Azure-docs: [Error] - Keyvault policy recoverable is not set

[murdockcrc]

Executing this command:

az storage account update 
    --name <storage-account> \
    --resource-group <resource_group> \
    --encryption-key-name <key> \
    --encryption-key-version $key_version \
    --encryption-key-source Microsoft.Keyvault \
    --encryption-key-vault $key_vault_uri

fails with the following error:
Keyvault policy recoverable is not set

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: b2deae96-4c5e-8396-519c-9ab7e09baacd
• Version Independent ID: a90b199e-623a-86ba-26e2-4ee71fae6e25
• Content: Configure customer-managed keys for Azure Storage encryption from Azure CLI
• Content Source: articles/storage/common/storage-encryption-keys-cli.md
• Service: storage
• Sub-service: common
• GitHub Login: @tamram
• Microsoft Alias: tamram

[SwathiDhanwada-MSFT]

@murdockcrc Thanks for the question. We are looking into it and will update you soon.

[SumanthMarigowda-MSFT]

@murdockcrc To run them as written, the best option is to use Bash in CloudShell and let me know the status

[murdockcrc]

I believe I ran this under shell.azure.com, in Bash (not PowerShell). Is that what you are referring to?

[SumanthMarigowda-MSFT]

@murdockcrc I was able to reproduce the issue and Configure encryption with customer-managed keys

az storage account update --name su*diag --resource-group Storage-Resources --assign-identity

az keyvault set-policy --name n*123 --resource-group storage-resources --object-id $storage_account_principal --key-permissions get recover unwrapkey wrapkey

az keyvault key create --name submtestkey --vault-name

key_vault_uri=$(az keyvault show --name ne*123 --resource-group storage-resources --query properties.vaultUri --output tsv)

key_version=$(az keyvault key list-versions --name suby --vault-name new3 --query [].kid --output tsv | cut -d '/' -f 6)

az storage account update --name su*diag --resource-group storage-resources --encryption-key-name subkey --encryption-key-version $key_version --encryption-key-source Microsoft.Keyvault --encryption-key-vault $key_vault_uri

Try to generate the Key and check if the issue still persists I'd recommend posting your question in https://social.msdn.microsoft.com/forums/azure/en-US/home?forum=windowsazuredata since it's not directly related to the documentation. We'll follow up there. We will now proceed to close this thread. If there are further questions regarding this matter, please tag me in your reply. We will gladly continue the discussion and we will reopen the issue.