Infinite Wait: az keyvault wait --created #32656
Description
Describe the bug
Waiting for Succeeded state of KeyVault takes infinite time.
KeyVault is already created and is in Succeeded state.
I verified it, because az keyvault show commands works correctly.
Also waiting for keyvault via az resource wait works correctly.
Only keyvault waiting az keyvault wait loops forever.
Bugged version: 2.82
Working version: 2.66
Related command
KEY_VAULT_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_NAME}/providers/Microsoft.KeyVault/vaults/${KEY_VAULT_NAME}"
az keyvault show --subscription ${SUBSCRIPTION_ID} --resource-group ${RESOURCE_GROUP_NAME} --name ${KEY_VAULT_NAME} --debug
az resource wait --ids "${KEY_VAULT_ID}" --created --debug
az keyvault wait --subscription ${SUBSCRIPTION_ID} --resource-group ${RESOURCE_GROUP_NAME} --name ${KEY_VAULT_NAME} --created --debug
Errors
KeyVault waits just shows - Starting .. forever.
Issue script & Debug output
DEBUG: cli.knack.cli: Command arguments: ['keyvault', 'show', '--subscription', '00000000-0000-0000-0000-00000000000000000', '--resource-group', 'resource-group-name', '--name', 'key-vault-name', '--debug']
...
DEBUG: cli.azure.cli.core: Modules found from index for 'keyvault': ['azure.cli.command_modules.keyvault']
DEBUG: cli.azure.cli.core: Loading command modules:
DEBUG: cli.azure.cli.core: Name Load Time Groups Commands
DEBUG: cli.azure.cli.core: keyvault 0.003 20 114
DEBUG: cli.azure.cli.core: Total (1) 0.003 20 114
DEBUG: cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
DEBUG: cli.azure.cli.core: Loading extensions:
DEBUG: cli.azure.cli.core: Name Load Time Groups Commands Directory
DEBUG: cli.azure.cli.core: Total (0) 0.000 0 0
DEBUG: cli.azure.cli.core: Loaded 20 groups, 114 commands.
DEBUG: cli.azure.cli.core: Found a match in the command table.
DEBUG: cli.azure.cli.core: Raw command : keyvault show
DEBUG: cli.azure.cli.core: Command table: keyvault show
...
DEBUG: cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000000000/resourceGroups/resource-group-name/providers/Microsoft.KeyVault/vaults/key-vault-name?api-version=2025-05-01'
DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'GET'
DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
DEBUG: cli.azure.cli.core.sdk.policies: 'CommandName': 'keyvault show'
DEBUG: cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--subscription --resource-group --name --debug'
DEBUG: cli.azure.cli.core.sdk.policies: 'Authorization': '*****'
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.core.sdk.policies: This request has no body
DEBUG: urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
DEBUG: urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/00000000-0000-0000-0000-00000000000000000/resourceGroups/resource-group-name/providers/Microsoft.KeyVault/vaults/key-vault-name?api-version=2025-05-01 HTTP/1.1" 200 1227
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 200
DEBUG: cli.azure.cli.core.sdk.policies: Response headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Length': '1227'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
DEBUG: cli.azure.cli.core.sdk.policies: '...'
...
{
"id": "/subscriptions/00000000-0000-0000-0000-00000000000000000/resourceGroups/resource-group-name/providers/Microsoft.KeyVault/vaults/key-vault-name",
"location": "0000000000000",
"name": "key-vault-name",
"properties": {
...
"provisioningState": "Succeeded",
...
},
...
"type": "Microsoft.KeyVault/vaults"
}
DEBUG: cli.knack.cli: Command arguments: ['resource', 'wait', '--ids', '/subscriptions/00000000-0000-0000-0000-00000000000000000/resourceGroups/resource-group-name/providers/Microsoft.KeyVault/vaults/key-vault-name', '--created', '--debug']
...
DEBUG: cli.azure.cli.core: Modules found from index for 'resource': ['azure.cli.command_modules.resource']
DEBUG: cli.azure.cli.core: Loading command modules:
DEBUG: cli.azure.cli.core: Name Load Time Groups Commands
DEBUG: cli.azure.cli.core: resource 0.092 52 234
DEBUG: cli.azure.cli.core: Total (1) 0.092 52 234
DEBUG: cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
DEBUG: cli.azure.cli.core: Loading extensions:
DEBUG: cli.azure.cli.core: Name Load Time Groups Commands Directory
DEBUG: cli.azure.cli.core: Total (0) 0.000 0 0
DEBUG: cli.azure.cli.core: Loaded 52 groups, 234 commands.
DEBUG: cli.azure.cli.core: Found a match in the command table.
