Issues with creating Windows function apps with secured storage

[websolut]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

v1.4.6

AzureRM Provider Version

3.87

Affected Resource(s)/Data Source(s)

azurerm_windows_function_app

Terraform Configuration Files

resource "azurerm_windows_function_app" "function_app" {

  name                          = var.function_name
  resource_group_name           = var.function_resource_group_name
  location                      = var.function_resource_group_location
  functions_extension_version   = var.function_extension_version
  service_plan_id               = var.function_plan_id
  storage_account_name          = var.function_sa_name
  storage_account_access_key    = var.function_sa_primary_access_key
  https_only                    = true
  virtual_network_subnet_id     = var.function_vnet_integration_subnet_id
  builtin_logging_enabled       = false  
  public_network_access_enabled = var.function_public_access_enabled
  site_config {
    http2_enabled                          = true
    always_on                              = true
    websockets_enabled                     = false
    application_insights_connection_string = var.function_application_insights_connection_string
    application_insights_key               = var.function_application_insights_key
    vnet_route_all_enabled                 = var.function_route_all_enabled
    application_stack {
      node_version                = var.function_node_version
      dotnet_version              = var.function_dotnet_version
      use_dotnet_isolated_runtime = var.function_use_dotnet_isolated_runtime
    }

    dynamic "cors" {
      for_each = var.function_cors[*]
      iterator = cors_iterator
      content {
        allowed_origins     = cors_iterator.value.allowed_origins
        support_credentials = cors_iterator.value.support_credentials
      }
    }
    
  }

  app_settings = local.app_settings_map

  dynamic "sticky_settings" {
    for_each = length(var.function_sticky_settings) > 0 ? [1] : []
    content {
      app_setting_names = var.function_sticky_settings
    }
  }

  identity {
    type = "SystemAssigned"
  }

  lifecycle {
    ignore_changes = [
      app_settings["WEBSITE_CONTENTSHARE"],
      app_settings["TaskHubName"],
      tags,
      app_settings["WEBSITE_RUN_FROM_PACKAGE"]
    ]
  }

}

Debug Output/Panic Output

Deployment is successful

Expected Behaviour

Function is fully functional

Actual Behaviour

Keys are not accessible
Kudu does not load

It seems that the current provider does meet requirements:

Specifically this value is false

    "vnetContentShareEnabled": false,

We do set the app setting WEBSITE_CONTENTOVERVNET=1

We verified that the storage account, share and private endpoints are created before the function.

Steps to Reproduce

No response

Important Factoids

No response

References

No response