Open donjuanmon opened 1 month ago
Thanks @donjuanmon for raising this issue, I don't see the required field private_connection_resource_id
or private_connection_resource_alias
is specified in your private_service_connection
block
doc reference:https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/private_endpoint#private_connection_resource_id
Besides of the required field, have you tried to use app service id as the private_connection_resource_id
as below example? The PE can be created without any issue by specifying the private_connection_resource_id
+ subresource_names=["sites-xiaxintestWAS-app-pe"]
private_service_connection {
name = "xiaxintest-pe-connection"
subresource_names = ["sites-xiaxintestWAS-app-pe"]
is_manual_connection = false
private_connection_resource_id = azurerm_linux_web_app.test.id
}
Let me know if you have any further questions.
Hey @xiaxyi,
Apologies, I must have removed private_connection_serouce_id when cleaning up extra comments. Here is the full code block I have been using in a web_app_slot module:
resource "azurerm_private_endpoint" "web_app_slot" {
count = var.enable_private_endpoint ? 1 : 0
name = azurecaf_name.web_app_slot_private_endpoint[0].result
location = var.location
resource_group_name = var.resource_group_name
subnet_id = var.private_endpoint_subnet_id
private_service_connection {
name = azurecaf_name.web_app_slot_private_endpoint[0].results["azurerm_private_service_connection"]
private_connection_resource_id = var.app_service_id
subresource_names = ["sites-${var.slot_name}"]
is_manual_connection = false
}
private_dns_zone_group {
name = azurecaf_name.web_app_slot_private_endpoint[0].results["azurerm_private_dns_zone_group"]
private_dns_zone_ids = [
var.privatelink_web_site_private_dns_zone_id
]
}
}
I have confirmed this fails on azurerm provider versions 3.108.0 and greater repeatedly. Can you share what version of the provider you are using?
@donjuanmon I used 3.111.0, but the PE can still be created even if I switched to 3.108.0
Is the failure always happening or intermittently?
Hey @xiaxyi, failure is always happening. We use Terratest to validate our Azure modules and the only solution that works 100% of the time is pinning to 3.107 or lower. Happy to share more debug information with you. Can you confirm which version of Terraform you are using?
Hi @donjuanmon. Try to add dependency (dependsOn) on slot to private endpoint. Seems Terraform wants to create PE when the slot is not built yet.
resource "azurerm_private_endpoint" "web_app_slot" {
[....]
depends_on = [
azurerm_linux_function_app_slot.slot
]
}
Is there an existing issue for this?
Community Note
Terraform Version
1.8.5
AzureRM Provider Version
>=3.108.0
Affected Resource(s)/Data Source(s)
azurerm_private_endpoint
Terraform Configuration Files
Debug Output/Panic Output
Expected Behaviour
In <=3.107.0, the working solution was to use
subresource_names = ["sites-slotname"]
as pointed out by https://github.com/hashicorp/terraform-provider-azurerm/issues/17551 and Microsofts own documentation: https://learn.microsoft.com/en-us/azure/app-service/overview-private-endpoint#conceptual-overviewActual Behaviour
In AzureRM >=3.108.0, terraform apply fails with:
Changing subresource_names to singulare
["sites"]
fixes the problem, but I don't see this documented anywhere. Wondering if this was changed with serviceconnector PR?Steps to Reproduce
Use
subresource_names = ["sites-<slot_name>"]
Pin azurerm provider to >=3.108.0 and try to create a Private Endpoint for a web app slot. Fails with:Setting
subresource_names = ["sites"]
fixes issue, but this is not documented anywhere.Important Factoids
N/A
References
https://github.com/hashicorp/terraform-provider-azurerm/issues/17551
https://learn.microsoft.com/en-us/azure/app-service/overview-private-endpoint#conceptual-overview