Search code examples
azurepowershellazure-storageazure-oms

getting "Bad Request" error in powershell while transferring the nsg flow log to the storage account in different subscription in azure

I am getting "Bad Request" error while transferring the nsg flow log to the storage account in different subscription. My script is working fine while using the storage account of same subscription.

$workspaceResourceId = "/subscriptions/xxxxxxxxxxxxxxxxxxxxxxxx/resourcegroups/rg-log-mgmt-prd-westeurope-01/providers/microsoft.operationalinsights/workspaces/nbsapucscoms"
$workspaceGUID = "xxxxxxxxxxxxxxxxxx"
$workspaceLocation = "westeurope"

$n = Get-AzureRmNetworkSecurityGroup -ResourceGroupName rg-8kmiles-dfi-westeurope-01 -Name apitst-nsg
$NwName = 'NetworkWatcher_' + $n.Location 
$NW = Get-AzureRmNetworkWatcher -ResourceGroupName NetworkWatcherRg -Name $NwName

#enter the storage account details. 
$storageAccount="/subscriptions/xxxxxxxxxxxxxxx/resourceGroups/rg-log-mgmt-prd-westeurope-01/providers/Microsoft.Storage/storageAccounts/nvsswelogmgmt001"

$flowLogStatus=Get-AzureRmNetworkWatcherFlowLogStatus -NetworkWatcher $NW -TargetResourceId $n.Id
if($false -eq $flowLogStatus.Enabled){

    #Configure Version 2 FLow Logs with Traffic Analytics Configured
    Set-AzureRmNetworkWatcherConfigFlowLog -NetworkWatcher $NW -TargetResourceId $n.Id `
        -StorageAccountId $storageAccount -EnableFlowLog $true -EnableTrafficAnalytics `
        -WorkspaceResourceId $workspaceResourceId -WorkspaceGUID $workspaceGUID `
        -WorkspaceLocation $workspaceLocation -EnableRetention $true -RetentionInDays 365 


    #Query Flow Log Status
    $flowLogStatus=Get-AzureRmNetworkWatcherFlowLogStatus -NetworkWatcher $NW -TargetResourceId $n.Id
    write-verbose "$($n.Name) Nsg Flow Log Enabled : $($flowLogStatus.Enabled)" -verbose
}

The error which i am getting is this

    Set-AzureRmNetworkWatcherConfigFlowLog : Operation returned an invalid status 
code 'BadRequest'
At C:\Users\singhniu\Desktop\Pipeline\TestNsgFlowLog.ps1:22 char:5
+     Set-AzureRmNetworkWatcherConfigFlowLog -NetworkWatcher $NW -Targe ...
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : CloseError: (:) [Set-AzureRmNetworkWatcherConfig 
   FlowLog], ErrorResponseException
    + FullyQualifiedErrorId : Microsoft.Azure.Commands.Network.SetAzureNetwork 
   WatcherConfigFlowLogCommand
Solution

  • after debugging i came to know that i was using V1 storage account which does not support retention. for retention policy to be applied we need to upgrade it to V2. bellow is the output after debugging.

        Body:
{
  "error": {
    "code": "UnsupportedStorageAccountVersionWithRetention",
    "message": "Storage /subscriptions/xxxxxxxxxxxxxxxxxxxxxxx/resourceGroups/rg-lo
g-mgmt-prd-westeurope-01/providers/Microsoft.Storage/storageAccounts/nvss is a V1 st
orage account and with retention policy. Only V2 storage account are supported with retention po
licy. Read more -> aka.ms/LogsHelp",
    "details": []
  }
}