Origin Group Missing Issue on first deployment of Front Door Standard/Premium

[david-parsonson]

Bicep version Bicep version 0.22.6 (windows-latest azure devops hosted pipelines)

Describe the bug When deploying Standard/Premium Front Door instance through bicep I am commonly running into the following error "Please make sure that the originGroup is created successfully and at least one enabled origin is created under the origin group." when deploying a new front door. Following this error being seen a redeploy of the same template results in a successful deployment of front door. This appears to be an issue with front door bicep not waiting for origin groups to be created even though the dependancy tree should know too. I've tried to use explicit dependancy calls with the same result so it doesn't appear to me to be a case of the dependancy between origin group and endpoint missing but rather azure thinks it has completed successfully when it hasn't. Finally I do not see consistent results when deploying the same bicep file, sometimes it will deploy on first attempt without issue and sometimes only some of the endpoints will fail to associate with origin groups.

To Reproduce Using the following bicep attempt to deploy a new front door from scratch:

/*
  Front Door resources module
*/

// parameters
@description('Deployment environment')
param environment string 

@description('Azure Front Door name')
param frontDoorName string

@description('Azure Front Door SKU')
param frontDoorSku string

@description('B2C tenant Name')
param b2cTenantName string

@description('Function App Name')
param functionAppName string

var originGroups = '[{"groupName": "b2c-origin-group","name": "b2c-origin","hostName": "${b2cTenantName}.b2clogin.com"}, {"groupName": "function-origin-group","name": "function-origin","hostName": "${functionAppName}.azurewebsites.net"}]'

// resource definitions
resource frontDoor 'Microsoft.Cdn/profiles@2021-06-01' = {
  name: frontDoorName
  location: 'Global'
  sku: {
    name: frontDoorSku
  }
  properties: {
    originResponseTimeoutSeconds: 60
  }
}

resource afdEndpoint 'Microsoft.Cdn/profiles/afdendpoints@2021-06-01' = {
  parent: frontDoor
  name: 'b2c${environment}'
  location: 'Global'
  properties: {
    enabledState: 'Enabled'
  }
}

resource b2cEndpointRoute 'Microsoft.Cdn/profiles/afdendpoints/routes@2021-06-01' = {
  parent: afdEndpoint
  name: 'b2c-route'
  properties: {
    customDomains: []
    originGroup: {
      id: originGroup[0].id
    }
    ruleSets: []
    supportedProtocols: [
      'Http'
      'Https'
    ]
    patternsToMatch: [
      '/*'
    ]
    forwardingProtocol: 'MatchRequest'
    linkToDefaultDomain: 'Enabled'
    httpsRedirect: 'Enabled'
    enabledState: 'Enabled'
  }
}

resource originGroup 'Microsoft.Cdn/profiles/origingroups@2021-06-01' = [for origin in json(originGroups): {
  parent: frontDoor
  name: origin.groupName
  properties: {
    loadBalancingSettings: {
      sampleSize: 4
      successfulSamplesRequired: 3
      additionalLatencyInMilliseconds: 50
    }
    healthProbeSettings: {
      probePath: '/'
      probeRequestType: 'HEAD'
      probeProtocol: 'Http'
      probeIntervalInSeconds: 100
    }
    sessionAffinityState: 'Disabled'
  }
}]

resource originGroupOrigin 'Microsoft.Cdn/profiles/origingroups/origins@2021-06-01' = [for (origin, index) in json(originGroups): {
  parent: originGroup[index]
  name: origin.name
  properties: {
    hostName: origin.hostName
    httpPort: 80
    httpsPort: 443
    originHostHeader: origin.hostName
    priority: 1
    weight: 1000
    enabledState: 'Enabled'
    enforceCertificateNameCheck: true
  }
}]

output frontDoorName string = frontDoorName
output afdEndpointId string = afdEndpoint.id
output frontDoorId string = frontDoor.properties.frontDoorId

Note that on first deployment the front door will at times fail to deploy.

Additional context This is parter of a larger set of bicep templates which also fill the role of deploying the function app mentioned in this template, as well as similar situations for other azure resources such as web apps or storage accounts. Given at times these resources may not be deployed before the front door I'm curious as to whether the origin.hostName dns not yet existing could play a role. I wouldn't think so as there is no validation of hostnames in front door itself but this felt like relevant context to mention.

[alex-frankel]

Agreed that the CDN RP is reporting a resource as completed too quickly. I'd recommend opening up a support case for this one and have it routed to the CDN team.

[anthony-c-martin]

@david-parsonson if I open your Bicep file in the Bicep Visualizer, I see the following:

However the error seems to indicate that it's not enough to just wait for the originGroup to be created - that you additionally need to introduce a dependency on one of the origins:

Please make sure that the originGroup is created successfully and at least one enabled origin is created under the origin group

Could you try introducing an explicit dependsOn to ensure that the routes resource is only deployed after the origins resources?

resource b2cEndpointRoute 'Microsoft.Cdn/profiles/afdendpoints/routes@2021-06-01' = {
  parent: afdEndpoint
  name: 'b2c-route'
  properties: {
    customDomains: []
    originGroup: {
      id: originGroup[0].id
    }
    ruleSets: []
    supportedProtocols: [
      'Http'
      'Https'
    ]
    patternsToMatch: [
      '/*'
    ]
    forwardingProtocol: 'MatchRequest'
    linkToDefaultDomain: 'Enabled'
    httpsRedirect: 'Enabled'
    enabledState: 'Enabled'
  }
  dependsOn: [ originGroupOrigin ]
}

After making this change, I now see the following in the Visualizer:

[jurjen74]

I had exactly the same issue. Adding the dependsOn fixed the error for me.

[microsoft-github-policy-service[bot]]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @t-bzhan, @gxue. Please see https://aka.ms/biceptypesinfo for troubleshooting help.