azurerm_function_app_flex_consumption examples are not working

[Soeren-WBS]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Bug Report: Issues with azurerm_function_app_flex_consumption

Issues Encountered

Incorrect Storage Container Endpoint Configuration

The storage_container_endpoint is incorrectly configured, causing an error when deploying, however this example works ${azurerm_storage_account.example.primary_blob_endpoint}/example-flexcontainer

Storage Account Name Length Exceeds Limit

The example uses azurerm_storage_account with the name examplelinuxfunctionappsa, which exceeds the character limit for storage account names.

Missing Attribute

The service_plan_id and site_config attribute is missing, which is required for proper configuration.

https_only Configuration Error

Setting https_only throws an error indicating it is not supported, although it should be supported. There is allready a bug for this. #29000

storage_authentication_type Issue

When setting storage_authentication_type to systemassignedidentity and it is deployed to azure functions, functions do not work. However, this setting works when configured via the Azure client.

location

Is set to West Europe, which is not provided by azure for flex consumption plan

Terraform Version

1.11.1

AzureRM Provider Version

4.21.1

Affected Resource(s)/Data Source(s)

azurerm_function_app_flex_consumption

Terraform Configuration Files

resource "azurerm_function_app_flex_consumption" "function_app_flex" {
  name                        = "${var.project_name}-${var.environment}-flex-function-app"
  service_plan_id             = azurerm_service_plan.service_plan.id
  resource_group_name         = data.azurerm_resource_group.resource_group.name
  location                    = "northeurope"
  storage_container_type      = "blobContainer"
  storage_container_endpoint  = "${azurerm_storage_account.example.primary_blob_endpoint}deployment-package"
  storage_authentication_type = "StorageAccountConnectionString" # system assigned managed 
  storage_access_key          = azurerm_storage_account.storage_account_function_app_flex.primary_access_key
  runtime_name                = "dotnet-isolated"
  runtime_version             = "8.0"
  maximum_instance_count      = 100
  instance_memory_in_mb       = 2048
  tags                        = local.tags
  virtual_network_subnet_id   = azurerm_subnet.example.id

  identity {
    type = "SystemAssigned"
  }
  site_config {
  } 
}

Debug Output/Panic Output

See above.

Expected Behaviour

No response

Actual Behaviour

No response

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[xiaxyi]

Thanks @Soeren-WBS for raising the issue, let me summarize the issues that you were listed:

1. The example of storage_container_endpoint is not working. The correction of the example is included in the azurerm_function_app_flex_consumption - update doc and test cases #28939.
2. A list of properties such as https_only are not supported but appeared in the docs. The correction is also included in the azurerm_function_app_flex_consumption - update doc and test cases #28939
3. The storage_authentication_type doc error. The correction is covered in Docs: update storage_authentication_type values to required casing #28972

There are some ongoing improvements to the flex consumption app:

1. adding https_only property -> see azurerm_function_app_flex_consumption - add https_only #29024
2. adding always_ready_config -> see azurerm_function_app_flex_consumption - add always_ready #29023
3. adding key_vault_refrence_id -> code is in progress, I will update once the PR is ready

Let me know if you have any other questions.

[garinevans-scotw]

Hi @Soeren-WBS @xiaxyi - it's partially related but I've also noticed that our Flex Function Apps are no longer logging to App Insights since around 20th February - rather oddly it seems to have coincided with all our Logic Apps failing to log, which was due to the App Insights Instrumentation Key finally being deprecated in the config. Shifting all the Logic Apps to use Connection String instead solved that, but our Flex Apps are still not working. It seems a strange coincidence and I wonder whether Microsoft have changed something. Have you had any similar experiences with them failing to log?

[Soeren-WBS]

Hi @xiaxyi, thanks for your response. I miss in the summary following issue, that setting storage_authentication_type set to SystemAssignedIdentity breaks azure functions. The raised issue #28972 only covers that the properties are in lower case, which raises an error.

[david-haugh]

@garinevans-scotw Mine have also all stopped logging. I would expect to be able to configure

  site_config {
    application_insights_connection_string = azurerm_application_insights.fn.connection_string
    application_insights_key               = azurerm_application_insights.fn.instrumentation_key

and it should log as expected.

