Creating a private endpoint for cosmosDB autogenerates a new network interface. How can I use the network interface I created?

Question

The code below is supposed to create a cosmosdb, network interface (NIC) and Private Endpoint (PE).

When running the terraform code below it autogenerates a second NIC with dynamic ip, no tags and a generic name like "pe.nic.9xxxxxb-85d7-4756-8b78-dxxxxxxx".

Preferably I want to use the NIC created through the terraform code instead of the auto-generated one, to be able to control tags, naming and if possible static ip.

Terraform documentation for PE: https://www.terraform.io/docs/providers/azurerm/r/private_endpoint.html

Simliar implementation from Github, not specified NIC: https://github.com/terraform-providers/terraform-provider-azurerm/blob/master/examples/private-endpoint/cosmos-db/main.tf

How can i achieve this?

resource "azurerm_cosmosdb_account" "cosmosDb" {
  name                = "MyCosmosDB"
  location            = data.azurerm_resource_group.rg.location
  resource_group_name = data.azurerm_resource_group.rg.name
  offer_type          = "Standard"
  consistency_policy {
      consistency_level= "Session"
      max_interval_in_seconds= 5
      max_staleness_prefix= 100
    }
  geo_location {
      failover_priority= 0
      location= data.azurerm_resource_group.rg.location
    }
  tags = local.tags
}
resource "azurerm_network_interface" "nic" {
  name                      = "example-nic"
  location                  = data.azurerm_resource_group.rg.location
  resource_group_name       = data.azurerm_resource_group.rg.name
  ip_configuration {
    name                          = "nic-ip-config"
    subnet_id                     = data.azurerm_subnet.subnet_vm.id
    private_ip_address_allocation = "Static"
    private_ip_address            = var.ip
  }
  tags = local.tags
}


resource "azurerm_private_endpoint" "pe" {
    name                = "example-pe"
    location            = data.azurerm_resource_group.rg.location
    resource_group_name = data.azurerm_resource_group.rg.name
    subnet_id           = data.azurerm_subnet.subnet_vm.id
    private_service_connection {
        is_manual_connection       = true
        name                       = "example-psc"
        private_connection_resource_id = azurerm_cosmosdb_account.cosmosDb.id
        subresource_names          = ["sql"]
        request_message            = "-"
  }
}

The automatic created Nic does not have a lock (same for the other resources created), but for what i found in the documentation is that it can't be changed (confirmed with PS and azure portal). — Fredriks

Johnny Johnny · Accepted Answer · 2020-06-17T12:27:14

According to https://github.com/MicrosoftDocs/azure-docs/issues/50919, static IP is not possible:

With Private Endpoints in general, the generated network interface is read-only and managed within the life cycle of the Private Endpoint resource.

Creating a private endpoint for cosmosDB autogenerates a new network interface. How can I use the network interface I created?

1 Answers