-1

I have created a application gateway, WAF policy, public IP via terraform. From Azure GUI I have created a Key vault in which I have uploaded the pfx certificate also I have created managed identity and granted full access to azure key vault.

I am trying to create a additional https listener and calling the certificate stored in the keyvault via data block but somehow landing in this error . Note: Kayvault , managed identity , appgw, waf policy are all in same region.

Error : │ Error: updating Application Gateway: (Name "abc-xyz-Nonprod-test-us6-Extappgw0001" / Resource Group "xyz-network-vnet-devtest"): network.ApplicationGatewaysClient#CreateOrUpdate: Failure sending request: StatusCode=400 -- Original Error: Code="InvalidResourceReference" Message="Resource /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/xyz-network-vnet-devtest/providers/Microsoft.Network/applicationGateways/abc-xyz-Nonprod-test-us6-Extappgw0001/sslCertificates/firepfx referenced by resource /subscriptions/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx/resourceGroups/xyz-network-vnet-devtest/providers/Microsoft.Network/applicationGateways/abc-xyz-Nonprod-test-us6-Extappgw0001/httpListeners/External_app_gtw_nonprod_backend_listener_https was not found. Please make sure that the referenced resource exists, and that both resources are in the same region." Details=[] │ │ with azurerm_application_gateway.abc-xyz-Nonprod-test-us6-Extappgw0001, │ on abc-xyz-Nonprod-test-us6-Extappgw0001.tf line 102, in resource "azurerm_application_gateway" "abc-xyz-Nonprod-test-us6-Extappgw0001": │ 102: resource "azurerm_application_gateway" "abc-xyz-Nonprod-test-us6-Extappgw0001"

code

terraform {


backend "azurerm" {
    storage_account_name = "abccloudlbstorage"
    resource_group_name  = "xyz-NETENG-AppResources-Prod"
    container_name       = "testlb"
    tenant_id            = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    subscription_id      = "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
    key                  = "abc-xyz-Nonprod-test-us6-Extappgw0001.tfstate"
  }
}

provider "azurerm" {
  features {}
}

data "azurerm_client_config" "current" {}

data "azurerm_subnet" "abc-xyz-devtest-us6-vnet00002-sub00001-AppGW" {
  name                 = "abc-xyz-devtest-us6-vnet00002-sub00001-AppGW"
  resource_group_name  = "xyz-network-vnet-devtest"
  virtual_network_name = "abc-xyz-devtest-us6-vnet00002"
}

data "azurerm_user_assigned_identity" "test-appgw-identity-us6"{
  name = "test-appgw-identity-us6"
  resource_group_name = "xyz-network-vnet-devtest"
}

data "azurerm_key_vault" "xyz-network-kv" {
  name                = "xyz-network-kv"
  resource_group_name = "xyz-network-vnet-devtest"
}

data "azurerm_key_vault_certificate" "firepfx" {
  name         = "firepfx"
  key_vault_id = data.azurerm_key_vault.xyz-network-kv.id

}

resource "azurerm_public_ip" "abc-test-us6-nonprod-FE0001" {
  name                = "abc-test-us6-nonprod-FE0001"
  resource_group_name = "xyz-network-vnet-devtest"
  location            = "eastus2"
  allocation_method   = "Static"
  sku                 = "Standard"
  zones               = ["1", "2", "3"]
  tags = {
    BusinessUnit   = "enterprise-management"
    LineOfBusiness = "xyz"
  }
}

resource "azurerm_web_application_firewall_policy" "abc-test-us6-nonprod-WFW0001" {
  name                = "abc-test-us6-nonprod-WFW0001"
  resource_group_name = "xyz-network-vnet-devtest"
  location            = "eastus2"
  tags = {
    BusinessUnit   = "enterprise-management"
    LineOfBusiness = "xyz"
  }

  custom_rules {
    name      = "Rule1"
    priority  = 1
    rule_type = "MatchRule"

    match_conditions {
      match_variables {
        variable_name = "RemoteAddr"
      }

      operator           = "IPMatch"
      negation_condition = false
      match_values       = ["8.8.8.8"]
    }

    action = "Block"
  }

  policy_settings {
    enabled                     = true
    mode                        = "Prevention"
    request_body_check          = true
    file_upload_limit_in_mb     = 100
    max_request_body_size_in_kb = 128
  }

  managed_rules {
    exclusion {
      match_variable          = "RequestHeaderNames"
      selector                = "x-company-secret-header"
      selector_match_operator = "Equals"
    }