[xiaxyi]

@Soeren-WBS Did you grant the required storage role when using system managed identity? It works fine in my environment, can you double check? Thanks

[zspasev-fr]

https://learn.microsoft.com/en-us/azure/azure-functions/functions-identity-based-connections-tutorial#grant-the-system-assigned-identity-access-to-the-storage-account

you have to assign a role to the storage account with permissions Storage Blob Data Owner in order to use system managed identity as authentication type on the flex function

[Soeren-WBS]

Thanks guys for your response i retestet it and it works, but i did added the storage blob data owner, maybe it was an issue with the other properties. Anyway here is my example, which works, including key vault and an sql database.

# DATA
#########################################################################

data "azurerm_resource_group" "resource_group" {
  name = var.resource_group_name
}

data "azurerm_client_config" "current" {}

# LOCALS
#########################################################################

locals {
  tags = {
    environment = var.environment
    project     = var.project_name
  }
  location      = data.azurerm_resource_group.resource_group.location
}

##
# VNet
##

# Create a Virtual Network
resource "azurerm_virtual_network" "vnet" {
  name                = "${var.project_name}-${var.environment}-vnet"
  location            = local.location
  resource_group_name = data.azurerm_resource_group.resource_group.name
  address_space       = ["10.0.0.0/16"]
  tags                = local.tags
}

# Create a Subnet within the VNet
resource "azurerm_subnet" "subnet" {
  name                 = "${var.project_name}-${var.environment}-private-subnet"
  resource_group_name  = data.azurerm_resource_group.resource_group.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = ["10.0.1.0/24"]

  # Delegate the subnet to "Microsoft.App/environments"
  delegation {
    name = "${var.project_name}-${var.environment}-private-subnet-flex-delegation"

    service_delegation {
      name    = "Microsoft.App/environments"
      actions = ["Microsoft.Network/virtualNetworks/subnets/join/action"]
    }
  }

  # Enable service endpoints for SQL and Storage
  service_endpoints = ["Microsoft.Sql", "Microsoft.Storage", "Microsoft.KeyVault", "Microsoft.Web"]
}

##
# SQL
##

resource "azurerm_mssql_server" "sql_server" {
  name                         = "${var.project_name}-${var.environment}-sql-server"
  location                     = local.location
  resource_group_name          = data.azurerm_resource_group.resource_group.name
  version                      = "12.0"
  administrator_login          = "${var.project_name}-${var.environment}-sql-user-admin"
  administrator_login_password = var.SQL_SERVER_ADMIN_PASSWORD
  tags                         = local.tags

  azuread_administrator {
    azuread_authentication_only = true
    login_username              = var.contributor_group
    object_id                   = var.contributor_group_object_id
  }

  lifecycle {
    ignore_changes = [
      administrator_login_password
    ]
  }
}

# Configure firewall rules for SQL Server to allow VNet access
resource "azurerm_mssql_virtual_network_rule" "vnet_rule" {
  name      = "${var.project_name}-${var.environment}-sql-vnet-rule"
  server_id = azurerm_mssql_server.sql_server.id
  subnet_id = azurerm_subnet.subnet.id
}

resource "azurerm_mssql_database" "sql_database" {
  name                 = "${var.project_name}-${var.environment}-sql-database"
  server_id            = azurerm_mssql_server.sql_server.id
  storage_account_type = "Local"
  tags                 = local.tags
  sku_name             = var.sql_plan_sku
}

##
# Functions App Flex Consumption Plan
##

# Storage account for the function app
resource "azurerm_storage_account" "storage_account_function_app_flex" {
  account_replication_type = var.replication_type
  account_kind             = "StorageV2"
  account_tier             = "Standard"
  name                     = "${var.project_name}${var.environment}flexfunctionappsa"
  location                 = local.location
  resource_group_name      = data.azurerm_resource_group.resource_group.name
  tags                     = local.tags

  network_rules {
    default_action             = "Deny"
    virtual_network_subnet_ids = [azurerm_subnet.subnet.id]
  }
}

# Storage container for the function app
resource "azurerm_storage_container" "flex_function_app_container" {
  name                  = "deployment-package"
  storage_account_id    = azurerm_storage_account.storage_account_function_app_flex.id
  container_access_type = "private"
}

# Azure Service Plan for the Function App
resource "azurerm_service_plan" "service_plan" {
  name                = "${var.project_name}-${var.environment}-function-app-flex-service-plan"
  location            = local.location
  resource_group_name = data.azurerm_resource_group.resource_group.name
  os_type             = "Linux"
  sku_name            = "FC1"
  tags                = local.tags
}

