Azure-quickstart-templates: Unable to Create AzureFileShare Protected Item in Vault

[stephenmontgomery]

Issue Details

Unable to create a Backup item for a new Premium Files share. Get an "Microsoft Azure Backup encountered an internal error." when executing via ARM template. In a supporting region ie canadacentral, eastus and can do it via Portal. Use the same template the Portal created/used to create the Files backup item so at a loss on what the issue is - suspect that it's to do with the registering/caching that Portal mentions it's doing - perhaps https://docs.microsoft.com/en-us/azure/backup/backup-afs-cli#enable-backup-for-azure-file-shares?

Repro steps (if necessary, delete otherwise)

1. Premium Azure Files storage account + File Share created
2. Recovery Vault created
3. Vault Backup policy created
4. Attempt to create backup for Azure File share fails with "Microsoft Azure Backup encountered an internal error."
5. Deployed to canadacentral + eastus - supports Premium Files + Backup
6. Works successfully via the Portal - assume it has something to do with the Vault "registering" + refreshing itself according to the activity log

Find attached template to reproduce.
azurefiles-vault-backup.json.zip

Any help appreciated.

[jotasixto]

Hi everyone! Any news about it?

I'm trying to do this but I always get the same error:

Deployment failed. Correlation ID: xxxxxxxxxx-xxxx-xxxx-xxxxx-xxxxxxxxxxxxxxxxxx. {
  "status": "Failed",
  "error": {
    "code": "ResourceDeploymentFailure",
    "message": "The resource operation completed with terminal provisioning state 'Failed'.",
    "details": [
      {
        "code": "CloudInternalError",
        "message": "Microsoft Azure Backup encountered an internal error."
      }
    ]
  }
}

I suspect a problem with the item name, what format they should be this? I don't see any reference about FileShares in https://docs.microsoft.com/en-us/azure/templates/microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems

Thanks in advance for the help!

[migel0]

Here the same behavior.
It seems the property format of name in this case is mandatory and not documented.

I have got success hardcoding the long string "661bd40fac4e36949e3e814039158f0b6c27ee8a497452559176d00f0cf257cb6"

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "vaultName": { "value": "blablabla" },
        "vaultRG": { "value": "rg-blablabla" },
        "policyName": { "value": "DailyPolicy" },
        "fabricName": { "value": "Azure" },
        "protectionContainers": {
          "value": [
            "storagecontainer;storage;rg-blablabla;storage002"
          ]
        },
        "protectedItems": {
          "value": [
           "azurefileshare;661bd40fac4e36949e3e814039158f0b6c27ee8a497452559176d00f0cf257cb6"
          ]
        },
        "sourceResourceIds": {
          "value": [
            "/subscriptions/ blabla bla /resourceGroups/rg-blablabla/providers/Microsoft.Storage/storageAccounts/storage002"
          ]
        }
    }
}

{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
            "parameters": {
              "vaultName": { "type": "string" },
              "vaultRG": { "type": "string" },
              "vaultSubID": { "type": "string" },
              "policyName": { "type": "string" },
              "fabricName": { "type": "string" },
              "protectionContainers": { "type": "array" },
              "protectedItems": { "type": "array" },
              "sourceResourceIds": { "type": "array" }
            },
    "resources": [
              {
                "name": "[concat(parameters('vaultName'), '/', parameters('fabricName'), '/',parameters('protectionContainers')[copyIndex()], '/', parameters('protectedItems')[copyIndex()])]",
                "apiVersion": "2020-02-02",
                "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
                "properties": {
                  "backupManagementType": "AzureStorage",
                  "workloadType": "AzureFileShare",
                  "friendlyName": "afs",
                  "protectedItemType": "AzureFileShareProtectedItem",
                  "policyId": "[resourceId('Microsoft.RecoveryServices/vaults/backupPolicies', parameters('vaultName'), parameters('policyName'))]",
                  "sourceResourceId": "[parameters('sourceResourceIds')[copyIndex()]]"
                },
                "copy": {
                  "name": "protectedItemsCopy",
                  "count": "[length(parameters('protectedItems'))]"
                }
              }
    ]
}

It is not complete functional, but it works

[mepand]

@stephenmontgomery @jotasixto @migel0 Configuring protection for azure file share via ARM template is currently not supported. We are working on this and it would be available by end of Q3 CY 2020.
@migel0 It worked for you because you provided the Unique ID of the file share, which we implemented as part of recently released soft delete feature , but its currently not exposed publicly so we are working to make ARM templates work even if you pass friendly name for the file share.

[jotasixto]

@mepand Thank you very much for your help!

[baartch]

@stephenmontgomery @jotasixto @migel0 Configuring protection for azure file share via ARM template is currently not supported. We are working on this and it would be available by end of Q3 CY 2020.
@migel0 It worked for you because you provided the Unique ID of the file share, which we implemented as part of recently released soft delete feature , but its currently not exposed publicly so we are working to make ARM templates work even if you pass friendly name for the file share.

Hey @mepand . Is there already a solution to this? The end of Q3 is now over.
I'm running into the same issue. Thank you for an answer to this.

btw, am I right that the UniqueID is a sha256 hash? From which string is it generated?

[mepand]

Hello @baartch Apologies for the delay. We have started enabling the feature flag for supporting ARM template to configure backup for azure file shares using friendly name. It has already been deployed in couple of regions and by end of this month, the feature flag would be enabled for all the geos.