Issue with azurerm_api_management_api_policy for WebSocket API

[gogo25171]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Issue Description:
I am encountering a problem while attempting to apply policies using the azurerm_api_management_api_policy resource in Terraform for a WebSocket API. The error message I am receiving is:
unexpected status 400 with error: ValidationError: Not allowed at 'Api' scope for 'WEBSOCKET' api type
It's worth noting that I can successfully apply the policy using the HTTPS endpoint, and when applying the policy directly through the Azure portal interface, it works without any issues.

Question:
Is there a different approach or specific considerations when applying policies for WebSocket APIs in Terraform, compared to HTTP APIs?

Additional Information:
Terraform Version: required_version = ">= 1.1.3"
Azure Provider Version: version = ">= 3.85.0"

Expected Behavior:
The policy should be applied successfully for WebSocket APIs using Terraform.

Additional Context:

• Using HTTPS endpoint works without any issues.
• Applying the policy directly through the Azure portal interface is successful.
  Any insights or guidance on the correct approach for applying policies to WebSocket APIs in Terraform would be greatly appreciated. Thank you!

Terraform Version

= 1.1.3

AzureRM Provider Version

3.87.0

Affected Resource(s)/Data Source(s)

azurerm_api_management_api_policy

Terraform Configuration Files

resource "azurerm_api_management_api" "api-speech" {
  name                = var.api_speech.name
  resource_group_name = var.apim.resource_group_name
  api_management_name = var.apim.name
  revision            = "1"
  display_name        = var.api_speech.display_name
  path                = var.api_speech.path
  protocols           = ["wss"]
  api_type            = "websocket"
  service_url         = "wss://myressource.cognitiveservices.azure.com/tts/cognitiveservices/websocket/v1"
  subscription_key_parameter_names {
    header = var.api_speech.subscription_key_parameter_header
    query = var.api_speech.subscription_key_parameter_query
  }
}

resource "azurerm_api_management_api_policy" "policy-speech-text" {
api_name            = "Test-speech-to-text"
api_management_name = "Name-API"
resource_group_name = "Name-RG-GROUPE"
xml_content = .....

}

Debug Output/Panic Output

unexpected status 400 with error: ValidationError: Not allowed at 'Api' scope for 'WEBSOCKET' api type

Expected Behaviour

No response

Actual Behaviour

No response

Steps to Reproduce

• Apply the policy using azurerm_api_management_api_policy for a WebSocket API.
• Observe the unexpected 400 status with the mentioned error.

Important Factoids

No response

References

No response

[rcskosir]

Thank you for taking the time to raise this! We use Issues in this repository to track feature enhancements and bugs in the Azure Provider. So that we can maintain focus on that, we instead ask that broader questions are raised using one of the Community Resources, such as the Azure Provider forum. With that in mind, I'm going to close this issue.

[FelipeEmerim]

Just for the record. Using the resource azurerm_api_management_api_operation_policy and passing 'onHandshake' on the operation_id field will achieve the result you want using terraform

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.