    managed_rule_set {
      type    = "OWASP"
      version = "3.2"
    }
  }
}

resource "azurerm_application_gateway" "abc-xyz-Nonprod-test-us6-Extappgw0001" {
  name                = "abc-xyz-Nonprod-test-us6-Extappgw0001"
  resource_group_name = "xyz-network-vnet-devtest"
  location            = "eastus2"
  zones               = ["1", "2", "3"]
  firewall_policy_id  = azurerm_web_application_firewall_policy.abc-test-us6-nonprod-WFW0001.id
  tags = {
    BusinessUnit   = "enterprise-management"
    LineOfBusiness = "xyz"
  }
  sku {
    name = "WAF_v2"
    tier = "WAF_v2"
  }

  autoscale_configuration {
    min_capacity = 2
    max_capacity = 10

  }

  gateway_ip_configuration {
    name      = "abc-test-us6-nonprod-GIP0001"
    subnet_id = data.azurerm_subnet.abc-xyz-devtest-us6-vnet00002-sub00001-AppGW.id
  }

  frontend_port {
    name = "abc-us6-gpt-nonprod-PRT-FE0001"
    port = 80
  }

  frontend_ip_configuration {
    name                 = "abc-test-us6-nonprod-CFG-FE0001"
    public_ip_address_id = azurerm_public_ip.abc-test-us6-nonprod-FE0001.id
  }

  frontend_ip_configuration {
    name                          = "abc-test-us6-nonprod-CFG-FE0002"
    subnet_id                     = data.azurerm_subnet.abc-xyz-devtest-us6-vnet00002-sub00001-AppGW.id
    private_ip_address            = "10.46.72.200"
    private_ip_address_allocation = "Static"
  }
  backend_address_pool {
    name = "External_app_gtw_nonprod_backend"
  }

  backend_http_settings {
    name                  = "External_app_gtw_nonprod_http_setting"
    cookie_based_affinity = "Disabled"
    path                  = "/"
    port                  = 80
    protocol              = "Http"
    request_timeout       = 60
  }

  http_listener {
    name                           = "External_app_gtw_nonprod_backend_listener"
    frontend_ip_configuration_name = "abc-test-us6-nonprod-CFG-FE0001"
    frontend_port_name             = "abc-us6-gpt-nonprod-PRT-FE0001"
    protocol                       = "Http"
  }


  request_routing_rule {
    name                       = "External_app_gtw_nonprod_RR"
    rule_type                  = "Basic"
    http_listener_name         = "External_app_gtw_nonprod_backend_listener"
    backend_address_pool_name  = "External_app_gtw_nonprod_backend"
    backend_http_settings_name = "External_app_gtw_nonprod_http_setting"
    priority                   = 1
  }

  frontend_port {
    name = "abc-us6-gpt-nonprod-PRT-FE00011"
    port = 443
  }


  backend_http_settings {
    name                  = "External_app_gtw_nonprod_https_setting"
    cookie_based_affinity = "Disabled"
    path                  = "/"
    port                  = 443
    protocol              = "Https"
    request_timeout       = 60
    host_name = "irms.abc.com"
  }
  http_listener {
    name                           = "External_app_gtw_nonprod_backend_listener_https"
    frontend_ip_configuration_name = "abc-test-us6-nonprod-CFG-FE0001"
    frontend_port_name             = "abc-us6-gpt-nonprod-PRT-FE00011"
    protocol                       = "Https"
    ssl_certificate_name             = data.azurerm_key_vault_certificate.firepfx.name
  }

  identity {
    type         = "UserAssigned"
    identity_ids = [data.azurerm_user_assigned_identity.test-appgw-identity-us6.id]
  }

  request_routing_rule {
    name                       = "External_app_gtw_nonprod_https"
    rule_type                  = "Basic"
    http_listener_name         = "External_app_gtw_nonprod_backend_listener_https"
    backend_address_pool_name  = "External_app_gtw_nonprod_backend"
    backend_http_settings_name = "External_app_gtw_nonprod_https_setting"
    priority                   = 3
  }
}
Ghost rider
  • 43
  • 1
  • 9

1 Answers1

0

For Application Gateway, you have to create an ssl_certificate block that references the Key Vault secret ID under the key_vault_secret_id property. Then your listener will reference the name of this ssl_certificate resource instead of the locals variable you declared.

ssl_certificate {
    name = "cert2023"
    key_vault_secret_id "https://mykv.vault.azure.net/secrets/cert2023"
}
DusDee
  • 136
  • 1
  • 5