azd up hangs on importing api definitions

[jharbieh]

Please provide us with the following information:

This issue is for a: (mark with an x)

- [x] bug report -> please search issues before submitting
- [ ] feature request
- [ ] documentation issue or request
- [ ] regression (a behavior that used to work and stopped in a new release)

Minimal steps to reproduce

Fork repo Clone to local machine azd auth login az login azd up

Any log messages given by the failure

No failure messages. Simply hang for a very long time and does not complete. 19 total resources provision successfully including APIC and APIM. APIC has 3 APIs. APIM has 1. An Entra ID app registration exists without a corresponding principal. Also noticed that the APIC portal has deployed however, when signing on to it, no APIs show up.

Expected/desired behavior

azd up completes and user has access to APIC portal APIs, then exercises the APIC analyzer feature.

OS and Version?

Windows 10 Pro for Workstations. Version 10.0.19045

Versions

PowerShell 7.4.3, AZ 2.46.0, ACD 1.9.5

Mention any other details that might be useful

I attempted this multiple times.

---

Thanks! We'll be in touch soon.

[justinyoo]

Thanks @jharbieh we'll reproduce the error on our end.

[justinyoo]

@jharbieh I wasn't able to reproduce the same error. Have you tried again after that?

[jharbieh]

Hey @justinyoo I did on 3 tenants. 2 of them stuck on API import as shown above. The 3rd tenant did not, however, it did not import the API. I assume it was trying to import the APIM USPTO API definition from APIM into APIC. API Center still had 3 APIs. It did actually give me a message. What I can do is azd down and then up and see if I get the message again.

[jharbieh]

Hi @justinyoo Just did and had two different outputs. The latter it seems to be a mismatch in the cli command to import an API.

[justinyoo]

@jharbieh There have been recent updates on the sample

• The former will disappear with the latest az apic-extension. Would you please update your az CLI to the latest? az upgrade --allow-preview true
• The latter happens with the role assignment. Does your account have enough permissions to assign roles?

[jharbieh]

Thanks @justinyoo Just ran the CLI upgrade. It seems to have the latest. I will re-do and report back.

As far as permissions, I will run this on another tenant where I am Global Admin and report back. I am a Subscription Owner on where I am trying this out.

Thanks!

[jharbieh]

Hi @justinyoo I redeployed the reference repo using a Global Administrator account in Entra. The Import API part worked. USPTO API was imported from APIM successfully. Prior to azd up, I made sure the AZ CLI and APIC-Extension are updated.

Other than the need to be a Global Admin for the deployment, we should be good to go here.

Thoughts?

Thanks!

[justinyoo]

Because you should have permissions to run this command:

https://github.com/Azure-Samples/APICenter-Reference/blob/1f7e1fb7fd1b7e17e579e1b81ffc71d98b7794f7/infra/hooks/postprovision.ps1#L46-L49

I think you should have either "Application Administrator" or "Application Developer" role. The "Application Admin" role can update apps generated by others while the "App Dev" role is only able to update the app generated by themselves.

[justinyoo]

I confirm that, given that I've only got the "application developer" role, I was successfully able to run azd up with no issue.

[jharbieh]

Thanks @justinyoo great to know! Thanks for looking into this and confirming RBAC role required for the command.