Unauthorized error using Terraform to deploy app service on Azure

Question

I am trying to deploy a windows container on azure app service with Terraform. The app service plan deploys fine, but I get an authorization error when the app service tries to deploy. I am using connection strings for an ACR instance with the admin user and password. Does anyone have some ideas?

The deployment works if I do it manually from the portal.

# Create an App Service Plan with Windows
resource "azurerm_app_service_plan" "appserviceplan" {
  name                = "${var.rg-name}-plan"
  location            = "westus"
  resource_group_name = var.rg-name

  # Define Windows as Host OS
  kind                = "xenon"
  is_xenon            = true

  # Choose size
  sku {
    tier = "PremiumContainer"
    size = "PC2"
  }
}

# Create an Azure Web App for Containers in that App Service Plan
resource "azurerm_app_service" "dockerapp" {
  name                = "${var.rg-name}-dockerapp"
  location            = "westus"
  resource_group_name = "${var.rg-name}"
  app_service_plan_id = "${azurerm_app_service_plan.appserviceplan.id}"

  # Configure Docker Image to load on start
  site_config {
    windows_fx_version = "DOCKER|apps.azurecr.io/test/container:latest"
  }
  app_settings = {
    # Settings for private Container Registires  
    DOCKER_REGISTRY_SERVER_URL      = "repo.azureco.io",
    DOCKER_REGISTRY_SERVER_USERNAME = "admin user",
    DOCKER_REGISTRY_SERVER_PASSWORD = "password"
  }
}

Error:

Error: Error creating App Service "dockerapp" (Resource Group "resource-group"): web.AppsClient#CreateOrUpdate: Failure sending request: StatusCode=401 -- Original Error: Code="Unauthorized" Message="Access is denied. Not authorized. latest" Details=[{"Message":"Access is denied. Not authorized. latest"},{"Code":"Unauthorized"},{"ErrorEntity":{"Code":"Unauthorized","ExtendedCode":"01001","Message":"Access is denied. Not authorized. latest","MessageTemplate":"Access is denied.","Parameters":[]}}]

the obvious question would be - you sure you are using the same account in terraform and on the portal? or try clearing you terraform credentials and log into azure again — 4c74356b41

Nancy Xiong Nancy Xiong · Accepted Answer · 2019-11-14T07:52:31

You could verify if the value of DOCKER_REGISTRY_SERVER_URL is correct, it should be a valid URL.

For example, It will look like this in your code.

app_settings = {
    # Settings for private Container Registires  
    DOCKER_REGISTRY_SERVER_URL      = "https://apps.azurecr.io", 
    DOCKER_REGISTRY_SERVER_USERNAME = "admin user",
    DOCKER_REGISTRY_SERVER_PASSWORD = "password"
  }

For more references, Here is an example of deploying a windows container on azure app service with Terraform.

Unauthorized error using Terraform to deploy app service on Azure

2 Answers