get resource groups in this subscription and 
$rg = Get-AzureRMResourceGroup

#for each resourge group 
foreach($rgItem in $rg)
{
   # get the RG name and see if there are any KeyVault items in the group
   $kv = Get-AzureRMKeyVault -ResourceGroupName $rgItem.ResourceGroupName

   # if yes
   if($kv)
   {
        #do something with it
        $kv.VaultName
   }
}

[dragav]

There were a couple of bugs here, both manifesting themselves in subscriptions with >1k resources:

• finding a vault without providing a RG name returns null
• listing all vaults is truncated to 1,000 records

The KV cmdlets implement pagination correctly. Both issues were caused by a limitation/bug in the ARM client - it returns at most 1k items with a null nextLink; this is being looked at by the ARM team.

In the meantime, the KV cmdlet has been rewired to use the KV management client List operations (#5864). Note this fix carries a performance hit, as the KV service unpacks/decrypts each vault object. The fix should be undone one the ARM client is fixed.

[dragav]

Transferring to Jianping.