Otdfbt

I'm getting an error when a webjob runs:

Microsoft.Azure.WebJobs.Host.FunctionInvocationException: Exception while executing function: Functions.Cleanup ---> Microsoft.Rest.Azure.CloudException: The client '[Redacted]' with object id '[Redacted]' does not have authorization to perform action 'Microsoft.Web/sites/config/list/action' over scope '/subscriptions/[Redacted]/resourceGroups/[Redacted]/providers/Microsoft.Web/sites/[Redacted]/config/publishingcredentials'.

This is a LetsEncrypt certificate renewal attempt; the full stack report is below.

I've reviewed documentation here and here, but I'm afraid I'm still at a loss.

I've found the Microsoft.Web/sites/config/list/action provider here, but it's not listed in the available roles and there's no indication as to how to give it access to this:

/subscriptions/[Redacted]/resourceGroups/[Redacted]/providers/Microsoft.Web/sites/[Redacted]/config/publishingcredentials

All has been working well for the past year, but this only started failing within the past month or so. I have two websites on which I'm running the job, and suddenly both are failing with like errors.

It could be related to my recent decision to move the extension's files out of AppData into a folder one level above the website, as discussed here, but due to timing issues I can't be certain.

How can I add the necessary permissions to let the WebJob run successfully?

 1 
 2 "Type": "FunctionCompleted",
 3 "EndTime": "2019-03-21T03:11:53.1829332+00:00",
 4 "Failure": 
 5 "ExceptionType": "Microsoft.Azure.WebJobs.Host.FunctionInvocationException",
 6 "ExceptionDetails": "Microsoft.Azure.WebJobs.Host.FunctionInvocationException: Exception while executing function: Functions.Cleanup ---> Microsoft.Rest.Azure.CloudException: The client '[Redacted]' with object id '[Redacted]' does not have authorization to perform action 'Microsoft.Web/sites/config/list/action' over scope '/subscriptions/[Redacted]/resourceGroups/[Redacted]/providers/Microsoft.Web/sites/[Redacted]/config/publishingcredentials'.
 7 at Microsoft.Azure.Management.WebSites.WebAppsOperations.<BeginListPublishingCredentialsWithHttpMessagesAsync>d__210.MoveNext()
 8 --- End of stack trace from previous location where exception was thrown ---
 9 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
10 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
11 at Microsoft.Azure.Management.WebSites.WebAppsOperationsExtensions.<BeginListPublishingCredentialsAsync>d__411.MoveNext()
12 --- End of stack trace from previous location where exception was thrown ---
13 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
14 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
15 at Microsoft.Azure.Management.WebSites.WebAppsOperationsExtensions.BeginListPublishingCredentials(IWebAppsOperations operations, String resourceGroupName, String name)
16 at LetsEncrypt.Azure.Core.KuduHelper.GetKuduClient(WebSiteManagementClient client, IAzureWebAppEnvironment settings) in D:\a\1\s\LetsEncrypt.SiteExtension.Core\KuduHelper.cs:line 15
17 at LetsEncrypt.Azure.Core.Services.KuduFileSystemAuthorizationChallengeProvider..ctor(IAzureWebAppEnvironment azureEnvironment, IAuthorizationChallengeProviderConfig config) in D:\a\1\s\LetsEncrypt.SiteExtension.Core\Services\KuduFileSystemAuthorizationChallengeProvider.cs:line 22
18 at LetsEncrypt.Azure.Core.CertificateManager..ctor(AppSettingsAuthConfig config) in D:\a\1\s\LetsEncrypt.SiteExtension.Core\CertificateManager.cs:line 31
19 at LetsEncrypt.SiteExtension.Functions.Cleanup(TimerInfo timerInfo) in D:\a\1\s\LetsEncrypt.SiteExtension.WebJob\Functions.cs:line 73
20 at lambda_method(Closure , Functions , Object[] )
21 at Microsoft.Azure.WebJobs.Host.Executors.VoidMethodInvoker`1.InvokeAsync(TReflected instance, Object[] arguments)
22 at Microsoft.Azure.WebJobs.Host.Executors.FunctionInvoker`1.<InvokeAsync>d__8.MoveNext()
