Terraform deploying azure function resulting in "FAILED TO DOWNLOAD ZIP FILE.txt"

Question

Im trying to Deploy azure functions using terraform, but i keep getting just a file named "FAILED TO DOWNLOAD ZIP FILE.txt" instead of actual function deployed.

It works if i paste the actual SAS blob string extracted from azure(from previous deployed storage account), but the terraform script fails. the zip file seems to get deployed correctly to blob.

I pretty much copy pasted theis example here: http://vgaltes.com/post/deploying-azure-functions-using-terraform/

Im new to terraform so there may be something obvious im missing here...

 resource "azurerm_resource_group" "rg" {
 name = "myName"
 location = "northEurope"
}

resource "random_string" "storage_name" {
 length = 16
 special = false
 upper = false
}
resource "random_string" "function_name" {
 length = 16
 special = false
 upper = false
}
resource "random_string" "app_service_plan_name" {
 length = 16
 special = false
}

resource "azurerm_storage_account" "storage" {
 name = "${random_string.storage_name.result}"
 resource_group_name = "${azurerm_resource_group.rg.name}"
 location = "${azurerm_resource_group.rg.location}"
 account_tier = "Standard"
 account_replication_type = "LRS"
}
resource "azurerm_storage_container" "storage_container" {
 name = "func"
 resource_group_name = "${azurerm_resource_group.rg.name}"
 storage_account_name = "${azurerm_storage_account.storage.name}"
 container_access_type = "blob"
}

resource "azurerm_storage_blob" "storage_blob" {
 name = "HelloWorld.zip"
 resource_group_name = "${azurerm_resource_group.rg.name}"
 storage_account_name = "${azurerm_storage_account.storage.name}"
 storage_container_name = "${azurerm_storage_container.storage_container.name}"
 type = "block"
 source = "./../FunctionAppZip/HelloWorld.zip"
}
data "azurerm_storage_account_sas" "storage_sas" {
 connection_string = "${azurerm_storage_account.storage.primary_connection_string}"
 https_only = false
resource_types {
 service = false
 container = false
 object = true
 }
services {
 blob = true
 queue = true
 table = true
 file = true
 }
start = "2019–05–21"
 expiry = "2029–05–21"
permissions {
 read = true
 write = true
 delete = true
 list = true
 add = true
 create = true
 update = true
 process = true
 }
}

resource "azurerm_app_service_plan" "plan" {
 name = "${random_string.app_service_plan_name.result}"
 location = "${azurerm_resource_group.rg.location}"
 resource_group_name = "${azurerm_resource_group.rg.name}"
 kind = "functionapp"
sku {
 tier = "Dynamic"
 size = "Y1"
 }
}

resource "azurerm_function_app" "function" {
  name = "${random_string.storage_name.result}"
  location = "${azurerm_resource_group.rg.location}"
  resource_group_name = "${azurerm_resource_group.rg.name}"
  app_service_plan_id = "${azurerm_app_service_plan.plan.id}"
  storage_connection_string = "${azurerm_storage_account.storage.primary_connection_string}"
  app_settings {
    FUNCTIONS_WORKER_RUNTIME = "dotnet"
    FUNCTION_APP_EDIT_MODE = "readwrite"
    https_only = false
    HASH = "${base64sha256(file("./../FunctionAppZip/HelloWorld.zip"))}"
    WEBSITE_RUN_FROM_PACKAGE = 1    
    WEBSITE_USE_ZIP = "https://${azurerm_storage_account.storage.name}.blob.core.windows.net/${azurerm_storage_container.storage_container.name}/${azurerm_storage_blob.storage_blob.name}${data.azurerm_storage_account_sas.storage_sas.sas}"
  }
}

When i download azure function content its just a file there named "FAILED TO DOWNLOAD ZIP FILE.txt"

containing this:

% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed

0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 curl: (22) The requested URL returned error: 403 Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.

Any suggestions what im doing wrong?

Sam Carrington Sam Carrington · Accepted Answer · 2019-07-05T14:05:25

I'm having the same issue - the value in your WEBSITE_USE_ZIP value https://${azurerm_storage_account.storage.name}.blob.core.windows.net/${azurerm_storage_container.storage_container.name}/${azurerm_storage_blob.storage_blob.name}${data.azurerm_storage_account_sas.storage_sas.sas} is the one which prevents the function app from accessing the zip package of source code. If you generate an access URL within the console portal it works. But for some reason - which I've not worked out yet - the value generated by the terraform template doesn't grant access due to a malformed signature field.

Terraform deploying azure function resulting in "FAILED TO DOWNLOAD ZIP FILE.txt"

1 Answers