0

I'm trying to deploy a service bus api connection using bicep. This connection should auth using managed identity (in my case, Logic Apps). In my DEV environment the api connection was created from a Logic App, and I'm trying to deploy the same to other environment.

I have tried this:

connections module:

param connectionName string
param displayName string
param apiName string
param parameterValues object = {}
param parameterValueSet object = {}

resource connection 'Microsoft.Web/connections@2016-06-01' = {
  name: connectionName
  location: resourceGroup().location
  kind: 'V2'
  properties: {
    api: {
      id: 'subscriptions/${subscription().subscriptionId}/providers/Microsoft.Web/locations/${resourceGroup().location}/managedApis/${apiName}'
    }
    displayName: displayName
    parameterValues: parameterValues
    parameterValueSet: parameterValueSet
  }
}

output connectionRuntimeUrl string = reference(connection.id, connection.apiVersion, 'full').properties.connectionRuntimeUrl

In main.bicep

module servicebusApiConnection 'Modules/connection.bicep' = {
  name: serviceBusApiConnectionName
  params: {
    connectionName: serviceBusApiConnectionName
    displayName: serviceBusApiConnectionName
    apiName: 'servicebus'
    parameterValueSet: {
      name: 'managedIdentityAuth'
      values: {
        namespaceEndpoint: {
          'value': 'sb://${serviceBusNamespace.name}.servicebus.windows.net'
        }
      }
    }
  }
}

But the connection says Status "Error" after deploy.

I can see in my service bus api connection in DEV has the option "Logic Apps Managed Identity" for Authentication Type.

enter image description here

the deployed one look like this. It does not say "This connection can only be used with a managed identity." like the one in DEV.

enter image description here

Loc Dai Le
  • 1,661
  • 4
  • 35
  • 70
  • According to the documentaiotn, the api-version is not correct: https://learn.microsoft.com/en-us/azure/logic-apps/create-managed-service-identity?tabs=standard#multi-authentication-1 – Thomas Apr 22 '23 at 03:04
  • This answer should help as well: https://stackoverflow.com/a/72656531/4167200 – Thomas Apr 22 '23 at 03:04
  • Does this answer your question? [Api connections(keyvault, servicebus and blob ) using managed identity through bicep](https://stackoverflow.com/questions/72648651/api-connectionskeyvault-servicebus-and-blob-using-managed-identity-through-b) – Thomas Apr 22 '23 at 03:04

1 Answers1

0

you have to deploy the access policy as well (after connections are deployed), i dont have bicep for it but here is an ARM example:

    {
  "type": "Microsoft.Web/connections/accessPolicies",
  "apiVersion": "2016-06-01",
  "name": "[concat('servicebus','/',variables('logicAppName'))]",
  "location": "westeurope",
  "dependsOn": [
    "[resourceId('Microsoft.Web/sites', variables('logicAppName'))]"
  ],
  "properties": {
    "principal": {
      "type": "ActiveDirectory",
      "identity": {
        "tenantId": "[subscription().tenantId]",
        "objectId": "[reference(resourceId('Microsoft.Web/sites', variables('logicAppName')), '2018-11-01', 'Full').identity.principalId]"
      }
    }
      }
    }
viktorh
  • 152
  • 13