az redisenterprise database access-policy-assignment delete rejects portal-created assignment names

[shraboin]

Describe the bug

Issue: unable to delete access policy using Azure CLI. Particularly Azure CLI is not deleting the access policies that were created through Azure portal.

The Azure CLI redisenterprise extension (v1.4.0) applies a client-side regex validation (^[A-Za-z0-9]{1,60}$) on the
--access-policy-assignment-name parameter that rejects GUID-format names containing hyphens. Access policy
assignments created through the Azure portal use GUID names (e.g., 76e670c5-eaf4-4674-8a48-2def9d37929c), making
them impossible to delete via CLI.

Steps To Reproduce

1. Create an AMR (Azure Managed Redis) instance
2. Create an access policy assignment via the Azure portal (generates a GUID name)
3. List assignments: az redisenterprise database access-policy-assignment list
   --resource-group --cluster-name --database-name default
4. Attempt to delete: az redisenterprise database access-policy-assignment delete
   --resource-group --cluster-name --database-name default
   --access-policy-assignment-name "76e670c5-eaf4-4674-8a48-2def9d37929c" --yes

Expected Behavior

The DELETE request is sent to ARM and the assignment is removed.

Actual Behavior

ERROR: InvalidArgumentValue: -n: Invalid format: '76e670c5-eaf4-4674-8a48-2def9d37929c'
does not fully match regular expression pattern '^[A-Za-z0-9]{1,60}$'

The request never reaches ARM — it is blocked by client-side input validation.

Root Cause (did not validate from CoPilot but seems right)

The validation happens in the CLI's argument formatter (_arg_fmt.py) before any HTTP request is made to ARM. The
request never reaches the server — it's a client-side regex that rejects hyphens.

The regex in the extension's argument formatter (
azext_redisenterprise/aaz/latest/redisenterprise/database/access_policy_assignment/_delete.py) does not permit
hyphens. The pattern should be updated to accept GUID-format names, e.g.:

^[A-Za-z0-9-]{1,60}$

or a full UUID pattern:

^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}$

Workaround

Use PowerShell:

Remove-AzRedisEnterpriseCacheAccessPolicyAssignment -ResourceGroupName <rg> -ClusterName <cluster> -DatabaseName default
-AccessPolicyAssignmentName "76e670c5-eaf4-4674-8a48-2def9d37929c"

Environment

• CLI version: Azure CLI with redisenterprise extension v1.4.0
• PowerShell module: Az.RedisEnterpriseCache v1.6.1 (works correctly)
• ARM API version: 2025-07-01
• OS: Windows

Related command

see description

Errors

File: azure/cli/core/aaz/_arg_fmt.py, line 56
AAZInvalidArgValueError: InvalidArgumentValue: -n: Invalid format:
'76e670c5-eaf4-4674-8a48-2def9d37929c' does not fully match regular
expression pattern '^[A-Za-z0-9]{1,60}$'

. Further details on the fix are in bug report but gist is regex for cli needs updating to accept hyphen

Issue script & Debug output

see description

Expected behavior

See description

Environment Summary

Environment

CLI version: Azure CLI with redisenterprise extension v1.4.0
PowerShell module: Az.RedisEnterpriseCache v1.6.1 (works correctly)
ARM API version: 2025-07-01
OS: Windows

Additional context

none

[yonzhan]

Thank you for opening this issue, we will look into it.

[a0x1ab]

Context for Copilot

Bug summary: The az redisenterprise database access-policy-assignment delete (and likely create/update) commands reject GUID-format --access-policy-assignment-name values (e.g. 76e670c5-eaf4-4674-8a48-2def9d37929c) because a client-side regex ^[A-Za-z0-9]{1,60}$ does not permit hyphens. Access policy assignments created through the Azure portal use GUID names, making them impossible to manage via the CLI.

Failing command:

az redisenterprise database access-policy-assignment delete   --resource-group <rg> --cluster-name <cluster> --database-name default   --access-policy-assignment-name "76e670c5-eaf4-4674-8a48-2def9d37929c" --yes

Error:

ERROR: InvalidArgumentValue: -n: Invalid format: '76e670c5-eaf4-4674-8a48-2def9d37929c'
does not fully match regular expression pattern '^[A-Za-z0-9]{1,60}$'

Root cause: Client-side regex validation in the redisenterprise AAZ-generated argument formatter(s) for the --access-policy-assignment-name parameter. The pattern ^[A-Za-z0-9]{1,60}$ must be updated to allow hyphens.

Files to fix (in the redisenterprise extension):

• src/redisenterprise/azext_redisenterprise/aaz/latest/redisenterprise/database/access_policy_assignment/_delete.py
• Also check _create.py, _update.py, _show.py, and any other command files under access_policy_assignment/ that use the same regex on --access-policy-assignment-name.

Suggested fix: Change the regex from ^[A-Za-z0-9]{1,60}$ to ^[A-Za-z0-9-]{1,60}$ (or a full UUID pattern) wherever --access-policy-assignment-name is validated in those files.

Affected extension: redisenterprise (v1.4.0), likely in azure/azure-cli-extensions repo. If this issue has been filed on the wrong repo, the fix should be applied to azure/azure-cli-extensions.

Testing: After the fix, az redisenterprise database access-policy-assignment delete with a GUID name should succeed and send the DELETE request to ARM.

---

Posted by agent-assist (autonomous bug-fix pipeline).