Infinite Wait: az keyvault wait --created

[ATunderSP]

Describe the bug

Waiting for Succeeded state of KeyVault takes infinite time.
KeyVault is already created and is in Succeeded state.
I verified it, because az keyvault show commands works correctly.
Also waiting for keyvault via az resource wait works correctly.
Only keyvault waiting az keyvault wait loops forever.

Bugged version: 2.82
Working version: 2.66

Related command

KEY_VAULT_ID="/subscriptions/${SUBSCRIPTION_ID}/resourceGroups/${RESOURCE_GROUP_NAME}/providers/Microsoft.KeyVault/vaults/${KEY_VAULT_NAME}"

az keyvault show --subscription ${SUBSCRIPTION_ID} --resource-group ${RESOURCE_GROUP_NAME} --name ${KEY_VAULT_NAME} --debug

az resource wait --ids "${KEY_VAULT_ID}" --created --debug

az keyvault wait --subscription ${SUBSCRIPTION_ID} --resource-group ${RESOURCE_GROUP_NAME} --name ${KEY_VAULT_NAME} --created --debug

Errors

KeyVault waits just shows - Starting .. forever.

Issue script & Debug output

DEBUG: cli.knack.cli: Command arguments: ['keyvault', 'show', '--subscription', '00000000-0000-0000-0000-00000000000000000', '--resource-group', 'resource-group-name', '--name', 'key-vault-name', '--debug']
...
DEBUG: cli.azure.cli.core: Modules found from index for 'keyvault': ['azure.cli.command_modules.keyvault']
DEBUG: cli.azure.cli.core: Loading command modules:
DEBUG: cli.azure.cli.core: Name                  Load Time    Groups  Commands
DEBUG: cli.azure.cli.core: keyvault                  0.003        20       114
DEBUG: cli.azure.cli.core: Total (1)                 0.003        20       114
DEBUG: cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
DEBUG: cli.azure.cli.core: Loading extensions:
DEBUG: cli.azure.cli.core: Name                  Load Time    Groups  Commands  Directory
DEBUG: cli.azure.cli.core: Total (0)                 0.000         0         0  
DEBUG: cli.azure.cli.core: Loaded 20 groups, 114 commands.
DEBUG: cli.azure.cli.core: Found a match in the command table.
DEBUG: cli.azure.cli.core: Raw command  : keyvault show
DEBUG: cli.azure.cli.core: Command table: keyvault show
...
DEBUG: cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000000000/resourceGroups/resource-group-name/providers/Microsoft.KeyVault/vaults/key-vault-name?api-version=2025-05-01'
DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'GET'
DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
DEBUG: cli.azure.cli.core.sdk.policies:     'Accept': 'application/json'
DEBUG: cli.azure.cli.core.sdk.policies:     'CommandName': 'keyvault show'
DEBUG: cli.azure.cli.core.sdk.policies:     'ParameterSetName': '--subscription --resource-group --name --debug'
DEBUG: cli.azure.cli.core.sdk.policies:     'Authorization': '*****'
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.core.sdk.policies: This request has no body
DEBUG: urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
DEBUG: urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/00000000-0000-0000-0000-00000000000000000/resourceGroups/resource-group-name/providers/Microsoft.KeyVault/vaults/key-vault-name?api-version=2025-05-01 HTTP/1.1" 200 1227
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 200
DEBUG: cli.azure.cli.core.sdk.policies: Response headers:
DEBUG: cli.azure.cli.core.sdk.policies:     'Cache-Control': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies:     'Pragma': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies:     'Content-Length': '1227'
DEBUG: cli.azure.cli.core.sdk.policies:     'Content-Type': 'application/json; charset=utf-8'
DEBUG: cli.azure.cli.core.sdk.policies:     '...'
...
{
  "id": "/subscriptions/00000000-0000-0000-0000-00000000000000000/resourceGroups/resource-group-name/providers/Microsoft.KeyVault/vaults/key-vault-name",
  "location": "0000000000000",
  "name": "key-vault-name",
  "properties": {
    ...
    "provisioningState": "Succeeded",
    ...
  },
  ...
  "type": "Microsoft.KeyVault/vaults"
}
DEBUG: cli.knack.cli: Command arguments: ['resource', 'wait', '--ids', '/subscriptions/00000000-0000-0000-0000-00000000000000000/resourceGroups/resource-group-name/providers/Microsoft.KeyVault/vaults/key-vault-name', '--created', '--debug']
...
DEBUG: cli.azure.cli.core: Modules found from index for 'resource': ['azure.cli.command_modules.resource']
DEBUG: cli.azure.cli.core: Loading command modules:
DEBUG: cli.azure.cli.core: Name                  Load Time    Groups  Commands
DEBUG: cli.azure.cli.core: resource                  0.092        52       234
DEBUG: cli.azure.cli.core: Total (1)                 0.092        52       234
DEBUG: cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
DEBUG: cli.azure.cli.core: Loading extensions:
DEBUG: cli.azure.cli.core: Name                  Load Time    Groups  Commands  Directory
DEBUG: cli.azure.cli.core: Total (0)                 0.000         0         0  
DEBUG: cli.azure.cli.core: Loaded 52 groups, 234 commands.
DEBUG: cli.azure.cli.core: Found a match in the command table.
DEBUG: cli.azure.cli.core: Raw command  : resource wait
DEBUG: cli.azure.cli.core: Command table: resource wait
...
DEBUG: cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000000000/providers/Microsoft.KeyVault?api-version=2024-11-01'
DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'GET'
DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