23 --- End of stack trace from previous location where exception was thrown ---
24 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
25 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
26 at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.<InvokeAsync>d__22.MoveNext()
27 --- End of stack trace from previous location where exception was thrown ---
28 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
29 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
30 at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
31 at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.<ExecuteWithWatchersAsync>d__21.MoveNext()
32 --- End of stack trace from previous location where exception was thrown ---
33 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
34 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
35 at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.<ExecuteWithLoggingAsync>d__19.MoveNext()
36 --- End of stack trace from previous location where exception was thrown ---
37 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
38 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
39 at System.Runtime.CompilerServices.TaskAwaiter.ValidateEnd(Task task)
40 at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.<ExecuteWithLoggingAsync>d__13.MoveNext()
41 --- End of inner exception stack trace ---
42 at System.Runtime.ExceptionServices.ExceptionDispatchInfo.Throw()
43 at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.<ExecuteWithLoggingAsync>d__13.MoveNext()
44 --- End of stack trace from previous location where exception was thrown ---
45 at System.Runtime.CompilerServices.TaskAwaiter.ThrowForNonSuccess(Task task)
46 at System.Runtime.CompilerServices.TaskAwaiter.HandleNonSuccessAndDebuggerNotification(Task task)
47 at Microsoft.Azure.WebJobs.Host.Executors.FunctionExecutor.<TryExecuteAsync>d__10.MoveNext()"
48 ,
49 "ParameterLogs": ,
50 "FunctionInstanceId": "[Redacted]",
51 "Function": 
52 "Id": "LetsEncrypt.SiteExtension.Functions.Cleanup",
53 "FullName": "LetsEncrypt.SiteExtension.Functions.Cleanup",
54 "ShortName": "Functions.Cleanup",
55 "Parameters": [
56 
57 "Name": "timerInfo",
58 "DisplayHints": 
59 "Description": "Timer executed on schedule (Daily: 1 occurrences)"
60 
61 
62 ]
63 ,
64 "Arguments": 
65 "timerInfo": "2019-03-21T03:11:49.9071967+00:00"
66 ,
67 "Reason": "AutomaticTrigger",
68 "ReasonDetails": "Timer fired at 2019-03-21T03:11:48.8550732+00:00",
69 "StartTime": "2019-03-21T03:11:48.8550732+00:00",
70 "OutputBlob": 
71 "ContainerName": "azure-webjobs-hosts",
72 "BlobName": "output-logs/[Redacted].txt"
73 ,
74 "ParameterLogBlob": 
75 "ContainerName": "azure-webjobs-hosts",
76 "BlobName": "output-logs/[Redacted].params.txt"
77 ,
78 "HostInstanceId": "[Redacted]",
79 "HostDisplayName": "LetsEncrypt.SiteExtension.WebJob",
80 "SharedQueueName": "azure-webjobs-host-le-[Redacted]",
81 "InstanceQueueName": "azure-webjobs-host-[Redacted]",
82 "Heartbeat": 
83 "SharedContainerName": "azure-webjobs-hosts",
84 "SharedDirectoryName": "heartbeats/le-[Redacted]",
85 "InstanceBlobName": "[Redacted]",
86 "ExpirationInSeconds": 45
87 ,
88 "WebJobRunIdentifier": 
89 "WebSiteName": "[Redacted]",
90 "JobType": "Continuous",
91 "JobName": "letsencrypt.siteextension.job",
92 "RunId": ""
93 
94 

It turned out that I didn't have a security role assigned to the WebJob (link).

Go to your Resource Group with the web site, click Access Control (IAM) and use the Check Access Feature. If you know the name of your Service Principal/Application you can just search for it and see what permission it has assigned. In my case here it is granted Owner access on the Subscription, but that is more than required. Contributor access on the Resource Group should be sufficient.

Once I did that, the job was able to run successfully.