Application Gateway integration with Azure Key Vault issue

Question

Hopefully someone can help there.

I am trying to integrate Azure Application Gateway with Key Vault using ARM template and getting an issue:

SecretIdSpecifiedIsInvalid: SecretId '==' specified in '/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx/resourceGroups/rg-ProjectX-dev-infra/providers/Microsoft.Network/applicationGateways/appgw-ProjectX-dev/sslCertificates/appGwSslCert' is invalid. []

User assigned managed identity of Application Gateway has proper permissions ('Get' and 'List' under secrets and certificates) in Azure Key Vault.

Certificate is self-signed and generated in Azure Key Vault. It works as expected if I add certificate using Azure portal but it fails to add using ARM template.

The following guides were used during deployment: TLS termination with Key Vault certificates and Pass sensitive values

Parameters.json file:

"app-gateway-httpsvaultCert": {
  "reference": {
    "keyVault": {
      "id": "/subscriptions/xxxx-xxxx-xxxx-xxxx-xxxx/resourceGroups/rg-projeX-dev-infra/providers/Microsoft.KeyVault/vaults/kv-ProjectX-dev"
    },
    "secretName": "zzz-zzz-zzz-zzz"
  }
},

Defined parameter as secure string in the template file:

"app-gateway-httpsvaultCert": {
        "type": "securestring",
        "metadata": {
            "description": "Secure access string from Azure Application Gateway to Key Vault."
        }
    },

Template.json file:

{
        "type": "Microsoft.Network/applicationGateways",
        "apiVersion": "2020-11-01",
        "name": "[variables('app-gateway-name')]",
        "location": "[parameters('location')]",
        "tags": "[parameters('resource-Tags')]",           
        "dependsOn": [
            "[resourceId('Microsoft.Insights/components', variables('app-insights-name'))]",
            "[resourceId('Microsoft.Network/publicIPAddresses', variables('public-ip-name'))]",
            "[resourceId('Microsoft.Network/virtualNetworks', variables('vnet-name'))]",
            "[resourceId('Microsoft.KeyVault/vaults', variables('kv-name'))]"
        ],
        "identity": {
            "type": "UserAssigned",
            "userAssignedIdentities": {
                "[resourceId('Microsoft.ManagedIdentity/userAssignedIdentities', variables('appgw-managed-id'))]": {
                }
            }
        },
        "properties": {
            "sku": {
                "name": "Standard_v2",
                "tier": "Standard_v2",
                "capacity": "[parameters('app-gateway-capacity')]"
            },
            "gatewayIPConfigurations": [
                {
                    "name": "appGatewayIpConfig",
                    "properties": {
                        "subnet": {
                            "id": "[resourceId('Microsoft.Network/virtualNetworks/subnets', variables('vnet-name'), 'appgw-subnet')]"
                        }
                    }
                }
            ],
            "sslCertificates": [
                {
                    "name": "appGwSslCert",
                    "properties": {
                        "keyVaultSecretId": "[parameters('app-gateway-httpsvaultCert')]"
                    }
                }
            ],
            "trustedRootCertificates": [],
            "frontendIPConfigurations": [
                {
                    "name": "appGwPublicFrontendIp",
                    "properties": {
                        "privateIPAllocationMethod": "Dynamic",
                        "publicIPAddress": {
                            "id": "[resourceId('Microsoft.Network/publicIPAddresses', variables('public-ip-name'))]"
                        }
                    }
                }
            ],
            "frontendPorts": [
                {
                    "name": "port_443",
                    "properties": {
                        "port": 443
                    }
                }
            ],
            "backendAddressPools": [
                {
                    "name": "gatewayBackEnd",
                    "properties": {
                        "backendAddresses": [
                            {
                                "fqdn": "[concat(variables('apim-name'), '.azure-api.net')]"
                            },
                            {
                                "fqdn": "[concat(variables('fr-name'), '.cognitiveservices.azure.com')]"
                            }
                        ]
                    }
                }
            ],
            "backendHttpSettingsCollection": [
                {
                    "name": "global-gateway-https-setting",
                    "properties": {
                        "port": 443,
                        "protocol": "Https",
                        "cookieBasedAffinity": "Disabled",
                        "pickHostNameFromBackendAddress": true,
                        "requestTimeout": 20,
                        "probe": {
                            "id": "[resourceId('Microsoft.Network/applicationGateways/probes', variables('app-gateway-name'), 'global-gateway-probe')]"
                        }
                    }
                }
            ],
            "httpListeners": [
                {
                    "name": "global-listener-https",
                    "properties": {
                        "frontendIPConfiguration": {
                            "id": "[resourceId('Microsoft.Network/applicationGateways/frontEndIPConfigurations', variables('app-gateway-name'), 'appGwPublicFrontendIp')]"
                        },
                        "frontendPort": {
                            "id": "[resourceId('Microsoft.Network/applicationGateways/frontEndPorts', variables('app-gateway-name'), 'port_443')]"
                        },
                        "protocol": "Https",
                        "sslCertificate": {
                            "id": "[resourceId('Microsoft.Network/applicationGateways/sslCertificates', variables('app-gateway-name'), 'appGwSslCert')]"
                        },
                        "hostNames": [],
                        "requireServerNameIndication": false
                    }
                }
            ],
            "urlPathMaps": [],
            "requestRoutingRules": [
                {
                    "name": "global-routing-rule",
                    "properties": {
                        "ruleType": "Basic",
                        "httpListener": {
                            "id": "[resourceId('Microsoft.Network/applicationGateways/httpListeners', variables('app-gateway-name'), 'global-listener-https')]"
                        },
                        "backendAddressPool": {
                            "id": "[resourceId('Microsoft.Network/applicationGateways/backendAddressPools', variables('app-gateway-name'), 'gatewayBackEnd')]"
                        },
                        "backendHttpSettings": {
                            "id": "[resourceId('Microsoft.Network/applicationGateways/backendHttpSettingsCollection', variables('app-gateway-name'), 'global-gateway-https-setting')]"
                        }
                    }
                }
            ],
            "probes": [
                {
                    "name": "global-gateway-probe",
                    "properties": {
                        "protocol": "Https",
                        "port": 443,
                        "path": "/status-0123456789abcdef",
                        "interval": 30,
                        "timeout": 30,
                        "unhealthyThreshold": 3,
                        "pickHostNameFromBackendHttpSettings": true,
                        "minServers": 0
                    }
                }
            ],
            "rewriteRuleSets": [],
            "redirectConfigurations": [],
            "privateLinkConfigurations": [],
            "sslPolicy": {
                "policyType": "Predefined",
                "policyName": "AppGwSslPolicy20170401S"
            },
            "enableHttp2": true
        }
    },

codeunit · Accepted Answer · 2021-08-16 05:49:07Z

0

An issue has been fixed changing template.json and parameters.json files accordingly:

Template.json:

"app-gateway-httpsvaultCert": {
    "type": "String",
    "defaultValue": "https://[KeyVaultName].vault.azure.net/secrets/[CertName]",
    "metadata": {
        "description": "The base-64 encoded SSL certificate PFX data. Must be supplied via a parameters file references to a Key Vault / Secret Name."
    }
}

Parameters.json:

"app-gateway-httpsvaultCert": {
  "value": 
  "https://[KeyVaultName].vault.azure.net/secrets/[CertName]"
}

answered Aug 16, 2021 at 5:49

codeunit

252 silver badges6 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Application Gateway integration with Azure Key Vault issue

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related