Terraform - Azure Api Management Standard V2 doesn't support Public network access disabled and Virtual network integration disabled either

[alvaroandradeglobant]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave comments along the lines of "+1", "me too" or "any updates", they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Hi everyone.

I have tried to deploy an Azure Api Management with the Standard with Terraform using the Standard V2 tier, configuring the Network configuration as

Private endpoints -> create new

1. Trying to create a new private endpoint to connect to a Api Management instance with Standard V2, It's not possible to user Gateway subresource and if you don't choose any one in this subcategory it shows and error.

Errors,
performing CreateOrUpdate: unexpected status 400 (400 Bad Request) with error: NotSupported: Call to Microsoft.ApiManagement/service failed. Error message: Setting up Private Endpoint Connection for API Management service /subscriptions/XXXX-YYYYYY-ZZZZZZ/resourceGroups/aita-rg-test/providers/Microsoft.ApiManagement/service/apim-private-test with Private Endpoint Connection groupId(s) gateway is not supported. Please refer to https://aka.ms/apim-private-link on more details.

resource "azurerm_private_endpoint" "apim_private_endpoint" {
name = "${var.apim_private_name}-pep-${var.environment}"
location = data.azurerm_resource_group.resource_group.location
resource_group_name = data.azurerm_resource_group.resource_group.name
subnet_id = data.azurerm_subnet.apim_subnet.id

private_service_connection {
name = "apim-private-endpoint-${var.environment}"
is_manual_connection = false
private_connection_resource_id = azurerm_api_management.apim_instance.id
subresource_names = ["gateway"]
}
}

2. Also if you try to user public_network_access_enabled = false (it's not supported) and virtual_network_configuration (neither), but if you see in the Azure UI those configurations seem to be enable to use,

*Inbound features
- Private endpoints -> Create New
- Public network access
- Enable
- Disable

Outbound features
- Virtual network integration
- Enable
- Disable
- Virtual Network
- Virtual Network
- Subnet

Errors,
performing Update: unexpected status 400 (400 Bad Request) with error: InvalidParameters: Invalid parameter: Managing Virtual Network Configuration with Type Internal not supported for Sku Type 'StandardV2'.

Terraform Version

1.10

AzureRM Provider Version

4.38.1

Affected Resource(s)/Data Source(s)

azurerm_api_management and azurerm_private_endpoint

Terraform Configuration Files

data "azurerm_virtual_network" "vnet" {
  name                = "vnet-test"
  resource_group_name = data.azurerm_resource_group.resource_group.name
}

data "azurerm_subnet" "apim_subnet" {
  name                 = var.apim_subnet_name
  virtual_network_name = var.virtual_network_name
  resource_group_name  = data.azurerm_resource_group.resource_group.name
}

data "azurerm_private_dns_zone" "dns_private_zone" {
  name                = var.dns_private_zone_name
  resource_group_name = data.azurerm_resource_group.resource_group.name
}

resource "azurerm_api_management" "apim_instance" {
  name                	= var.apim_private_name
  location            	= data.azurerm_resource_group.resource_group.location
  resource_group_name 	= data.azurerm_resource_group.resource_group.name
  publisher_name      	= var.publisher_name
  publisher_email     	= var.publisher_email
  
  #Don't support with Standard V2#
  #virtual_network_type	= "Internal"

  #Don't support with Standard V2#
  #virtual_network_configuration {
  #  subnet_id = data.azurerm_subnet.apim_subnet.id
  #}
  
  #Don't support with Standard V2#
  #public_network_access_enabled = false

  identity {
    type = "SystemAssigned"
  }
  
  sku_name = var.sku_name

  tags = {
    environment = var.environment
  }    
}

resource "azurerm_private_endpoint" "apim_private_endpoint" {
  name                = "${var.apim_private_name}-pep-${var.environment}"
  location            = data.azurerm_resource_group.resource_group.location
  resource_group_name = data.azurerm_resource_group.resource_group.name
  subnet_id           = data.azurerm_subnet.apim_subnet.id
  
  private_service_connection {
    name                           = "apim-private-endpoint-${var.environment}"
    is_manual_connection           = false
    private_connection_resource_id = azurerm_api_management.apim_instance.id
    subresource_names              = ["gateway"]
  }
}

resource "azapi_resource" "apim_scaling" {
  type      = "Microsoft.Insights/autoscalesettings@2022-10-01"
  name      = "Auto-scale-capacity-70-percentage"
  location  = data.azurerm_resource_group.resource_group.location
  parent_id = data.azurerm_resource_group.resource_group.id

