CODEWITHSUNDEEP
azureazure-automationazure-runbookpowershell-workflow
Jeffrey
Jeffrey

Reputation: 2149

Azure Automation Runbook Workflow looses AzContext

I have written the following runbook workflow, but from time to time I see the error when it try's to start or stop a VM:

Start-AzVM : Your Azure credentials have not been set up or have expired, please run Connect-AzAccount to set up your Azure credentials. At StartStopVmByTag:46 char:46 + + CategoryInfo : CloseError: (:) [Start-AzVM], ArgumentException + FullyQualifiedErrorId : Microsoft.Azure.Commands.Compute.StartAzureVMCommand

I have tried passing the $azContext variable in, but I still get this issue, how can I further investigate?

workflow StartStopVmByTag {
    $connectionName = "AzRunAsConnection2042";

    try {
        # Get the connection "AzureRunAsConnection "
        $servicePrincipalConnection = Get-AutomationConnection -Name $connectionName

        Write-Output "Logging in to Azure..."
        $null = Add-AzAccount `
            -ServicePrincipal `
            -TenantId $servicePrincipalConnection.TenantId `
            -ApplicationId $servicePrincipalConnection.ApplicationId `
            -CertificateThumbprint $servicePrincipalConnection.CertificateThumbprint
    }
    catch {

        if (!$servicePrincipalConnection) {
            $ErrorMessage = "Connection $connectionName not found."
            throw $ErrorMessage
        }
        else {
            Write-Error -Message $_.Exception
            throw $_.Exception
        }
    }

    [DateTime]$now = [System.TimeZoneInfo]::ConvertTimeBySystemTimeZoneId((Get-Date), 'GMT Standard Time')
    $startTag = 'Start Schedule'

    Write-Output "*** $now - Runbook Started  ***"

    # Get Subscriptions
    $Subscriptions = Get-AzSubscription

    ForEach ($Subscription in $Subscriptions) {
        $azContext = Set-AzContext -SubscriptionId $Subscription.Id

        # Get all VM's with a Start or Stop Schedule
        Write-Output "$($Subscription.Name): Getting VM's..."
        [Array]$taggedVms = Get-AzResource -TagName $startTag -ResourceType 'Microsoft.Compute/virtualMachines'
        $taggedVms = $taggedVms | Sort-Object -Property Name -Unique

        # For each VM, check if start schedule is valid for now
        Foreach -Parallel ($taggedVm in $taggedVms) {
            Write-Output "$($Subscription.Name): Found Tagged VM: $($taggedVm.Name), $($startTag): $($taggedVm.Tags.$startTag -replace '\s', '')"
            $WORKFLOW:null = Start-AzVM -ResourceGroupName $taggedVm.ResourceGroupName -Name $taggedVm.Name -DefaultProfile $azContext -NoWait
        }
    }
}

Upvotes: 0

Views: 272

Answers (1)

R. Edwards
R. Edwards

Reputation: 11

I have been struggling with this issue for a while, and I've tried dozens of different workarounds and nothing has worked. I finally resolved it with these registry settings that force .NET applications to use TLS 1.2. I find it very strange that this solution works, but possibly because the TLS 1.2 set as part of any parent task doesn't get passed on to the job.

They probably aren't all required, but it seems to be a best practice these days anyway.

set-itemproperty "HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727" -name SystemDefaultTlsVersions -value 1 -Type DWord
set-itemproperty "HKLM:\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" -name SchUseStrongCrypto -value 1 -Type DWord
set-itemproperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v2.0.50727" -name SystemDefaultTlsVersions -value 1 -Type DWord
set-itemproperty "HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NETFramework\v4.0.30319" -name SchUseStrongCrypto -value 1 -Type DWord

Upvotes: 0

Related Questions