Add KeyVault Access Policy with DependsOn Azure Function

Question

Trying to provision a function app but at the same time create an access policy in key vault with a dependency. Not sure if this is possible. I was hoping it would create the app, then add the access policy followed by the updates to the function config.

However I get the following error:

##[error]Deployment template validation failed: 'The template resource 'my-keyvault/add' at line '1' and column '2933' is not valid: Unable to evaluate template language function 'resourceId': the type 'Microsoft.Web/sites/functions' requires '2' resource name argument(s). Please see https://aka.ms/arm-template-expressions/#resourceid for usage details.. Please see https://aka.ms/arm-template-expressions for usage details.'.

This is the template:

{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "parameters": {
    "keyVault.name": {
      "type": "string"
    },
    "environment": {
      "type": "string"
    },
    "functionAppName": {
      "type": "string"
    },
    "appInsightsKey": {
      "type": "string"
    },
    "location": {
      "type": "string"
    }
  },
  "resources": [
    {
      "type": "Microsoft.Web/serverfarms",
      "apiVersion": "2020-06-01",
      "name": "[parameters('functionAppName')]",
      "location": "[parameters('location')]",
      "sku": {
        "name": "Y1",
        "tier": "Dynamic"
      },
      "properties": {
        "name": "[parameters('functionAppName')]",
        "computeMode": "Dynamic"
      }
    },
    {
      "type": "Microsoft.Web/sites",
      "apiVersion": "2020-06-01",
      "name": "[parameters('functionAppName')]",
      "location": "[parameters('location')]",
      "kind": "functionapp",
      "identity": {
        "type": "SystemAssigned"
      },
      "dependsOn": [
        "[resourceId('Microsoft.Web/serverfarms', parameters('functionAppName'))]"
      ],
      "properties": {
        "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('functionAppName'))]",
        "httpsOnly": true
      },
      "resources": [
        {
          "apiVersion": "2020-06-01",
          "name": "web",
          "type": "config",
          "dependsOn": [
            "[resourceId('Microsoft.Web/Sites', parameters('functionAppName'))]"
          ],
          "properties": {
            "serverFarmId": "[resourceId('Microsoft.Web/serverfarms', parameters('functionAppName'))]"
          }
        },
        {
          "apiVersion": "2020-06-01",
          "type": "config",
          "name": "appsettings",
          "dependsOn": [
            "[resourceId('Microsoft.Web/sites', parameters('functionAppName'))]",
            "[resourceId('Microsoft.KeyVault/vaults/', parameters('keyVault.Name'))]"
          ],
          "properties": {
            "AzureWebJobsStorage": "[concat('@Microsoft.KeyVault(SecretUri=https://', parameters('keyVault.Name'), '.vault.azure.net/secrets/StorageAccountConnectionString/)')]",
            "WEBSITE_CONTENTAZUREFILECONNECTIONSTRING": "[concat('@Microsoft.KeyVault(SecretUri=https://', parameters('keyVault.Name'), '.vault.azure.net/secrets/StorageAccountConnectionString/)')]",
            "WEBSITE_CONTENTSHARE": "[toLower(parameters('functionAppName'))]",
            "FUNCTIONS_EXTENSION_VERSION": "~3",
            "WEBSITE_NODE_DEFAULT_VERSION": "~12",
            "WEBSITE_RUN_FROM_PACKAGE": "1",
            "APPINSIGHTS_INSTRUMENTATIONKEY": "[parameters('appInsightsKey')]",
            "FUNCTIONS_WORKER_RUNTIME": "dotnet"
          }
        }
      ]
    },
    {
      "type": "Microsoft.KeyVault/vaults/accessPolicies",
      "apiVersion": "2019-09-01",
      "name": "[concat(parameters('keyVault.name'), '/add')]",
      "dependsOn": [
        "[resourceId('my-resource-group', 'Microsoft.Web/sites/functions', parameters('functionAppName'))]"
      ],
      "properties": {
        "accessPolicies": [
          {
            "tenantId": "[subscription().tenantId]",
            "objectId": "[reference(resourceId('Microsoft.Web/sites', parameters('functionAppName')), '2019-08-01', 'full').identity.principalId]",
            "permissions": {
              "secrets": [
                "get",
                "list"
              ]
            }
          }
        ]
      }
    }    
  ]
}

Jim Xu Jim Xu · Accepted Answer · 2021-03-25T02:21:40

The resource type Microsoft.Web/sites/functions indicates the function resource in the function app. It is a child resource type in Microsoft.Web/sites. So if we want to use the function resourceId to get the resource's id in are template, the expression should be like "[resourceId('my-resource-group', 'Microsoft.Web/sites/functions', parameters('functionAppName'),<function name>)]".

Besides, if we just want to get function app's id, the expression should be like "[resourceId('my-resource-group', 'Microsoft.Web/sites', parameters('functionAppName'))]".

For more details, please refer to

https://docs.microsoft.com/en-us/azure/azure-functions/functions-infrastructure-as-code

https://docs.microsoft.com/en-us/azure/templates/microsoft.web/sites/functions?tabs=json

https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-functions-resource?tabs=json#remarks-3

Add KeyVault Access Policy with DependsOn Azure Function

1 Answers