Azure-cli: az sql db export not working

[sirdank]

Describe the bug
az sql db export does not work. It fails with the error

Deployment failed. Correlation ID: 11c66e3d-ac64-4a67-88c4-61934905898b. Operation failed with status: 'Bad Request'. Details: The ImportExport operation with Request Id 'acbe5755-7eb4-4022-b021-5fab9c61a2c8' failed due to 'Error encountered during the service operation.
Blob https://account.blob.core.windows.net/container is not writeable.
The remote server returned an error: (404) Not Found.
The remote server returned an error: (404) Not Found.
'.
'sp' is not recognized as an internal or external command,
operable program or batch file.
'sv' is not recognized as an internal or external command,
operable program or batch file.
'sr' is not recognized as an internal or external command,
operable program or batch file.
'sig' is not recognized as an internal or external command,
operable program or batch file.

Those unrecognized "commands" correspond to the query parameters in my SAS token.

To Reproduce
These are the steps from the doc/ az sql db export --help

$sas = az storage blob generate-sas --account-name $StorageAccount -c $StorageContainer -n $bacpac --permissions w --expiry (Get-Date).AddDays(1).ToString("yyyy-MM-ddT00:00:00Z")

az sql db export -s $ServerName -n $baseName -g $ResourceGroupName -p "$($creds.GetNetworkCredential().Password)" -u $cred.UserName --storage-uri "$exportUri/$baseName.bacpac" --storage-key-type SharedAccessKey --storage-key "?$($sas.Trim('"'))"

I also ran an equivalent from cmd.exe but no dice.

Expected behavior
bacpac file showing up in blob storage.

Environment summary
Powershell 5.1 on Windows 10
azure-cli 2.0.63 - I upgraded to this version after getting this error on an older one, I believe it was 2.0.61.
Installed via MSI.

Additional context
I had a script like this working last week using New-AzSqlDatabaseExport but then, without any changes I am aware of (can't speak for group policy), it started failing to request the export with weird errors that made me suspect some kind of wires got crossed between the AzureRm and Az powershell modules so I tried moving to the cli.

[adewaleo]

This does not seem to be a CLI issue but a shell issue.

$sas is a parameter expansion. It is bash syntax not cmd.exe syntax; I doubt it is powershell syntax either. You will need to replace usages of $ with cmd.exe / powershell equivalents or simply use raw parameter values. Please try this and let us know if this fixes the issue for you.

On our end we do have an issue #8755 open to make examples shell sensitive. Ideally we should have examples that work on bash and cmd.exe / powershell. This should help us towards that.

cc: @tjprescott

[sirdank]

@adewaleo Hello, I believe $sas is correct powershell syntax and this is the command I ran inside cmd.exe:

az sql db export -s SERVER -n DBNAME -g RGNAME -p PASSWORD!!# -u USER --storage-uri https://ACCOUNT.blob.core.windows.net/CONTAINER --storage-key-type SharedAccessKey --storage-key ?se=2019-05-02T00%3A00%3A00Z&sp=w&sv=2018-03-28&sr=b&sig=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

And this was the error output I got from inside cmd.exe:

Deployment failed. Correlation ID: 11c66e3d-ac64-4a67-88c4-61934905898b. Operation failed with status: 'Bad Request'. Details: The ImportExport operation with Request Id 'acbe5755-7eb4-4022-b021-5fab9c61a2c8' failed due to 'Error encountered during the service operation.
        Blob https://cloud2strg.blob.core.windows.net/daviddbs is not writeable.
                The remote server returned an error: (404) Not Found.
                        The remote server returned an error: (404) Not Found.
'.
'sp' is not recognized as an internal or external command,
operable program or batch file.
'sv' is not recognized as an internal or external command,
operable program or batch file.
'sr' is not recognized as an internal or external command,
operable program or batch file.
'sig' is not recognized as an internal or external command,
operable program or batch file.

Forgive me, I was trying to indicate that I adapted it to the shell(s) correctly by saying "I also ran an equivalent from cmd.exe but no dice." but that wasn't very clear. Personally, I do not believe this is a doc question but a bug.

[tjprescott]

Can you run the command with --debug and provide the first line (starts with "Command Arguments:"). If it doesn't even display this, it is definitely a shell-specific issue that the CLI team cannot do anything about,

[adewaleo]

@sirdank, thanks for clarifying.... On closer inspection. The command is working but fails with a service error that says: "the blob is not writable" and that "there is a 404 error".

However the "command not recognized" error is probably because of how cmd is interpreting some of your inputs to the command, meaning the cli comamnd might not be receiving the arguments you expect.

I have two suggestions:

1. You might need to quote your parameter values with double-quotes to escape any shell behaviors. You want the shell to interpret your values as strings not as shell syntax.
2. As @tjprescott mentioned, running the command with --debug will be helpful. It would show how your shell interprets your arguments and what is passed to the cli command and it will also show any network requests and payloads.

Feel free to post (parts of) your debug output with sensitive information removed.

[tjprescott]

If the sas token is being omitted due to the shell, it might explain why you get 404 for the blobs.

[sirdank]

Thanks for that --debug flag; you both are right. The powershell issue was because of the & in the string. I'm surprised at this as I don't think a string with a $ in it will break the shell this way. However, using --storage-key "$sas" worked e.g. --storage-key ""se=2019-05-07T00%3A00%3A00Z&sp=rw&sv=2018-03-28&sr=b&sig=AAAAAAAAAAAAAAAAAAAAAAAAAAAAA%2BXiiI%3D"". It seems silly but it's working.

My cmd.exe example is now working also. I had to add the blob name to the end of the --storage-uri value (I had it correct in powershell and must have messed it up in translation) and I also had to have quotes around the token.