unable to deploy Azure Api management in the existingazure vnet subnet

Question

I am trying to deploy the API management in the existing vnet subnet. Its an internal API management gateway stv2 so i have to provide the public IP as well as Public IP address is required to use availability zones since my service is in a virtual network".Other team has setup the required infrastructure already like vnets, subnets, Function APP etc.The issue is when i am trying to deploy API management with public IP it throws the error message. Kindly suggest how to fix this one?

Data block section

data "azurerm_resource_group" "rg" {
  name = "azdlgleuw-rg-sharatapigw-001"
}
    
data "azurerm_virtual_network" "virtualnetwork" {
  name                = "azdlgleuw-vnet-sharatapigw-001"
  resource_group_name = data.azurerm_resource_group.rg.name
}

data "azurerm_subnet" "apisubnet" {
  name                 = "azdlgleuw-snet-sharatapigw-001"
  resource_group_name  = data.azurerm_resource_group.rg.name
  virtual_network_name = data.azurerm_virtual_network.virtualnetwork.name
}

Resource Block

resource "azurerm_public_ip" "api-pip" {
    allocation_method   = "Static"
    location            = data.azurerm_resource_group.rg.location
    name                = "azdlgleuw-pip-publicip-001"
    resource_group_name = data.azurerm_resource_group.rg.name
    sku                 = "Standard"
    zones = [1,2,3]
    sku_tier                = "Regional"
    idle_timeout_in_minutes = 4
    ip_version              = "IPv4"
    domain_name_label   = "azure-api-sharatapigw-001"
}

Creating the API management resources

resource "azurerm_api_management" "apim" {
  name                 = "azdlgleuw-apim-apimngname-001"
  resource_group_name  = data.azurerm_resource_group.rg.name
  location             = data.azurerm_resource_group.rg.location
  publisher_name       = "sharat"
  publisher_email      = "abc@xyz.com"
  virtual_network_type = "Internal"
  sku_name             = "Developer_1"

  virtual_network_configuration {
    subnet_id = data.azurerm_subnet.apisubnet.id
  }

  public_ip_address_id = azurerm_public_ip.api-pip.id
}


resource "azurerm_api_management_api" "sharatapimgmntapi" {
  name                = "azdlgleuw-apim-apimgmntapi-001"
  resource_group_name = data.azurerm_resource_group.rg.name
  api_management_name = azurerm_api_management.apim.name
  revision            = "1"
  display_name        = "sharat-api"
  path                = "extranet/v1"
  protocols           = ["https"]

  import {
    content_format = "openapi"
    content_value  = file("${path.module}/openapi.yaml")
  }  
}

resource "azurerm_api_management_api_policy" "example" {
  api_name            = azurerm_api_management_api.sharatapimgmntapi.name
  api_management_name = azurerm_api_management.apim.name
  resource_group_name = data.azurerm_resource_group.rg.name

  xml_content = <<XML
<policies>
  <inbound>
    <base />
    <set-backend-service base-url="https://azure-api-sharatapigw-001.azurewebsites.net/api" />
  </inbound>
</policies>
XML
}

Error message:

Error: creating/updating Service (Subscription: "xxxxxxxxxxxxxx" │ Resource Group Name: "azdlgleuw-rg-sharatapigw-001" │ Service Name: "azure-api-sharatapigw-001"): performing CreateOrUpdate: unexpected status 400 (400 Bad Request) with error: InvalidParameters: Invalid parameter: When updating subnetResourceId to /subscriptions/xxxxxxxx/resourceGroups/azdlgleuw-rg-sharatapigw-001/providers/Microsoft.Network/virtualNetworks/azdlgleuw-vnet-sharatapigw-001/subnets/azdlgleuw-snet-sharatapigw-001 in API Management service deployment with Virtual Network configured Internal, the Public IP Address property in location West Europe, must be a different from /subscriptions/xxxxxxxxxxxxx/resourceGroups/azdlgleuw-rg-sharatapigw-001/providers/Microsoft.Network/publicIPAddresses/azdlgleuw-pip-publicip-001 and should not match any of the existing location(s) (West Europe), as we need to create a new deployment to avoid downtime.

Answer 1

Unable to deploy Azure Api management in the existing azure vnet subnet:

1. Verify that the previously created subnet and the currently being created API Management service are located in the same region before connecting the API Management service to the subnet. Both should be in the same region if you want to use the existed one.
2. Additionally, to deploy the API Management service into an existing subnet, it is necessary to have a Network security group associated with the subnet.

Note: Associate it through portal and then try deployment once again to get succeeded.

After checking above, I tried your requirement, and the deployment was successful as shown below.

provider "azurerm"{
features{}
}
data "azurerm_resource_group" "rg" {
  name = "jahresources"
}
    
data "azurerm_virtual_network" "virtualnetwork" {
  name                = "westvnet"
  resource_group_name = data.azurerm_resource_group.rg.name
}

data "azurerm_subnet" "apisubnet" {
  name                 = "default2west"
  resource_group_name  = data.azurerm_resource_group.rg.name
  virtual_network_name = data.azurerm_virtual_network.virtualnetwork.name
}
resource "azurerm_public_ip" "api-pip" {
    allocation_method   = "Static"
    location            = data.azurerm_resource_group.rg.location
    name                = "azdlgleuw-pip-publicip-001"
    resource_group_name = data.azurerm_resource_group.rg.name
    sku                 = "Standard"
    zones = [1,2,3]
    sku_tier                = "Regional"
    idle_timeout_in_minutes = 4
    ip_version              = "IPv4"
    domain_name_label   = "azure-api-sharatapigw-001"
}
resource "azurerm_api_management" "apim" {
  name                 = "azdlgleuw-apim-apijah-001"
  resource_group_name  = data.azurerm_resource_group.rg.name
  location             = data.azurerm_resource_group.rg.location
  publisher_name       = "sharat"
  publisher_email      = "abc@xyz.com"
  virtual_network_type = "Internal"
  sku_name             = "Developer_1"

  virtual_network_configuration {
    subnet_id = data.azurerm_subnet.apisubnet.id
  }

  public_ip_address_id = azurerm_public_ip.api-pip.id
}


resource "azurerm_api_management_api" "sharatapimgmntapi" {
  name                = "azdlgleuw-apim-apimgmjah-001"
  resource_group_name = data.azurerm_resource_group.rg.name
  api_management_name = azurerm_api_management.apim.name
  revision            = "1"
  display_name        = "sharat-api"
  path                = "extranet/v1"
  protocols           = ["https"]  
}

resource "azurerm_api_management_api_policy" "example" {
  api_name            = azurerm_api_management_api.sharatapimgmntapi.name
  api_management_name = azurerm_api_management.apim.name
  resource_group_name = data.azurerm_resource_group.rg.name

  xml_content = <<XML
<policies>
  <inbound>
    <base />
    <set-backend-service base-url="https://azure-api-sharatapigw-001.azurewebsites.net/api" />
  </inbound>
</policies>
XML
}

Output: