Bad Request while deploying the war file from private blob storage onto app service

Question

I am trying to deploy a war file from the private blob of the container onto the app service. I have the following terraform code.

terraform {
  required_providers {
    azurerm = {
        source = "hashicorp/azurerm"
        version = "~>3.56"
    }
  }
}

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "rg" {
  name = "MyRG"
  location = "East US"
}

resource "azurerm_service_plan" "app_plan" {
  name                = "Plan1"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location
  os_type             = "Linux"
  sku_name            = "P1v2"
}
resource "azurerm_storage_account" "example" {
  name                     = "sttg2023"
  resource_group_name      = azurerm_resource_group.rg.name
  location                 = azurerm_resource_group.rg.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}
resource "azurerm_storage_container" "example1" {
  name                  = "content"
  storage_account_name  = azurerm_storage_account.example.name
  container_access_type = "private"
}
resource "azurerm_storage_blob" "blobexample" {
  name                   = "sample.war"
  storage_account_name  = azurerm_storage_account.example.name
  storage_container_name = azurerm_storage_container.example1.name
  type                   = "Block"
  source                 = "C:/Terraform/sample.war"
}

/*resource "azurerm_storage_blob" "blobexample1" {
  name                   = "Tomcat.war"
  storage_account_name  = azurerm_storage_account.example.name
  storage_container_name = azurerm_storage_container.example1.name
  type                   = "Block"
  source                 = "C:/Terraform/Tomcat.war"
}*/

resource "azurerm_linux_web_app" "app_name" {
  name                = "AppStart2023"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_service_plan.app_plan.location
  service_plan_id     = azurerm_service_plan.app_plan.id

  site_config {
    always_on = true
    application_stack {
      java_version = 8
      java_server = "TOMCAT"
      java_server_version = 9
    }
  }
  app_settings = {
    WEBSITES_PORT = 8080
  }
  provisioner "local-exec" {
    command = "az webapp deploy --resource-group ${azurerm_resource_group.rg.name} --name ${azurerm_linux_web_app.app_name.name} --src-url ${azurerm_storage_blob.blobexample.url} --type war"
  }
  /*provisioner "local-exec" {
    command = <<-EOT
      az webapp deploy --resource-group ${azurerm_resource_group.rg.name} --name ${azurerm_linux_web_app.app_name.name} --ids ${azurerm_linux_web_app.app_name.id} --src-url ${azurerm_storage_blob.blobexample.url} --type war
    EOT
  }*/
}

The error I got is

Error: local-exec provisioner error
│
│   with azurerm_linux_web_app.app_name,
│   on main.tf line 73, in resource "azurerm_linux_web_app" "app_name":
│   73:   provisioner "local-exec" {
│
│ Error running command 'az webapp deploy --resource-group MyRG --name AppStart2023 --src-url https://sttg2023.blob.core.windows.net/content/sample.war --type    
│ war': exit status 1. Output: WARNING: This command is in preview and under development. Reference and support levels: https://aka.ms/CLI_refstatus
│ ERROR: Bad Request

Can anyone help me with how to access the private blob. I do not want to change the blob access type. I want it from private blob only. Thanks in advance.

Answer 1

Bad Request while deploying the war file from private blob storage onto app service: -

To access a private blob temporarily, you need to generate a SAS token and URL to authenticate the uploaded .War file from the blob and then proceed to the app service.

Refer azurerm_storage_account_blob_container_sas for SAS_Token template structure.

I modified your code as below and the deployment was successful as shown.

provider "azurerm" {
  features {}
}
variable "sastoken" {
}
resource "azurerm_resource_group" "rg" {
  name = "MyRGnew"
  location = "East US"
}

resource "azurerm_service_plan" "app_plan" {
  name                = "Plan1"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_resource_group.rg.location
  os_type             = "Linux"
  sku_name            = "P1v2"
}
resource "azurerm_storage_account" "example" {
  name                     = "sttg2023jahnavii"
  resource_group_name      = azurerm_resource_group.rg.name
  location                 = azurerm_resource_group.rg.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}
resource "azurerm_storage_container" "example1" {
  name                  = "content"
  storage_account_name  = azurerm_storage_account.example.name
  container_access_type = "private"
}
resource "azurerm_storage_blob" "blobexample" {
  name                   = "sample.warf"
  storage_account_name  = azurerm_storage_account.example.name
  storage_container_name = azurerm_storage_container.example1.name
  type                   = "Block"
  source                 = "/home/xxxx/SampleWebApp.war"
}
data "azurerm_storage_account_blob_container_sas" "example" {
  connection_string = azurerm_storage_account.example.primary_connection_string
  container_name    = azurerm_storage_container.example1.name
  https_only        = true

  ip_address = "xxxx"

  start  = "2023-03-21"
  expiry = "2023-04-25"

  permissions {
    read   = true
    write  = false
    delete = true
  }
  content_language    = "en-US"
  content_type        = "application/json"
}
locals {
  sastoken = data.azurerm_storage_account_blob_container_sas.example.sas
  }
resource "azurerm_linux_web_app" "app_name" {
  name                = "AppStart2023jahnav"
  resource_group_name = azurerm_resource_group.rg.name
  location            = azurerm_service_plan.app_plan.location
  service_plan_id     = azurerm_service_plan.app_plan.id

  site_config {
    always_on = true
    application_stack {
      java_version = 8
      java_server = "TOMCAT"
      java_server_version = 9
    }
  }
  app_settings = {
    WEBSITES_PORT = 8080
  }
  provisioner "local-exec" {
    command = <<-EOT
     az webapp deploy --ids ${azurerm_linux_web_app.app_name.id} --src-url ${azurerm_storage_blob.blobexample.url} --type war --sas-token ${local.sastoken}
    EOT
  }
}

Output: