3

I know that I can get the host key and trigger_url of an Azure Function in an ARM template by using the listKeys/listSecrets method. But I need the systemkey, I'm deploying an Event Grid Subscription and it needs the Azure Function endpoint url which contains the system key:

"resources": [
        {
            "type": "Microsoft.Storage/StorageAccounts/providers/eventSubscriptions",
            "name": "[concat(concat(parameters('publisherName'), '/Microsoft.EventGrid/'), parameters('name'))]",
            "apiVersion": "2018-01-01",
            "properties": {
                "destination": {
                    "endpointType": "[parameters('endpointType')]",
                    "properties": {
                        "endpointUrl": "[parameters('endpointUrl')]"
                    }
                },
                "filter": {
                    "subjectBeginsWith": "[parameters('subjectBeginsWith')]",
                    "subjectEndsWith": "[parameters('subjectEndsWith')]",
                    "subjectIsCaseSensitive": "[parameters('subjectIsCaseSensitive')]",
                    "includedEventTypes": "[parameters('includedEventTypes')]"
                },
                "labels": "[parameters('labels')]"
            }
        }
    ]

where endpointUrl is in the form of:

https://<function-app-name>.azurewebsites.net/admin/extensions/EventGridExtensionConfig?functionName=<function-name>&code=XZvGU0ROPxxxxxxxxxxxxxxxxxxxxxxxxxxxxaaieD89gPQ==

The parameter named 'code' is the systemkey, which can be retrieved by doing a GET on 

http://<function-app-name>.azurewebsites.net/admin/host/systemkeys/eventgridextensionconfig_extension?code=<master_key>

Is there a way to retrieve this systemkey (or the entire endpointurl) in the ARM template without resorting to bash scripts that inject it or other external systems?

The documentation does say: "However, you cannot use list operations that require values in the request body." So I don't think I'll be able to with a 'list' operation.

Nicolas Mommaerts
  • 3,207
  • 4
  • 35
  • 55
  • have a look at my answer for creating a full endpointUrl of the EventGridTrigger function subscriber https://stackoverflow.com/questions/50367435/is-there-a-option-to-get-the-event-grid-trigger-url-key-at-output-value-from-t – Roman Kiss May 24 '18 at 06:15
  • I actually ran across your answer, but it is a solution using a REST call, so some scripting is needed. I was hoping for a pure ARM based solution. – Nicolas Mommaerts May 24 '18 at 07:34

2 Answers2

5

Yes, it is now possible:

"destination": {
    "endpointType": "WebHook",
    "properties": {
        "endpointUrl": "[concat(variables('functionUrl'), listKeys(resourceId(variables('functionResourceGroupName'), 'Microsoft.Web/sites/host/', variables('functionAppName'), 'default'),'2016-08-01').systemkeys.eventgrid_extension)]"
    }
},

Where functionUrl ends with &code=. Tested that on runtime ~2.

Monsignor
  • 2,671
  • 1
  • 36
  • 34
  • oh that would be great, gonna try it out! – Nicolas Mommaerts Dec 11 '19 at 20:36
  • This only works if the function has been deployed before the template is run. That means it's not likely to work if you want to use a systemkey from another reasource in the same deployment. – Marius Apr 06 '21 at 11:13
2

This is not possible right now. You can return only function keys using the ARM template. Same described here: https://blog.mexia.com.au/list-of-access-keys-from-output-values-after-arm-template-deployment#functions

Alexey Rodionov
  • 1,436
  • 6
  • 8