Unable to Create AzureFileShare Protected Item in Vault

[stephenmontgomery]

Issue Details

Unable to create a Backup item for a new Premium Files share. Get an "Microsoft Azure Backup encountered an internal error." when executing via ARM template. In a supporting region ie canadacentral, eastus and can do it via Portal. Use the same template the Portal created/used to create the Files backup item so at a loss on what the issue is - suspect that it's to do with the registering/caching that Portal mentions it's doing - perhaps https://docs.microsoft.com/en-us/azure/backup/backup-afs-cli#enable-backup-for-azure-file-shares?

Repro steps (if necessary, delete otherwise)

1. Premium Azure Files storage account + File Share created
2. Recovery Vault created
3. Vault Backup policy created
4. Attempt to create backup for Azure File share fails with "Microsoft Azure Backup encountered an internal error."
5. Deployed to canadacentral + eastus - supports Premium Files + Backup
6. Works successfully via the Portal - assume it has something to do with the Vault "registering" + refreshing itself according to the activity log

Find attached template to reproduce. azurefiles-vault-backup.json.zip

Any help appreciated.

[jotasixto]

Hi everyone! Any news about it?

I'm trying to do this but I always get the same error:

Deployment failed. Correlation ID: xxxxxxxxxx-xxxx-xxxx-xxxxx-xxxxxxxxxxxxxxxxxx. {
  "status": "Failed",
  "error": {
    "code": "ResourceDeploymentFailure",
    "message": "The resource operation completed with terminal provisioning state 'Failed'.",
    "details": [
      {
        "code": "CloudInternalError",
        "message": "Microsoft Azure Backup encountered an internal error."
      }
    ]
  }
}

I suspect a problem with the item name, what format they should be this? I don't see any reference about FileShares in https://docs.microsoft.com/en-us/azure/templates/microsoft.recoveryservices/vaults/backupfabrics/protectioncontainers/protecteditems

Thanks in advance for the help!

[migel0]

Here the same behavior. It seems the property format of name in this case is mandatory and not documented.

I have got success hardcoding the long string "661bd40fac4e36949e3e814039158f0b6c27ee8a497452559176d00f0cf257cb6"

{
    "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
    "contentVersion": "1.0.0.0",
    "parameters": {
        "vaultName": { "value": "blablabla" },
        "vaultRG": { "value": "rg-blablabla" },
        "policyName": { "value": "DailyPolicy" },
        "fabricName": { "value": "Azure" },
        "protectionContainers": {
          "value": [
            "storagecontainer;storage;rg-blablabla;storage002"
          ]
        },
        "protectedItems": {
          "value": [
           "azurefileshare;661bd40fac4e36949e3e814039158f0b6c27ee8a497452559176d00f0cf257cb6"
          ]
        },
        "sourceResourceIds": {
          "value": [
            "/subscriptions/ blabla bla /resourceGroups/rg-blablabla/providers/Microsoft.Storage/storageAccounts/storage002"
          ]
        }
    }
}

{
    "$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
    "contentVersion": "1.0.0.0",
            "parameters": {
              "vaultName": { "type": "string" },
              "vaultRG": { "type": "string" },
              "vaultSubID": { "type": "string" },
              "policyName": { "type": "string" },
              "fabricName": { "type": "string" },
              "protectionContainers": { "type": "array" },
              "protectedItems": { "type": "array" },
              "sourceResourceIds": { "type": "array" }
            },
    "resources": [
              {
                "name": "[concat(parameters('vaultName'), '/', parameters('fabricName'), '/',parameters('protectionContainers')[copyIndex()], '/', parameters('protectedItems')[copyIndex()])]",
                "apiVersion": "2020-02-02",
                "type": "Microsoft.RecoveryServices/vaults/backupFabrics/protectionContainers/protectedItems",
                "properties": {
                  "backupManagementType": "AzureStorage",
                  "workloadType": "AzureFileShare",
                  "friendlyName": "afs",
                  "protectedItemType": "AzureFileShareProtectedItem",
                  "policyId": "[resourceId('Microsoft.RecoveryServices/vaults/backupPolicies', parameters('vaultName'), parameters('policyName'))]",
                  "sourceResourceId": "[parameters('sourceResourceIds')[copyIndex()]]"
                },
                "copy": {
                  "name": "protectedItemsCopy",
                  "count": "[length(parameters('protectedItems'))]"
                }
              }
    ]
}

It is not complete functional, but it works

[mepand]

@stephenmontgomery @jotasixto @migel0 Configuring protection for azure file share via ARM template is currently not supported. We are working on this and it would be available by end of Q3 CY 2020. @migel0 It worked for you because you provided the Unique ID of the file share, which we implemented as part of recently released soft delete feature , but its currently not exposed publicly so we are working to make ARM templates work even if you pass friendly name for the file share.

[jotasixto]

@mepand Thank you very much for your help!

[baartch]

@stephenmontgomery @jotasixto @migel0 Configuring protection for azure file share via ARM template is currently not supported. We are working on this and it would be available by end of Q3 CY 2020. @migel0 It worked for you because you provided the Unique ID of the file share, which we implemented as part of recently released soft delete feature , but its currently not exposed publicly so we are working to make ARM templates work even if you pass friendly name for the file share.

Hey @mepand . Is there already a solution to this? The end of Q3 is now over. I'm running into the same issue. Thank you for an answer to this.

btw, am I right that the UniqueID is a sha256 hash? From which string is it generated?

[mepand]

Hello @baartch Apologies for the delay. We have started enabling the feature flag for supporting ARM template to configure backup for azure file shares using friendly name. It has already been deployed in couple of regions and by end of this month, the feature flag would be enabled for all the geos.

[jotasixto]

@mepand Do you have more information about this? I check again in various regions but i get the same problem:

{
  "code": "DeploymentFailed",
  "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
  "details": [
    {
      "code": "CloudInternalError",
      "message": "Microsoft Azure Backup encountered an internal error."
    }
  ]
}

Please, could you tell me where to try if this is active in any region?

Thanks!!

[mepand]

@jotasixto We have enabled the ARM template support to configure file share backups in all regions. So, it should work for you irrespective of the region of deployment. Below is the link where you can find the sample template published by us.

https://aka.ms/ARMTemplate-AFSBackup

To troubleshoot your issue, I would request to please share your template with me over mail at [email protected].

[jotasixto]

@mepand Thank you very much for the help!

I wasn't setting the ProtectionContainers resource. I checked the ARMTemplate-AFSBackup and I saw the problem.

Now this works fine! Thanks a lot!

[mepand]

My pleasure @jotasixto . Glad to know that your issue is resolved .

[hadr10]

Hi,

i am getting the same error as @jotasixto or this one when i using above ARM template. Item could have been deleted. Please check if item is present in Backup Items.

Honza

[code-on-git]

@mepand I'm getting the exact same error as described. The link you provided (https://aka.ms/ARMTemplate-AFSBackup) doesn't seem to work anymore.

[Gordonby]

The aka.ms link should take you to this template