  body = jsonencode({
    properties = {
      enabled = true
      name    = "Auto-scale-capacity-70-percentage"
      notifications = [
        {
          email = {
            customEmails = [
              "cloud@test.com"
            ]
            sendToSubscriptionAdministrator    = false
            sendToSubscriptionCoAdministrators = false
          }
          operation = "Scale"
        }
      ]
      profiles = [
        {
          capacity = {
            default = "1"
            maximum = "3"
            minimum = "1"
          }
          name = "Auto created default scale condition"
          rules = [
            {
              metricTrigger = {
                dimensions             = []
                dividePerInstance      = false
                metricName             = "Capacity"
                metricNamespace        = "microsoft.apimanagement/service"
                metricResourceLocation = azurerm_api_management.apim_instance.location
                metricResourceUri      = azurerm_api_management.apim_instance.id
                operator               = "GreaterThan"
                statistic              = "Average"
                threshold              = 70
                timeAggregation        = "Average"
                timeGrain              = "PT1M"
                timeWindow             = "PT10M"
              }
              scaleAction = {
                cooldown  = "PT5M"
                direction = "Increase"
                type      = "ChangeCount"
                value     = "1"
              }
            },
            {
              metricTrigger = {
                dimensions             = []
                dividePerInstance      = false
                metricName             = "Capacity"
                metricNamespace        = "microsoft.apimanagement/service"
                metricResourceLocation = azurerm_api_management.apim_instance.location
                metricResourceUri      = azurerm_api_management.apim_instance.id
                operator               = "LessThan"
                statistic              = "Average"
                threshold              = 65
                timeAggregation        = "Average"
                timeGrain              = "PT1M"
                timeWindow             = "PT10M"
              }
              scaleAction = {
                cooldown  = "PT5M"
                direction = "Decrease"
                type      = "ChangeCount"
                value     = "1"
              }
            }
          ]
        }
      ]
      targetResourceLocation = azurerm_api_management.apim_instance.location
      targetResourceUri      = azurerm_api_management.apim_instance.id
    }
  })
}

Debug Output/Panic Output

│ Error: creating Private Endpoint (Subscription: "0385d25e-9eb9-4f94-988f-22f7522d8b38"
│ Resource Group Name: "aita-rg-test"
│ Private Endpoint Name: "apim-private-test-pep-test"): performing CreateOrUpdate: unexpected status 400 (400 Bad Request) with error: NotSupported: Call to Microsoft.ApiManagement/service failed. Error message: Setting up Private Endpoint Connection for API Management service /subscriptions/XXXXXX-YYYYYYY-ZZZZZZZZ/resourceGroups/aita-rg-test/providers/Microsoft.ApiManagement/service/apim-private-test with Private Endpoint Connection groupId(s) gateway is not supported. Please refer to https://aka.ms/apim-private-link on more details.
│
│   with azurerm_private_endpoint.apim_private_endpoint,
│   on apim_private.tf line 46, in resource "azurerm_private_endpoint" "apim_private_endpoint":
│   46: resource "azurerm_private_endpoint" "apim_private_endpoint" {

Expected Behaviour

Using the Azure UI, I'm able to create an Api Management tier Standard V2 with Public network access disabled, Virtual network integration enabled and a private endpoint pointing to Gateway subresource and attach it to a Api Management instance being only accesible via Vnet. If you try to send traffic to the DNS, it shows an error regarding to This resource is not accesible through internet.

Actual Behaviour

No response

Steps to Reproduce

No response

Important Factoids

No response

References

No response

[Arch-Stalker]

Standard v2 does not support internal mode, you need premium v2 for that, although they don't talk about internal and external modes in regards to v2 tiers, they talk about integration (= external) and injection (= internal)

Also I've understood that the inbound private endpoints with standard v2 need to use APIM policies to block other traffic, though I'm still in the process of setting up my first v2, so I've don't know exactly how this is done yet

[iMasloPro]

Try subresource_names = ["Gateway"] (capital "G") - this is not a joke

[QixiaLu]

Hi @alvaroandradeglobant , as @iMasloPro has pointed out (thanks!), subresource_names = ["Gateway"] should resolve the problem.

For future reference, you could find valid subresource_names from this page

[rcskosir]

Thank you for taking the time to raise this! I am going to close this with @iMasloPro‘s response as an answer. If you have future questions, I suggest using the Community Resources, such as the Azure Provider forum.

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.