Restoring the Automation Suite Platform Using NFS Backup Fails Due to Managed Identity Assignment Issues

News Knowledge Base
1

How to restore the Automation Suite Platform Using NFS Backup Fails Due to Managed Identity Assignment Issues

Issue Description

While restoring the Automation Suite platform using the NFS backup as per the official documentation, the process fails due to errors related to the assignment of managed identities with Azure resources.

Example error messages include:

  • Azure resource ‘azure-resource-id’ does not have access to identity ‘managed-identity-id’.
  • No managed service identities are associated with resource ‘azure-resource-id’.

Additionally, the IMDS (Instance Metadata Service) endpoint may respond with a 400 status code, indicating that the requested identity is not assigned to the VM.

Root Cause

  1. Missing or Incorrect Identity Assignment: The managed identity (user-assigned or system-assigned) is not correctly associated with the Azure resources or VM.
  2. Proxy or Gateway Interference: The IMDS endpoint does not support requests routed via proxies or gateways.

Resolution

Perform the following steps depending on the managed identity configuration:

  1. User-Assigned Managed Identity:

    1. Verify the ID being used for the user-assigned identity.
    2. Reassign the identity to the Azure resource:
      • Sign in to the Azure portal.
      • Navigate to the target VM.
      • Click Identity > User assigned, then click +Add.
      • Select the required user-assigned identity and click Add.

  2. System-Assigned Managed Identity:

If the system-assigned identity is not functioning correctly, disable the identity, then re-enable it:

    • Sign in to the Azure portal.
    • Navigate to the target VM.
    • Click Identity > System assigned.
    • Toggle the status off, then on again.

Further:

  1. For user-assigned identities, ensure the correct ID is specified.
  2. For system-assigned identities, ensure they are enabled and properly configured (review the official Azure-managed identity documentation).
  3. Disable any proxies or gateways running on the VM that could interfere with requests to the IMDS endpoint (http://169.254.169.254).

Additional Notes:

  • If certain identities are no longer needed, remove them from the Azure resource to reduce potential conflicts.
  • Ensure all permissions required for the Automation Suite restoration process are correctly assigned at the subscription or resource level.