DEBUG: cli.azure.cli.core: Raw command : resource wait
DEBUG: cli.azure.cli.core: Command table: resource wait
...
DEBUG: cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000000000/providers/Microsoft.KeyVault?api-version=2024-11-01'
DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'GET'
DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
DEBUG: cli.azure.cli.core.sdk.policies: 'CommandName': 'resource wait'
DEBUG: cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--ids --created --debug'
DEBUG: cli.azure.cli.core.sdk.policies: 'Authorization': '*****'
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.core.sdk.policies: This request has no body
DEBUG: urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
DEBUG: urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/00000000-0000-0000-0000-00000000000000000/providers/Microsoft.KeyVault?api-version=2024-11-01 HTTP/1.1" 200 23944
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 200
DEBUG: cli.azure.cli.core.sdk.policies: Response headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Length': '23944'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
DEBUG: cli.azure.cli.core.sdk.policies: '...'
...
DEBUG: cli.knack.cli: Command arguments: ['keyvault', 'wait', '--subscription', '00000000-0000-0000-0000-00000000000000000', '--resource-group', 'resource-group-name', '--name', 'key-vault-name', '--created', '--debug']
...
DEBUG: cli.azure.cli.core: Modules found from index for 'keyvault': ['azure.cli.command_modules.keyvault']
DEBUG: cli.azure.cli.core: Loading command modules:
DEBUG: cli.azure.cli.core: Name Load Time Groups Commands
DEBUG: cli.azure.cli.core: keyvault 0.004 20 114
DEBUG: cli.azure.cli.core: Total (1) 0.004 20 114
DEBUG: cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
DEBUG: cli.azure.cli.core: Loading extensions:
DEBUG: cli.azure.cli.core: Name Load Time Groups Commands Directory
DEBUG: cli.azure.cli.core: Total (0) 0.000 0 0
DEBUG: cli.azure.cli.core: Loaded 20 groups, 114 commands.
DEBUG: cli.azure.cli.core: Found a match in the command table.
DEBUG: cli.azure.cli.core: Raw command : keyvault wait
DEBUG: cli.azure.cli.core: Command table: keyvault wait
...
DEBUG: cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000000000/resourceGroups/resource-group-name/providers/Microsoft.KeyVault/vaults/key-vault-name?api-version=2025-05-01'
DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'GET'
DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'Accept': 'application/json'
DEBUG: cli.azure.cli.core.sdk.policies: 'CommandName': 'keyvault wait'
DEBUG: cli.azure.cli.core.sdk.policies: 'ParameterSetName': '--subscription --resource-group --name --created --debug'
DEBUG: cli.azure.cli.core.sdk.policies: 'Authorization': '*****'
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.core.sdk.policies: This request has no body
DEBUG: urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
DEBUG: urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/00000000-0000-0000-0000-00000000000000000/resourceGroups/resource-group-name/providers/Microsoft.KeyVault/vaults/key-vault-name?api-version=2025-05-01 HTTP/1.1" 200 1227
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 200
DEBUG: cli.azure.cli.core.sdk.policies: Response headers:
DEBUG: cli.azure.cli.core.sdk.policies: 'Cache-Control': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Pragma': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Length': '1227'
DEBUG: cli.azure.cli.core.sdk.policies: 'Content-Type': 'application/json; charset=utf-8'
DEBUG: cli.azure.cli.core.sdk.policies: '...'
...
INFO: az_command_data_logger: exit code: 1
INFO: cli.__main__: Command ran in 10.761 seconds (init: 0.080, invoke: 10.681)
INFO: telemetry.main: Begin splitting cli events and extra events, total events: 1
INFO: telemetry.client: Accumulated 0 events. Flush the clients.
INFO: telemetry.main: Finish splitting cli events and extra events, cli events: 1
INFO: telemetry.save: Save telemetry record of length 4054 in cache file under /home/00000/.azure/telemetry/00000000000000000
INFO: telemetry.main: Begin creating telemetry upload process.
INFO: telemetry.process: Creating upload process: "/opt/az/bin/python3 /opt/az/lib/python3.13/site-packages/azure/cli/telemetry/__init__.py /home/00000/.azure /home/00000/.azure/telemetry/00000000000000000"
INFO: telemetry.process: Return from creating process 3257057
INFO: telemetry.main: Finish creating telemetry upload process.
Expected behavior
Key Vault waiting script finishes instantly in the similar way az az resource waiting.
Environment Summary
Azure CLI: 2.82.0 (DEB build)
Python: 3.13.9 (embedded with Azure CLI)
Cloud: Azure Public
Authentication: User principal via az login
Network: No proxy on the client. Key Vault has firewall enabled with specific IPs and one VNet rule; ARM/control-plane access is not restricted.