how to get key info from other tenant

Question

Hi
according to this article: https://learn.microsoft.com/en-us/azure/storage/common/customer-managed-keys-configure-cross-tenant-new-account?toc=%2Fazure%2Fstorage%2Fblobs%2Ftoc.json&bc=%2Fazure%2Fstorage%2Fblobs%2Fbreadcrumb%2Ftoc.json&tabs=azure-portal

I want do a validation by get the key info with the cross tenant application or the user-assigned identity. How to do that?

I tried use golang `

client.GetKey(...

but it's error
RESPONSE 401: 401 Unauthorized

ERROR CODE: Unauthorized

--------------------------------------------------------------------------------

{

"error": {

"code": "Unauthorized",

"message": "AKV10032: Invalid issuer. Expected one of https://sts.windows.net/...

Answer 1

@Siqing Zheng

Thank for your time and patience. I was able to test through this in my lab and found the following:

The details about the key can't be fetched using managed Identity or service principal as both have dependencies and authorization token cannot be fetched using managed Identity credential library:

I got the following error while trying the same, seems like this is a preventive limitation to avoid any intrusion to customer's tenant hosting CMK.

ImdsCredential.get_token failed: ManagedIdentityCredential authentication unavailable, no response from the IMDS endpoint.
ManagedIdentityCredential.get_token failed: ManagedIdentityCredential authentication unavailable, no response from the IMDS endpoint.

On the contrary I used the CLI and got the details about the version, name and the URI of the vault:

az storage account show --name akshaycmk --resource-group AzureLabService --query encryption

Assuming this is what you were looking for please do let me know if you have any further queries.

Please "Accept the answer (Yes)" and "share your feedback ". This will help us and others in the community as well.

Thanks,

Akshay Kaushik

Answer 2

Hi,

Any update on this?

I have a very similar issue, using Golang SDK.

Thanks.