DEBUG: cli.azure.cli.core.sdk.policies:     'Accept': 'application/json'
DEBUG: cli.azure.cli.core.sdk.policies:     'CommandName': 'resource wait'
DEBUG: cli.azure.cli.core.sdk.policies:     'ParameterSetName': '--ids --created --debug'
DEBUG: cli.azure.cli.core.sdk.policies:     'Authorization': '*****'
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.core.sdk.policies: This request has no body
DEBUG: urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
DEBUG: urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/00000000-0000-0000-0000-00000000000000000/providers/Microsoft.KeyVault?api-version=2024-11-01 HTTP/1.1" 200 23944
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 200
DEBUG: cli.azure.cli.core.sdk.policies: Response headers:
DEBUG: cli.azure.cli.core.sdk.policies:     'Cache-Control': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies:     'Pragma': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies:     'Content-Length': '23944'
DEBUG: cli.azure.cli.core.sdk.policies:     'Content-Type': 'application/json; charset=utf-8'
DEBUG: cli.azure.cli.core.sdk.policies:     '...'
...
DEBUG: cli.knack.cli: Command arguments: ['keyvault', 'wait', '--subscription', '00000000-0000-0000-0000-00000000000000000', '--resource-group', 'resource-group-name', '--name', 'key-vault-name', '--created', '--debug']
...
DEBUG: cli.azure.cli.core: Modules found from index for 'keyvault': ['azure.cli.command_modules.keyvault']
DEBUG: cli.azure.cli.core: Loading command modules:
DEBUG: cli.azure.cli.core: Name                  Load Time    Groups  Commands
DEBUG: cli.azure.cli.core: keyvault                  0.004        20       114
DEBUG: cli.azure.cli.core: Total (1)                 0.004        20       114
DEBUG: cli.azure.cli.core: These extensions are not installed and will be skipped: ['azext_ai_examples', 'azext_next']
DEBUG: cli.azure.cli.core: Loading extensions:
DEBUG: cli.azure.cli.core: Name                  Load Time    Groups  Commands  Directory
DEBUG: cli.azure.cli.core: Total (0)                 0.000         0         0  
DEBUG: cli.azure.cli.core: Loaded 20 groups, 114 commands.
DEBUG: cli.azure.cli.core: Found a match in the command table.
DEBUG: cli.azure.cli.core: Raw command  : keyvault wait
DEBUG: cli.azure.cli.core: Command table: keyvault wait
...
DEBUG: cli.azure.cli.core.sdk.policies: Request URL: 'https://management.azure.com/subscriptions/00000000-0000-0000-0000-00000000000000000/resourceGroups/resource-group-name/providers/Microsoft.KeyVault/vaults/key-vault-name?api-version=2025-05-01'
DEBUG: cli.azure.cli.core.sdk.policies: Request method: 'GET'
DEBUG: cli.azure.cli.core.sdk.policies: Request headers:
DEBUG: cli.azure.cli.core.sdk.policies:     'Accept': 'application/json'
DEBUG: cli.azure.cli.core.sdk.policies:     'CommandName': 'keyvault wait'
DEBUG: cli.azure.cli.core.sdk.policies:     'ParameterSetName': '--subscription --resource-group --name --created --debug'
DEBUG: cli.azure.cli.core.sdk.policies:     'Authorization': '*****'
DEBUG: cli.azure.cli.core.sdk.policies: Request body:
DEBUG: cli.azure.cli.core.sdk.policies: This request has no body
DEBUG: urllib3.connectionpool: Starting new HTTPS connection (1): management.azure.com:443
DEBUG: urllib3.connectionpool: https://management.azure.com:443 "GET /subscriptions/00000000-0000-0000-0000-00000000000000000/resourceGroups/resource-group-name/providers/Microsoft.KeyVault/vaults/key-vault-name?api-version=2025-05-01 HTTP/1.1" 200 1227
DEBUG: cli.azure.cli.core.sdk.policies: Response status: 200
DEBUG: cli.azure.cli.core.sdk.policies: Response headers:
DEBUG: cli.azure.cli.core.sdk.policies:     'Cache-Control': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies:     'Pragma': 'no-cache'
DEBUG: cli.azure.cli.core.sdk.policies:     'Content-Length': '1227'
DEBUG: cli.azure.cli.core.sdk.policies:     'Content-Type': 'application/json; charset=utf-8'
DEBUG: cli.azure.cli.core.sdk.policies:     '...'
...
INFO: az_command_data_logger: exit code: 1
INFO: cli.__main__: Command ran in 10.761 seconds (init: 0.080, invoke: 10.681)
INFO: telemetry.main: Begin splitting cli events and extra events, total events: 1
INFO: telemetry.client: Accumulated 0 events. Flush the clients.
INFO: telemetry.main: Finish splitting cli events and extra events, cli events: 1
INFO: telemetry.save: Save telemetry record of length 4054 in cache file under /home/00000/.azure/telemetry/00000000000000000
INFO: telemetry.main: Begin creating telemetry upload process.
INFO: telemetry.process: Creating upload process: "/opt/az/bin/python3 /opt/az/lib/python3.13/site-packages/azure/cli/telemetry/__init__.py /home/00000/.azure /home/00000/.azure/telemetry/00000000000000000"
INFO: telemetry.process: Return from creating process 3257057
INFO: telemetry.main: Finish creating telemetry upload process.

Expected behavior

Key Vault waiting script finishes instantly in the similar way az az resource waiting.

Environment Summary

Azure CLI: 2.82.0 (DEB build)
Python: 3.13.9 (embedded with Azure CLI)
Cloud: Azure Public
Authentication: User principal via az login
Network: No proxy on the client. Key Vault has firewall enabled with specific IPs and one VNet rule; ARM/control-plane access is not restricted.

[yonzhan]

Thank you for opening this issue, we will look into it.