Azure Terraform Web App private Endpoint virtual network

Question

I am trying to automate the deployment of an azure virtual network and azure web app. During the deployment of those resources, everything went just fine and no errors. So I wanted to try to activate the private endpoint on the web app. This is my configuration on terraform.

resource "azurerm_virtual_network" "demo-vnet" {
  name                = "virtual-network-test"
  address_space       = ["10.100.0.0/16"]
  location            = var.location
  resource_group_name = azurerm_resource_group.rg-testing-env.name
}

resource "azurerm_subnet" "front_end" {
  name                 = "Front_End-Subnet"
  address_prefixes     = ["10.100.5.0/28"]
  virtual_network_name = azurerm_virtual_network.demo-vnet.name
  resource_group_name  = azurerm_resource_group.rg-testing-env.name
  delegation {
    name = "testing-frontend"
    service_delegation {
      name    = "Microsoft.Web/serverFarms"
      actions = ["Microsoft.Network/virtualNetworks/subnets/action"]
    }
  }
}

And on the web app itself, I set this configuration

resource "azurerm_app_service_virtual_network_swift_connection" "web-app-vnet" {
  app_service_id = azurerm_app_service.app-test.example.id
  subnet_id      = azurerm_subnet.front_end.id
}

NOTE: On my first deployment, the swift failed because I had not delegation on the virtual network, so I had to add the delegation on the subnet to be able to run terraform.

After setting in place all the configuration, I run my terraform, everything run just smoothly, no errors. After the completion, I checked my web app Private Endpoint and that was just off.

Can please anyone explain me what am I doing wrong here?. I thought that the swift connection was the block of code to activate the Private endpoint but apparently I am missing something else.

Just to confirm my logic workflow, I tried to do the manual steps in the portal. But surprisingly I was not able because I have the delegation on the subnet, as you can see.

Thank you so much for any help and/or explanation you can offer to solve this issue

Answer 1

I have used the below code to test the creation of VNET and Web app with private endpoint.

provider "azurerm" {
    features{}
}

data "azurerm_resource_group" "rg" {
  name     = "ansumantest"
}

# Virtual Network
resource "azurerm_virtual_network" "vnet" {
  name                = "ansumanapp-vnet"
  location            = data.azurerm_resource_group.rg.location
  resource_group_name = data.azurerm_resource_group.rg.name
  address_space       = ["10.4.0.0/16"]
}

# Subnets for App Service instances
resource "azurerm_subnet" "appserv" {
  name                 = "frontend-app"
  resource_group_name  = data.azurerm_resource_group.rg.name
  virtual_network_name = azurerm_virtual_network.vnet.name
  address_prefixes     = ["10.4.1.0/24"]
  enforce_private_link_endpoint_network_policies = true
  }

 
# App Service Plan
resource "azurerm_app_service_plan" "frontend" {
  name                = "ansuman-frontend-asp"
  location            = data.azurerm_resource_group.rg.location
  resource_group_name = data.azurerm_resource_group.rg.name
  kind                = "Linux"
  reserved            = true

  sku {
    tier = "Premium"
    size = "P1V2"
  }
}


# App Service
resource "azurerm_app_service" "frontend" {
  name                = "ansuman-frontend-app"
  location            = data.azurerm_resource_group.rg.location
  resource_group_name = data.azurerm_resource_group.rg.name
  app_service_plan_id = azurerm_app_service_plan.frontend.id

}
#private endpoint

resource "azurerm_private_endpoint" "example" {
  name                = "${azurerm_app_service.frontend.name}-endpoint"
  location            = data.azurerm_resource_group.rg.location
  resource_group_name = data.azurerm_resource_group.rg.name
  subnet_id           = azurerm_subnet.appserv.id
  

  private_service_connection {
    name                           = "${azurerm_app_service.frontend.name}-privateconnection"
    private_connection_resource_id = azurerm_app_service.frontend.id
    subresource_names = ["sites"]
    is_manual_connection = false
  }
}

# private DNS
resource "azurerm_private_dns_zone" "example" {
  name                = "privatelink.azurewebsites.net"
  resource_group_name = data.azurerm_resource_group.rg.name
}

#private DNS Link
resource "azurerm_private_dns_zone_virtual_network_link" "example" {
  name                  = "${azurerm_app_service.frontend.name}-dnslink"
  resource_group_name   = data.azurerm_resource_group.rg.name
  private_dns_zone_name = azurerm_private_dns_zone.example.name
  virtual_network_id    = azurerm_virtual_network.vnet.id
  registration_enabled = false
}

Requirements:

• As you can see from the above code the Private Endpoint , Private DNS and Private DNS Link block are required for creating the private endpoint and enabling it for the app service.
• The App service Plan needs to have Premium Plan for having Private endpoint.
• The Subnet to be used by Private Endpoint should have enforce_private_link_endpoint_network_policies = true set other wise it will error giving message as subnet has private endpoint network policies enabled , it should be disabled to be used by Private endpoint.
• DNS zone name should only be privatelink.azurewebsites.net as you are creating a private endpoint for webapp.

Outputs: