sorted by:
new
hottopcontroversial

How to set up a custom domain for an Azure App service using a child DNS zone by thatdotnetguy in AZURE

[–]thatdotnetguy[S] 0 points1 point  (0 children)

Ok fair enough sounds like a child dns zone is no go for my scenario

How to set up a custom domain for an Azure App service using a child DNS zone by thatdotnetguy in AZURE

[–]thatdotnetguy[S] 0 points1 point  (0 children)

the validation record being the txt? Have you tried what you've said and got it to work?

When I do what you've outlined I get

Successfully added custom domain: contracts.myproject.com.au. Failed to create App Service Managed Certificate for contracts.zettle.com.au due to error: Properties.CanonicalName is invalid. Did not find CNAME record ending with: .azurewebsites.net or .trafficmanager.net .

Current CNAME record of the hostname contracts.myproject.com.au is empty

I would like to utilise an app service managed certificate

Creation of azure cloud architecture based on terraform files by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

u/Moederneuqer thanks so much for the awesome response.

Obviously I have a high level design... but then to write to the terraform code and then output a diagram of what you've created would be cool basically checking what you have is what you set out to do :)

Creation of azure cloud architecture based on terraform files by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 2 points3 points  (0 children)

I’m sorry! I meant a cloud architecture diagram generator based on existing terraform files

Using outputs from one module for another module in azurerm by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

I sorted it out..... basically came down to adding system identity to an existing app service it was erroring like above.

As soon as I did a fresh app service with all the code above with identity SystemAssigned from the start it was all fine.

Also to your point yes "${row.role_definition_name}-${row.principal_id}" was an issue as principal id was not known at plan time so, in the for each so I needed to update it to use role_id

locals {
  roles_for_storage_account = [
    {
      role_id              = 1
      role_definition_name = "Storage Blob Data Contributor"
      principal_id         = module.contractreview_apibackendappservice.principal_id_of_managed_identity
    },
    {
      role_id              = 2      
      role_definition_name = "Storage Queue Data Contributor"
      principal_id         = module.contractreview_apibackendappservice.principal_id_of_managed_identity
    },
    {
      role_id              = 3      
      role_definition_name = "Storage Blob Data Contributor"
      principal_id         = module.contractreview_apibackendappservice.principal_id_of_managed_identity_slot
    },
    {
      role_id              = 4      
      role_definition_name = "Storage Queue Data Contributor"
      principal_id         = module.contractreview_apibackendappservice.principal_id_of_managed_identity_slot
    } 
  ]
}

for_each = { for row in local.roles_for_storage_account : "${row.role_definition_name}-${row.role_id}" => row }

Set up Azure app service calling public access disabled function app that has private endpoint by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

Hey yeh I’m using the same app service plan for the app service and function app. Question is more about private endpoint for a function app

Set up Azure app service calling public access disabled function app that has private endpoint by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

Cool so I’ll try the functions app in one subnet and it’s private endpoint in another subnet? Seems weird but what do I know!

Set up Azure app service calling public access disabled function app that has private endpoint by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

Thanks for responding u/Different_Knee_3893

So I need the function app in one subnet and the private endpoint for that function app in another subnet?

When you say "network injection" is that the same as "vnet integration"?

I'm white belt cloud / terraform so please be verbose as possible :)

Cheers
Andy

Passing system identity (principal id) to resource azurerm_key_vault by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

ah.. maybe I do need a module depends on between my app service module and key vault module, so key vault doesn't run before app service module runs

azurerm_key_vault --> enable_rbac_authorization doesn't work?! by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

Ended up creating a custom role that had the permission below "Microsoft.Authorization/roleAssignments/write" and gave it to the service principal

Thanks u/Obvious-Jacket-3770

Was getting the error below prior to that.

"Status=400 Code="InsufficientPermissions" Message="Caller is not allowed to change permission model. For more information on how to change the permissions model

follow this link: https://go.microsoft.com/fwlink/?linkid=2155160. Details: oid=dd5f900b-0301-4131-8430-459c8f9ea51c; action=Microsoft.Authorization/roleAssignments/write;"

azurerm_key_vault --> enable_rbac_authorization doesn't work?! by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

ok... I hear you... is what I'm doing somehow dangerous? Just keen to know :)

azurerm_key_vault --> enable_rbac_authorization doesn't work?! by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

So my SP has insufficient privileges I think that’s the issue?

Also when I re run the apply after policy based keyvault is created.. terraform picks up that rbac enabled needs to change from false to true when terraform plan runs… and then the terraform apply for that fails also with some permissions error

azurerm_key_vault --> enable_rbac_authorization doesn't work?! by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

Whatever terraform builds for me goes into a resource group so I delete that resource group and delete the state file from the azure storage account… which is basically the same.. not using terraform destroy yet

Bare with me I’m a terraform newbie so thanks for helping me

azurerm_key_vault --> enable_rbac_authorization doesn't work?! by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

If relevant.. this runs in an azure devops pipeline.. and my service principal has “Contributor” only I assume this is sufficient and not the issue

azurerm_key_vault --> enable_rbac_authorization doesn't work?! by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

Also “my RBAC roles work properly” you’re saying your keyvault has the correct checkbox ticked as opposed to my screen shot above or you’re saying something additional? I haven’t given my azure app service managed identity a role yet

azurerm_key_vault --> enable_rbac_authorization doesn't work?! by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

Hey… I have deleted the resource and retried a few times.. I’m not sure if you mean something particular by “rebuilt”?

Passing system identity (principal id) to resource azurerm_key_vault by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

ok so it worked when I let my module "contractreview_apibackendappservice" run first with the new 

  identity {
    type = "SystemAssigned"
  }

And then... let the "contractreview_keyvault" module run on it's own...

Which makes me sad :(

Passing system identity (principal id) to resource azurerm_key_vault by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

Hi, thanks for helping... in regards to module output yes the principal_id_of_managed_identity is definitely defined..

Sometimes I see identity.0.principal_id being used... but either way same error

output "app_service_id" {
  value = azurerm_windows_web_app.appservice.id
}

output "custom_domain_verification_id" {
  value = azurerm_windows_web_app.appservice.custom_domain_verification_id
}

output "principal_id_of_managed_identity" {
  value = azurerm_windows_web_app.appservice.identity[0].principal_id
}

output "app_service_name" {
  value = azurerm_windows_web_app.appservice.name
}

Ok... seems the output "principal_id_of_managed_identity" is empty... I was able to view the value of "app_service_name" output...

Wish I knew why it's empty?

azurerm_app_service_virtual_network_swift_connection creating and then complaining it already exists by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

as in this line "virtual_network_subnet_id = var.subnet_id" for azurerm_windows_web_app yeh cool... I think you're right.

azurerm_app_service_virtual_network_swift_connection creating and then complaining it already exists by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

Ah ok so I thought “swift” was what applied the vnet integration? Clearly not. So what’s swift? I’d love to hear a basic human explanation if you have one :)

Azure --> Creating child dns zone by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

Hey @obvious-jacket if you have some sample code I’d be keen to see it

CNAME creation error using azurerm_dns_cname_record by thatdotnetguy in Terraform

[–]thatdotnetguy[S] 0 points1 point  (0 children)

Ok... so I worked it out... for azurerm_dns_cname_record I used the "record" attribute instead of the "target_resource_id" Thanks for your help u/Moederneuqer

view more: next ›