autorest | OpenAPI (f | REST library

Storage Account and Container names are Pulumi outputs, meaning they may not be known yet at the time when the program runs. You need to format the path using Output.all:

So I managed to find a workaround by using a debugger and inspecting the err object. It isn't particularly pretty, but it does work.

1. Looking into the AutoRest source code, it will only create public constructors if the security schema in the OpenAPI spec is set to AzureKey or AADtoken. This is verified in their docs AutoRest source code
   AutoRest Security Schemes documentation

2. The table for AutoRest flags says that the --add-credential does nothing for the .NET clients (4th column from the left).
   https://github.com/Azure/autorest/blob/main/docs/generate/flags.md#shared-flags

It appears that AutoRest v3 is only for APIs hosted on Azure itself. With the evidence above, as well as the fact that required parameters for constructors of generated clients, like ClientDiagnostics, are declared internal, I think we're going to have to find another API client generator.

If you disable local accounts you need to activate AKS-managed Azure Active Directory integration as you have no more local accounts to authenticate against AKS.

This example enables RBAC, Azure AAD & Azure RBAC:

I solved it by adding the following to my command line arguments:

If you are giving name = azurerm_storage_account.website_installers_account.id in storage account block for your then it will give the below error . So , you have to give a name to it only which you want to set like WebsiteStorageConnectionString.

And for the second error that you get as below because we can't use Azure Blobs on Windows App Service ,It is a limitation from Microsoft end as mentioned in this Microsoft Document.So, as a solution you can use kind = linux in app service plan block or you can create a file share and use it with app service if you don't want to change kind.

Solutions:

1. Creating a file share instead of Container and Using AzureFiles instead of Azure blobs.

Terraform uses Auth V1 Settings instead of using Auth V2 setting for the Web App. Currently only Azure CLI cmdlet and ARM Templates allow the auth_settings_v2 to be configured. This might be available in the upcoming version of azurerm provider i.e. v3.0.0 as mentioned under Feature details: New Data Sources / Resources for App Service & Function Apps .

As for the error which you are getting , I tried creating a App Service in Azure using similar code as yours and it didn't provide any error in the initial creation but after I go to portal and under authentication setting , I upgrade the authentication settings to v2 . I start receiving the same error while trying to update the application from terraform like below :

In order to avoid the error , if you are using terraform to create and manage the web app , then please don't upgrade Web Authentication Settings .

This is an expected behavior as you are setting up the network rules for the storage account to deny and only bypassing the Azure Services.

When you deny and bypass Azure Services the Azure Services like Azure Portal's IP gets the access to the storage account and you are able to delete it . But at the same time , when you use terraform to perform a destroy , then it denies because your IP which is being used by your machine to send terraform requests to Azure is not bypassed .

I tested your code like below with the same permissions :

As a Solution you will have to add ip rules while creating the storage account to the add the client_ip like below :

Please check the Microsoft Graph permission Directory.ReadWrite.All has been provided to the service connection and it has been granted the admin consent.

I tested the same in my environment where I gave the permission to my service principal but didn't grant admin consent like below :

When deploying the below code, it gave me error :