Adding key-values to Azure App Configuration using Bicep when Private Link enabled

[Daniel-Krzyczkowski]

Hi,

I encountered specific problem.
I deploy Azure App Configuration with Bicep. App Configuration has public access disabled because I want to use Private Link.
When I am trying to add key-values to App Configuration using Bicep, I receive information that access to the App Configuration is forbidden.
When I change public access to "Enabled", deployment works.
Do you know what it does not work when public access is disabled and Private Link is enabled? For instance for Azure Key Vault I am able to add secrets even when public access is disabled and Private Link is enabled.

I would be grateful for any hints because I am not sure if this is the issue with the service or it should just work like this.

[zhenlan]

Hi @Daniel-Krzyczkowski, this is a known limitation for either Bicep or ARM template deployment. Please see the note in the document that I quoted here:

App Configuration allows key-value data access over a private link from your virtual network. By default, when the feature is enabled, all requests for your App Configuration data over the public network are denied. Because the ARM template runs outside your virtual network, data access from an ARM template isn't allowed. To allow data access from an ARM template when a private link is used, you can enable public network access by using the following Azure CLI command. It's important to consider the security implications of enabling public network access in this scenario.

[Daniel-Krzyczkowski]

Thank you @zhenlan for a quick response! This was also my suspicion but I wanted to be sure.
Azure Key Vault can be accessed by ARM when public access is enabled but I suppose this is because it provides "NetworkRuleSet" and we can set its property called "bypass" to "AzureServices":
https://learn.microsoft.com/en-us/azure/templates/microsoft.keyvault/vaults?pivots=deployment-language-bicep#networkruleset

[drago-draganov]

@Daniel-Krzyczkowski
Bypass for ARM/Biceps pretty much means public network access. As @zhenlan mentioned above, ARM templates allow to read and write AppConfiguration key-values. That basically translates to proxy calls from a public network. That is the reason for AppConfiguration to be explicit on calling it out, since it goes outside of the promise of Private Link isolation.

[Daniel-Krzyczkowski]

Thank you so much for the answers, all clear now!

[jimmyca15]

Looks like this has been answered. Feel free to reach out again if there are any other questions.

[brazarb]

So what's the recommended way of handling this when using Private Link isolation?

Currently we use a dedicated host that has access to the resources, and az cli to import the json file kvset into app configuration.

However this is painful to maintain, we have 5 different environments, so 5 different .json files to maintain and is error prone, a couple of weeks ago this caused massive pain, we were adding a app configuration key vault reference which didn't exist, the error message when running the arm-deploy action didn't explicitly mention that and we spent hours trying to figure out what was wrong.

[Daniel-Krzyczkowski]

I ended up with the solution where I change the publicNetworkAccess property of the App Configuration to true when I want to update the values from the automation scripts. Once it is done I disable the public network access.
However it would be great to have it covered by Resource Manager like for the Azure Key Vault as I explained above.

[drago-draganov]

Thank you @brazarb and @Daniel-Krzyczkowski for our valuable inputs.

Let me start by noting that allowing to bypass Private Link constraints comes with non-trivial security risks. That also includes exceptions for any Azure Services.
Saying that we understand that there is an urgent need for ARM template scenarios and Private Link resource isolation. Needless to say, that the current situation is far from ideal.
We are in early stages of developing a mechanism to ensure full Private Link support for access via ARM and direct access, without any exceptions, without the need for public access, without compromises. Unfortunately, I don't have a specific ETA at this point in time.

[Daniel-Krzyczkowski]

@drago-draganov Thank you so much for the answer. Great to know that this problem is taken under consideration to be solved in the future.

[hahahahahaiyiwen]

The feature to support adding key-values using Bicep/ARM template to an App Configuration store that's behind a private endpoint is GA'ed.

The feature requires the setup of "Resource management private links" resource as a prerequisite. Please see this for how to create private links for managing azure resources

After that, on App Configuration side, you also need to activate the pass-through authentication mode and grant your deployment identity with App Configuration data plane roles (such as 'App Configuration Data Owner' for read and write key values)