Repository navigation
[9.6] [Asset Inventory][Azure] Skip storage accounts that don't support File/Queue/Table (#9293) - #9486
Merged
Conversation
…e/Queue/Table (elastic#9293) ## Problem Azure storage accounts that don't support a storage service return `400 FeatureNotSupportedForAccount` for that service. Examples: blob-only accounts (`BlockBlobStorage`) don't support File/Queue/Table, and premium file accounts (`FileStorage`) don't support Blob. The storage listers returned on the first such error. A single unsupported account therefore dropped those assets for **all** other storage accounts in the cycle, and logged an ERROR, which triggered the `[Agentless] Cloudbeat error logs` alert. ## Fix - All 8 storage listers (blob containers/services, file services/shares, queues/queue services, tables/table services) skip only the account that returns `FeatureNotSupportedForAccount` and continue with the others. - Skipped accounts are logged at WARN, so missing assets can be traced without tripping the error-log alert. - All other errors (e.g. 403) still fail as before. ## Validation against Azure We checked the real Azure Resource Manager responses in a throwaway resource group in the staging synthetics subscription (`subs-csp-1`). We created one account of each relevant kind, called the same ARM endpoints Cloudbeat uses with `az rest`, and deleted the resource group afterwards. | Account kind | Endpoints called | Result | |---|---|---| | `FileStorage` | `blobServices`, `blobServices/default/containers` | `400 FeatureNotSupportedForAccount` | | `BlockBlobStorage` | `fileServices`, `fileServices/default/shares`, `queueServices`, `queueServices/default/queues`, `tableServices`, `tableServices/default/tables` | `400 FeatureNotSupportedForAccount` | | `FileStorage`, `BlockBlobStorage` | `{blob,queue,table}Services/default/providers/Microsoft.Insights/diagnosticSettings` for services the account lacks | `200 OK` | What this means for the code: - The blob listers needed the same skip, so it was added. - The diagnostic settings path doesn't fail for missing services, so it needs no change. - Matching `FeatureNotSupportedForAccount` exactly is enough for every account kind that can be created today. Legacy `BlobStorage` accounts couldn't be verified, because Azure no longer allows creating them (`AccountKindNotSupported`). ## Tests - A table-driven test covers all 8 listers: an unsupported account returns no error and doesn't stop the next account from being fetched. - Existing tests check that other errors (403) still fail. - `go test` passes for `azurelib/inventory` and `azurefetcher`. --------- Co-authored-by: Cloud Security Machine <cloudsecmachine@users.noreply.github.com> Co-authored-by: Cursor <cursoragent@cursor.com> (cherry picked from commit 4fa3d0a)
gurevichdmitry
approved these changes
Oct 29, 2026
Contributor
|
This pull request does not currently match the merge queue conditions, so it cannot be queued from here. The box comes back if it matches again. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #9293 to
9.6.#9293 merged into
mainon 2026-10-23, after9.6was branched (2026-10-20), and it was labelledbackport-skip. So it isn't in 9.6.0 BC1 or BC2, whose Cloudbeat builds came from9.6on 2026-10-22 and 2026-10-28 (elastic/dev#3645).Without it, a single Azure storage account that doesn't support a storage service (
FeatureNotSupportedForAccount) drops those assets for every other storage account, and the error trips the[Agentless] Cloudbeat error logsalert.Changes
Clean cherry-pick (
git cherry-pick -x 4fa3d0a) with no conflicts. See #9293 for the full description and the validation against Azure.Testing on
9.6go build ./...passes.go test ./internal/resources/providers/azurelib/... ./internal/inventory/azurefetcher/...passes, including the new tests for all 8 storage listers../bin/golangci-lint run(v2.15.0) on the changed packages reports 0 issues.