Skip to content
This repository has been archived by the owner on Mar 11, 2021. It is now read-only.

Accessing Identity output #115

Closed
jkonecki-techfabric opened this issue Nov 6, 2020 · 15 comments · Fixed by pulumi/pulumi-azure-native#408 or pulumi/pulumi-azure-native#478
Closed

Accessing Identity output #115

jkonecki-techfabric opened this issue Nov 6, 2020 · 15 comments · Fixed by pulumi/pulumi-azure-native#408 or pulumi/pulumi-azure-native#478
Assignees
@mikhailshilkov
Labels
1.0 Track for 1.0 release bug Something isn't working impact/usability
Milestone
0.51

Comments

@jkonecki-techfabric
Copy link

I'm trying to create a new VM ScaleSet with system-assigned identity and than create KeyVault access policy for this identity:

var scaleSet = new VirtualMachineScaleSet($"{tenant}-orleans-scaleset-{environment}", new VirtualMachineScaleSetArgs
{
	Identity = new VirtualMachineScaleSetIdentityArgs
	{
		Type = "SystemAssigned"
	}                
});

new AccessPolicy($"{tenant}-orleans-scaleset-{environment}", new AccessPolicyArgs
{
	KeyVaultId = keyVault.VaultId,
	ObjectId = scaleSet.Identity.Apply(x => x.PrincipalId),
	TenantId = scaleSet.Identity.Apply(x => x.TenantId),
	KeyPermissions = new[] { "get", "list" },
	SecretPermissions = new[] { "get", "list" }
});

When running pulumi up I'm getting the following error:

  azure:keyvault:AccessPolicy (vrm-orleans-scaleset-dev):
    error: azure:keyvault/accessPolicy:AccessPolicy resource 'vrm-orleans-scaleset-dev' has a problem: Missing required property 'tenantId'
    error: azure:keyvault/accessPolicy:AccessPolicy resource 'vrm-orleans-scaleset-dev' has a problem: Missing required property 'objectId'

Am I using Output.Apply correctly?
@mikhailshilkov
Copy link
Member

Your Apply usage looks good.

  1. Do I understand correctly that AccessPolicy is from Pulumi.Azure? (if so, I'll probably move the issue to that repo)
  2. This sounds like this issue which was recently fixed. Which provider version are you using?

@jkonecki-techfabric
Copy link
Author

jkonecki-techfabric commented Nov 6, 2020 via email

@mikhailshilkov
Copy link
Member

mikhailshilkov commented Nov 6, 2020 •
edited
Loading

Yes, it might be related. The issue I mentioned above was fixed for output flow for the Azure provider. I guess something is still missing for Azure NextGen. You can work around the issue with this:

    ObjectId = scaleSet.Identity.Apply(x => x.PrincipalId ?? Guid.Empty.ToString()),
    TenantId = scaleSet.Identity.Apply(x => x.TenantId ?? Guid.Empty.ToString()),

@mikhailshilkov mikhailshilkov added bug Something isn't working impact/usability 1.0 Track for 1.0 release labels Nov 6, 2020
@jkonecki-techfabric
Copy link
Author

jkonecki-techfabric commented Nov 6, 2020 via email

@mikhailshilkov
Copy link
Member

@jkonecki-techfabric Which Pulumi.Azure version are you using?

@scp-mb
Copy link

scp-mb commented Nov 10, 2020 •
edited
Loading

It doesn't seem pulumi/pulumi-azure#192 has fixed the issue completely, seeing a very similar issue trying to create a new AppService using a managed identity and applying PrincipalId to an instance of Pulumi.Azure.Authorization.Assignment

new Pulumi.Azure.Authorization.Assignment(<redacted>",
            new Pulumi.Azure.Authorization.AssignmentArgs
            {
                PrincipalId = appService.Identity.Apply(x => x.PrincipalId),
                Scope = ResourceGroup.Id,
                RoleDefinitionName = "Contributor"
            });

error: azure:authorization/assignment:Assignment resource 'redacted' has a problem: Missing required property 'principalId'

This is with Pulumi 2.13.2 and Pulumi.Azure v3.30.0

Edit: I've just realised this is the nextgen provider repo, whereas I'm using the regular provider. The issue seems to be the same however.

@jkonecki-techfabric
Copy link
Author

@mikhailshilkov 3.28.0

@mikhailshilkov
Copy link
Member

@scp-mb Could you add a repro to pulumi/pulumi-azure#192? Maybe we should reopen it.