# Function App

resource "azurerm_function_app_flex_consumption" "function_app_flex" {
  name                        = "${var.project_name}-${var.environment}-flex-function-app"
  service_plan_id             = azurerm_service_plan.service_plan.id
  resource_group_name         = data.azurerm_resource_group.resource_group.name
  location                    = local.location
  storage_container_type      = "blobContainer"
  storage_container_endpoint  = "${azurerm_storage_account.storage_account_function_app_flex.primary_blob_endpoint}deployment-package"
  storage_authentication_type = "SystemAssignedIdentity"
  runtime_name                = "dotnet-isolated"
  runtime_version             = "8.0"
  maximum_instance_count      = 100
  instance_memory_in_mb       = 2048
  tags                        = local.tags
  virtual_network_subnet_id   = azurerm_subnet.subnet.id

  public_network_access_enabled = true ## might set to false for private access

  identity {
    type = "SystemAssigned"
  }
  site_config {
  }

  connection_string {
    name  = var.sql_database_connection_string_key
    type  = "SQLServer"
    value = "Server=${azurerm_mssql_server.sql_server.fully_qualified_domain_name},1433;Database=${azurerm_mssql_database.sql_database.name};Authentication=Active Directory Managed Identity;Encrypt=True;TrustServerCertificate=False;Connection Timeout=30;"
  }
}

# Assign the Storage Blob Data Owner role to the function app
resource "azurerm_role_assignment" "storage_roleassignment" {
  scope                = azurerm_storage_account.storage_account_function_app_flex.id
  role_definition_name = "Storage Blob Data Owner"
  principal_id         = azurerm_function_app_flex_consumption.function_app_flex.identity.0.principal_id
}


##
# Key Vault
##

resource "azurerm_key_vault" "key_vault" {
  name                = "${var.project_name}-${var.environment}-key-vault"
  location            = local.location
  resource_group_name = data.azurerm_resource_group.resource_group.name
  tenant_id           = data.azurerm_client_config.current.tenant_id
  sku_name            = "standard"
  tags                = local.tags

  network_acls {
    default_action = "Deny"
    bypass         = "None"

    virtual_network_subnet_ids = [azurerm_subnet.subnet.id]
    ip_rules                   = [var.azure_function_app_custom_domain_ip]
  }

  # Assign the managed identity of the function app access to the Key Vault
  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = azurerm_function_app_flex_consumption.function_app_flex.identity.0.principal_id

    secret_permissions = ["Get", "List"]
    key_permissions    = ["Get", "List"]
  }

  # Add the user from the Contributor Group as an admin
  access_policy {
    tenant_id = data.azurerm_client_config.current.tenant_id
    object_id = var.contributor_group_object_id

    secret_permissions = [
      "Get", "List", "Set", "Delete", "Recover", "Backup", "Restore"
    ]
    key_permissions = [
      "Get", "List", "Create", "Delete", "Recover", "Backup", "Restore"
    ]
    certificate_permissions = [
      "Get", "List", "Update", "Create", "Import", "Delete", "Recover", "Backup", "Restore", "ManageContacts",
      "ManageIssuers", "GetIssuers", "ListIssuers", "SetIssuers", "DeleteIssuers", "Purge"
    ]
  }
}

[Soeren-WBS]

Hi Guys,

The bug persists after creating everything from scratch; the functions are not working. When I navigate to Test and click on the function, selecting Get Function URL results in an error.

Setting the storage_access_key to azurerm_storage_account.storage_account_function_app_flex.primary_access_key, which is only required for StorageAccountConnectionString and redeploying resolves the issue temporarily. However, this causes the SystemAssignedIdentity to not be set.

Removing the setting and redeploy results then in the expected functionality.

[alexbirisp]

i still cannot deploy in flex consumption plan the java zip. i tried az cli, azurerm, azapi, tried with connection string, system assigned identity - nothing seems to work :)

it only works if i create the functionapp manually from azure portal.

i receive: < Failed to fetch host key to check for function app status > - if i deploy the function app using any of azurerm/azapi and leave the zip part with the az cli cmd or i receive < Site Name: "myFunctionApp"): publishing failed with status code 404 Not Found > if i try it with terraform....

if i run the < az functionapp deployment source config-zip > after the terraform deploy my function goes into a bad state

i had it before with Consumption and Premium plan with no issues deploying it....