Cosmos DB rewrapClientencryptignationKeynAsync返回400不良请求
I am trying to use this method "RewrapClientEncryptionKeyAsync" to change the CMK(azure key vault) in a cosmos db following this example:
azure.requestfailedexception：'Get方法不允许操作'。 状态：400（不良要求） 错误代码：不良参数
内容： {“ error”：{“ code”：“ dadParameter”，“ message”：“获取方法不允许操作。”}}}}}}}}}}
我正在使用defaultazurecrecredential（）获取客户端cosmos，也是客户端的实例数据库看起来不错；使用我当前的密钥（旧版本），我可以毫无问题地创建和读取项目。该应用程序对于旧密钥，包装和解开包装加密操作的应用程序都具有相同的权限，并且还可以旋转旋转策略操作。
该代码在.NET 6控制台应用程序中，Nugets的版本为： azure.Identity 1.6.0，azure.security.keyvault.keys 4.3.0，microsoft.azure.cosmos.cosmos.Encryption 1.0.0和microsoft.azure.cosmos.cosmos 3.26.1。
I am trying to use this method "RewrapClientEncryptionKeyAsync" to change the CMK(azure key vault) in a cosmos db following this example: https://learn.microsoft.com/en-us/azure/cosmos-db/how-to-always-encrypted?tabs=dotnet#cmk-rotation but when the code calls that method I always get the same error:
Azure.RequestFailedException: 'GET method does not allow the operation'.
Status: 400 (Bad Request)
ErrorCode: BadParameter
Content:
{"error":{"code": "BadParameter", "message": "GET method does not allow the operation."}}}
I am using DefaultAzureCredential() to get the client cosmos, also the instance for the client and the database looks fine; using my current key (old version) I can create and read items without problem. The application has the same permissions for both old and new key, for wrap and unwrap encryption operations and also rotate on rotation policy operations.
The code is in a .net 6 console application and the version of the nugets are:
Azure.Identity 1.6.0, Azure.Security.KeyVault.Keys 4.3.0, Microsoft.Azure.Cosmos.Encryption 1.0.0 and Microsoft.Azure.Cosmos 3.26.1.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
400 BadRequest错误通常是由
不正确的URIS引起的。检查URI类型或语法问题，以及关键保险库的正确URL格式，如下所示，或，
用户无需许可。
为避免这种情况，请配置
keyVault访问策略，以允许用户分配的托管ID访问该秘密。有关更多信息，您可以参考此 Microsoft文档
400 BadRequest errors are often caused by
incorrect URIs. Check for URI type or syntax issues and the correct URL format for key vault is like below,OR,
The user doesn't have the required permission.
To avoid this, configure a
keyvaultaccess policy to allow user-assigned managed IDs to access the secret.For more information you can refer to this Microsoft Document