@scp-mb scp-mb mentioned this issue Nov 10, 2020
Closed
@mikhailshilkov
Copy link
Member

I reopened pulumi/pulumi-azure#192 let's track there

@andrewdmoreno
Copy link

Encountered this issue also with AccessPolicy from Pulumi.AzureNextGen while attempting to get identity from WebApp and WebAppSlot, also from Pulumi.AzureNextGen.

The following workaround recommended above worked.

app.Identity.Apply(i => i?.PrincipalId ?? Guid.Empty.ToString())

@mikhailshilkov
Copy link
Member

@andrewdmoreno I closed this 10 seconds before your comment :)

Could you add your code snippet here?

@andrewdmoreno
Copy link

@mikhailshilkov Just want to confirm I'm understanding you correctly: Are you asking me to post the above comment in pulumi/pulumi-azure#192? Or were you wanting me to provide more info here re: Pulumi.AzureNextGen?

@andrewdmoreno
Copy link

I'm gonna assume in the meantime that you wanted additional code snippet for Pulumi.AzureNextGen here. (Some code omitted for brevity).

            var app = new WebApp("api", new WebAppArgs
            {
                Name = ResourceName("api"),
                Location = _location,
                ResourceGroupName = _resourceGroup,
                ServerFarmId = plan.Id,
                ClientAffinityEnabled = false,
                Identity = ManagedIdentity(),
                SiteConfig = siteConfigArgs,
                Tags = Tags
            });

            var accessPolicies = new InputList<AccessPolicyEntryArgs>
            {
                DefaultSecretsAccessPolicy(servicePrincipalId),
                DefaultSecretsAccessPolicy(app.Identity.Apply(i => i?.PrincipalId ?? Guid.Empty.ToString())),
                DefaultSecretsAccessPolicy(slot.Identity.Apply(i => i?.PrincipalId ?? Guid.Empty.ToString()))
            };

            var vault = CreateKeyVault(accessPolicies);

        ...

        private Vault CreateKeyVault(InputList<AccessPolicyEntryArgs> accessPolicies)
        {
            return new Vault("vault", new VaultArgs
            {
                ResourceGroupName = _resourceGroup,
                Location = _location,
                Properties = new VaultPropertiesArgs
                {
                    Sku = new SkuArgs
                    {
                        Family = "A",
                        Name = "standard",
                    },
                    TenantId = _azureAdTenantId,
                    AccessPolicies = accessPolicies
                },
                VaultName = _keyVaultName
            });
        }

        private AccessPolicyEntryArgs DefaultSecretsAccessPolicy(Input<string> objectId) => new AccessPolicyEntryArgs
        {
            ObjectId = objectId,
            Permissions = new PermissionsArgs
            {
                Secrets = _secretPermissions,
            },
            TenantId = _azureAdTenantId,
        };

I don't have the exact error message this moment, but it was complaining about the access policies with index [1] and [2] in the accessPolicies list.

@mikhailshilkov mikhailshilkov mentioned this issue Nov 23, 2020
Closed
@mikhailshilkov mikhailshilkov mentioned this issue Dec 8, 2020
Closed
@mikhailshilkov mikhailshilkov self-assigned this Dec 17, 2020
@mikhailshilkov mikhailshilkov added this to the current milestone Dec 17, 2020
@mikhailshilkov mikhailshilkov mentioned this issue Dec 18, 2020
Merged
@mikhailshilkov
Copy link
Member

The fix will be released in version 0.3.2

@andrewdmoreno andrewdmoreno mentioned this issue Jan 26, 2021
Closed
@mikhailshilkov
Copy link
Member

While this error doesn't happen during the initial preview, it does happen during an update. For instance, if WebApp in the example above changes, I get an error azure-nextgen:keyvault/latest:Vault resource 'vault' has a problem: missing required property 'properties.accessPolicies[0].objectId'

@mikhailshilkov mikhailshilkov removed this from the current milestone Jan 26, 2021
@mikhailshilkov mikhailshilkov mentioned this issue Jan 26, 2021
Merged
@leezen leezen added this to the 0.51 milestone Jan 26, 2021
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@mikhailshilkov mikhailshilkov

Labels
1.0 Track for 1.0 release bug Something isn't working impact/usability
Projects
None yet
Milestone
0.51
5 participants
@leezen @mikhailshilkov @andrewdmoreno @scp-mb @jkonecki-techfabric