Bicep - Cannot access Function Key on B1 plan

Michał Jełowicki 0

Hello,

I am trying to deploy bicep template which includes two resources - Key Vault and Function App. I would also like to add Function App default key as a KV secret. In order to do so I am using following syntax.

resource functionAppHost 'Microsoft.Web/sites/host@2022-09-01' existing = {
  name: 'default'
  parent: functionApp
}

resource secretFunctionAppSecret 'Microsoft.KeyVault/vaults/secrets@2022-07-01' = {
  parent: keyVault
  name: 'secret-pbimon-func-app-secret'
  properties: {
    value: functionAppHost.listKeys().functionKeys.default
  }
}

This syntax functions correctly with every App Service Plan except B1, where it results in an error:

User's image

I don't know what is the reason - I tried serverless and other Premium Plans which didn't cause any issues. I can also add other secrets to KV (for example I use almost the same syntax for adding Storage Key). Below is my ASP resource (if I change plan to any other everything works fine)

resource appServicePlan 'Microsoft.Web/serverfarms@2022-09-01' = {
  name: app_service_plan_name
  location: region_uppercase
  sku: {
    name: 'B1'
    tier: 'Basic'
    size: 'B1'
    family: 'B'
    capacity: 1
  }
  kind: 'linux'
  properties: {
    reserved: true
  }
}

VenkateshDodda-MSFT 21,651 Reputation points Microsoft Employee

2023-12-14T05:37:31.95+00:00

@Michał Jełowicki Thanks for reaching out to Microsoft Q&A, apologize for any inconvenience caused on this.

When we have tested this in our local environment, we are also not able to access the function app(which are running on dedicated app service plan) it is failing with internal server error from host runtime.

I am checking with internal team on this and will update you here once I hear back from them.
VenkateshDodda-MSFT 21,651 Reputation points Microsoft Employee

2023-12-16T06:15:52.0333333+00:00

@Michał Jełowicki Thanks for your patience on this could you please retry the operation and let us know if you are still facing the issue.
Michał Jełowicki 0 Reputation points

2023-12-16T17:25:11.41+00:00

@VenkateshDodda-MSFT Unfortunately I still do.
VenkateshDodda-MSFT 21,651 Reputation points Microsoft Employee

2023-12-17T06:11:40.07+00:00

@Michał Jełowicki Thanks for your response. Could you please share your complete bicep template to check and assist you further.

Michał Jełowicki 0

@VenkateshDodda-MSFT Here you go, thanks for your assistance

param app_service_plan_name string
param function_name
param vault_name string
param func_storage_name 
param tenant_id string
param region_uppercase
param region string

// (2) App Service Plan + Function Storage + Function App
resource appServicePlan 'Microsoft.Web/serverfarms@2022-09-01' = {
  name: app_service_plan_name
  location: region_uppercase
  sku: {
    name: 'B1'
    tier: 'Basic'
    size: 'B1'
    family: 'B'
    capacity: 1
  }
  kind: 'linux'
  properties: {
    reserved: true
  }
}

// (2b) Function Storage 
resource functionStorage 'Microsoft.Storage/storageAccounts@2023-01-01' = {
  location: region
  name: func_storage_name
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'Storage'
  properties: {
    minimumTlsVersion: 'TLS1_2'
  }
}

resource functionStorageDefault 'Microsoft.Storage/storageAccounts/blobServices@2023-01-01' = {
  parent: functionStorage
  name: 'default'
}

resource functionStorageServices 'Microsoft.Storage/storageAccounts/fileServices@2023-01-01' = {
  parent: functionStorage
  name: 'default'
}

resource functionStorageContainer 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-01-01' = {
  parent: functionStorageDefault
  name: 'azure-webjobs-hosts'
}

resource functionStorageContainer2 'Microsoft.Storage/storageAccounts/blobServices/containers@2023-01-01' = {
  parent: functionStorageDefault
  name: 'azure-webjobs-secrets'
}

// (2c) Function App
resource functionApp 'Microsoft.Web/sites@2022-09-01' = {
  name: function_name
  location: region_uppercase
  kind: 'functionapp,linux'
  identity: {
    type: 'SystemAssigned'
  }
  properties: {
    enabled: true
    serverFarmId: appServicePlan.id
    siteConfig: {
      appSettings: [
        {
          name: 'FUNCTIONS_WORKER_RUNTIME'
          value: 'python'
        }
        {
          name: 'FUNCTIONS_EXTENSION_VERSION'
          value: '~4'
        }
        {
          name: 'AzureWebJobsStorage'
          value: 'DefaultEndpointsProtocol=https;AccountName=${func_storage_name};AccountKey=${functionStorage.listKeys().keys[0].value};EndpointSuffix=core.windows.net'
        }
        {
          name: 'AzureWebJobsFeatureFlags'
          value: 'EnableWorkerIndexing'
        }
      ]
      netFrameworkVersion: 'v4.0'
      linuxFxVersion: 'Python|3.11'
      alwaysOn: true
    }
  }
}

