Open cmergenthaler opened 10 months ago
@cmergenthaler Thanks for raising this issue. I've give it a try and I think the limitation is from the Azure REST API we are using here. If we try to give it an empty string, following error will be raised by API, therefore we enforce the string to be non-empty in AzureRM provider.
Error: validating the configuration for Private Endpoint (Subscription: "85b3dbca-5974-4067-9669-67a141095a76"
Resource Group Name: "acctestRG-privatelink-231130142151408020"
Private Endpoint Name: "acctest-privatelink-231130142151408020"): "private_service_connection":"acctestPLS-231130142151408020" is invalid, the "request_message" attribute must not be empty
I shall communicate with Azure CLI team and comment on this thread later.
Hi @cmergenthaler , I did some further digging about this issue. Since request_message
is an optional property. Although you could not create a manual connection by terraform without specifying request_message
but you should be able to import one created by CLI.
I create a private endpoint using following CLI command.
az network private-endpoint create -g yunliu-resources -n yunliu-endpoint --vnet-name yunliu-network --subnet yunliu-service --private-connection-resource-id "/subscriptions/xxx/resourceGroups/yunliu-resources/providers/Microsoft.Network/privateLinkServices/yunliu-privatelink" --manual-request t --connection-name yunliu-privateserviceconnection -l westeurope
And I successfully import it by
terraform import azurerm_private_endpoint.yunliu /subscriptions/xxx/resourceGroups/yunliu-resources/providers/Microsoft.Network/privateEndpoints/yunliu-endpoint
with adding following template to .tf file
resource "azurerm_private_endpoint" "yunliu" {
name = "yunliu-endpoint"
location = azurerm_resource_group.yunliu.location
resource_group_name = azurerm_resource_group.yunliu.name
subnet_id = azurerm_subnet.yunliu_service.id
private_service_connection {
name = "yunliu-privateserviceconnection"
private_connection_resource_id = azurerm_private_link_service.yunliu.id
is_manual_connection = true
}
}
Running terraform plan
to confirm no change.
No changes. Your infrastructure matches the configuration.
Full .tf config file I use
provider "azurerm" {
features {}
}
resource "azurerm_resource_group" "yunliu" {
name = "yunliu-resources"
location = "West Europe"
}
resource "azurerm_virtual_network" "yunliu" {
name = "yunliu-network"
address_space = ["10.0.0.0/16"]
location = azurerm_resource_group.yunliu.location
resource_group_name = azurerm_resource_group.yunliu.name
}
resource "azurerm_subnet" "yunliu_service" {
name = "yunliu-service"
resource_group_name = azurerm_resource_group.yunliu.name
virtual_network_name = azurerm_virtual_network.yunliu.name
address_prefixes = ["10.0.1.0/24"]
enforce_private_link_service_network_policies = true
}
resource "azurerm_subnet" "yunliu_endpoint" {
name = "yunliu-endpoint"
resource_group_name = azurerm_resource_group.yunliu.name
virtual_network_name = azurerm_virtual_network.yunliu.name
address_prefixes = ["10.0.2.0/24"]
enforce_private_link_endpoint_network_policies = true
}
resource "azurerm_public_ip" "yunliu" {
name = "yunliu-pip"
sku = "Standard"
location = azurerm_resource_group.yunliu.location
resource_group_name = azurerm_resource_group.yunliu.name
allocation_method = "Static"
}
resource "azurerm_lb" "yunliu" {
name = "yunliu-lb"
sku = "Standard"
location = azurerm_resource_group.yunliu.location
resource_group_name = azurerm_resource_group.yunliu.name
frontend_ip_configuration {
name = azurerm_public_ip.yunliu.name
public_ip_address_id = azurerm_public_ip.yunliu.id
}
}
resource "azurerm_private_link_service" "yunliu" {
name = "yunliu-privatelink"
location = azurerm_resource_group.yunliu.location
resource_group_name = azurerm_resource_group.yunliu.name
nat_ip_configuration {
name = azurerm_public_ip.yunliu.name
primary = true
subnet_id = azurerm_subnet.yunliu_service.id
}
load_balancer_frontend_ip_configuration_ids = [
azurerm_lb.yunliu.frontend_ip_configuration.0.id,
]
}
resource "azurerm_private_endpoint" "yunliu" {
name = "yunliu-endpoint"
location = azurerm_resource_group.yunliu.location
resource_group_name = azurerm_resource_group.yunliu.name
subnet_id = azurerm_subnet.yunliu_service.id
private_service_connection {
name = "yunliu-privateserviceconnection"
private_connection_resource_id = azurerm_private_link_service.yunliu.id
is_manual_connection = true
}
}
Hey @liuwuliuyun, thanks for checking out and sorry for my late response! Yes, you can import the previously created PE, and you also don't see any differences between terraform and infrastructure. But unfortunately your terraform script would be faulty when trying to setup the infrastructure from plain again. So you won't be able to provision the infrastructure by just applying the terraform script.
Hi @cmergenthaler, in general, if you would like to manage your infra using Terraform, it is not recommended to change managed infra using other tools.
So if you would like to create from plain, you could add any request_message
here so that it works. If you already made changes using cli and you do not want to change current infra. You are able to import this to Terrafrom using above command. I am not sure I understand your use case here.
The reason for AzureRM provider behaves differently with Azure CLI could be that we use different Azure REST API versions. AzureRM provider is using the lastest stable version 2023-06-01
here which does not allow empty request_message
.
As of 2024-06-12 (v3.107.0) this issue still happens; the issue arises in my case for manual private endpoints that I lack permission to approve and where I can't even see the resource group that they ultimately link to, which not an atypical scenario. In the Azure portal, I find I must create such endpoints by resource ID. I can't specify the resource group and navigate in.
Is there an existing issue for this?
Community Note
Description
The current azurerm provider implementation forbids creating a private endpoint without a
request_message
specified when settingis_manual_connection
to true . The fact that this is actually possible using the azure cli makes it hard to import an already existing resource as the provider does not allow applying the pe-resource again:private_service_connection:private-link is invalid, the "request_message" attribute must not be empty
New or Affected Resource(s)/Data Source(s)
azurerm_private_endpoint
Potential Terraform Configuration
References
No response