// (5) Key Vault
resource keyVault 'Microsoft.KeyVault/vaults@2023-07-01' = {
  name: vault_name
  location: region
  properties: {
    sku: {
      family: 'A'
      name: 'standard'
    }
    tenantId: tenant_id
    accessPolicies: [
      {
        tenantId: tenant_id
        objectId: rg_owner_id
        permissions: {
          keys: [
            'Get'
            'List'
            'Update'
            'Create'
            'Import'
            'Delete'
            'Recover'
            'Backup'
            'Restore'
            'GetRotationPolicy'
            'SetRotationPolicy'
            'Rotate'
            'Encrypt'
            'Decrypt'
            'UnwrapKey'
            'WrapKey'
            'Verify'
            'Sign'
            'Purge'
            'Release'
          ]
          secrets: [
            'Get'
            'List'
            'Set'
            'Delete'
            'Recover'
            'Backup'
            'Restore'
            'Purge'
          ]
          certificates: [
            'Get'
            'List'
            'Update'
            'Create'
            'Import'
            'Delete'
            'Recover'
            'Backup'
            'Restore'
            'ManageContacts'
            'ManageIssuers'
            'GetIssuers'
            'ListIssuers'
            'SetIssuers'
            'DeleteIssuers'
            'Purge'
          ]
        }
      }
      {
        tenantId: tenant_id
        objectId: functionApp.identity.principalId
        permissions: {
          certificates: [
            'Get'
            'List'
          ]
          keys: [
            'Get'
            'List'
          ]
          secrets: [
            'Get'
            'List'
          ]
        }
      }
      {
        tenantId: tenant_id
        objectId: dataFactory.identity.principalId
        permissions: {
          certificates: [
            'get'
            'list'
          ]
          keys: [
            'get'
            'list'
          ]
          secrets: [
            'get'
            'list'
          ]
        }
      }
    ]
  }
}

resource secretAppRegistrationSecret 'Microsoft.KeyVault/vaults/secrets@2022-07-01' = {
  parent: keyVault
  name: 'secret-pbimon-app-reg-secret'
  properties: {
    value: app_reg_secret
  }
}

VenkateshDodda-MSFT 21,651 Reputation points Microsoft Employee

2023-12-18T08:15:10.19+00:00

@Michał Jełowicki Thanks for sharing the requested details I will check and update you accordingly.
Michał Jełowicki 0 Reputation points

2023-12-21T11:27:07.7666667+00:00

@VenkateshDodda-MSFT
Sorry for late reply. I did as you told but ufortunetely I still receive an error.
VenkateshDodda-MSFT 21,651 Reputation points Microsoft Employee

2023-12-27T13:29:20.73+00:00

@Michał Jełowicki apologize for the delay in my response. This would need one on one offline support and I will suggest you to open a support ticket.

In case if you don't have the support plan then please send an email with your Subscription Id and link to this thread to AzCommunity@microsoft.com with subject line as "ATTN: Venkatesh" so I can enable one-time free support on your subscription to assist you further.
Michał Jełowicki 0 Reputation points

2023-12-28T10:30:10.8833333+00:00

@VenkateshDodda-MSFT

As suggested I opened support ticket. Thank you for your help. I will post the solution in this thread.
Karthikeyan T C 0 Reputation points

2024-10-23T07:36:46.5566667+00:00

Hi @Michał Jełowicki, Did you got the solution for this problem ?
Michał Jełowicki 0 Reputation points

2024-10-25T08:30:07.93+00:00

Unfortunately I didn't. MS support said it's a bug which is probably gonna be fixed in the next updates

1 answer

VenkateshDodda-MSFT 21,651 Reputation points Microsoft Employee

2023-12-18T14:52:37.0066667+00:00
@Michał Jełowicki looks like you haven't shared the complete template, and you have couple other dependencies like data factory etc.,.
I would suggest you retry the deployment by making the below changes and let us know you if are still facing the issues.

Remove the resource block Microsoft.Web/sites/host@2022-09-01 which is used to list the function app keys.

Pass this listkeys('${resourceId('Microsoft.Web/sites', functionApp.name)}/host/default/', '2021-02-01').masterKey as secret value in this resource Microsoft.KeyVault/vaults/secrets@2022-07-01 block.

If are using the single template to create resource and storing secrets. I recommend you use two template one template for resource creation and other template for storing secrets and use deployment scripts to wait for few seconds and to create the secret in key vaults. Refer to learn documentation about deployment scripts.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Bicep - Cannot access Function Key on B1 plan

1 answer

Your answer