Deploy to an Azure Web App with a private endpoint

Question

I have configured an Azure Web App with a private endpoint and want to deploy to it using Azure DevOps. I have found this possibility using Azure Blob storage and Azure CLI: https://azure.github.io/AppService/2021/03/01/deploying-to-network-secured-sites-2.html

The following Azure CLI webapp deploy command:

az webapp deploy --name $WEBAPP --resource-group $GROUP --type zip --src-url  $ZIP_URL --async false

However gives the following Http 403 error: The web app you have attempted to reach has blocked your access.

I am using a service principal to login.

Any clues what I am missing here?

Does the service principal have the right rights to deploy to this web app? — rickvdbosch
– rickvdbosch, Commented Mar 21, 2022 at 13:45
Contributor should be good. Everything else is setup correctly? You're logged in with the correct service principal? What happens when you try this method of deploying the web app from your machine? — rickvdbosch
– rickvdbosch, Commented Mar 21, 2022 at 14:20
I would use the build-in Azure web app task that is provided from Azure DevOps. You will connect your subscription and you will select your web app. Then the only thing that you will need to specify is the .zip location. - task: AzureWebApp@1 — GeralexGR
– GeralexGR, Commented Mar 21, 2022 at 14:56

Joel Neukom · Accepted Answer · 2022-07-28 05:04:58Z

3

I had the same problem and opened a Microsoft Support ticket. That was the answer: There is a problem with "az webapp deploy --src-url": It actually doesn't go via ARM API, but directly to the scm endpoint of the web-app (which is blocked due to private endpoint setup).

There is a bug reported to fix this: https://github.com/Azure/azure-cli/issues/21168

The solution in the meantime is not to use Azure cli command "az webapp deploy", but to call the ARM API directly. In your case its something like this:

az rest --method PUT --uri https://management.azure.com/subscriptions/${SUBSCRIPTIONID}/resourceGroups/${RESOURCEGROUP}/providers/Microsoft.Web/sites/${WEBAPP}/extensions/onedeploy?api-version=2022-03-01 --body '{"properties": {"type": "zip", "packageUri": ${ARTIFACTURL} }}'

This call will go via ARM proxy and won't be blocked by your private endpoint setup.

edited Jul 28, 2022 at 5:04

answered Jul 21, 2022 at 14:37

Joel Neukom

6498 silver badges7 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Rodrigo Riskalla Leal Over a year ago

The command: "az rest --method PUT ..." gives the error: "ERROR: Bad Request({"error":{"code":"BadRequest","message":"System.NullReferenceException: Object reference not set to an instance of an object.\r\n at Kudu.Services.Deployment.PushDeploymentController.<OneDeploy>d__13.MoveNext() in C:\\Kudu Files\\Private\\src\\master\\Kudu.Services\\Deployment\\PushDeploymentController.cs:line 187"}}"

Joel Neukom Over a year ago

Can you paste your full command (custom ids and SAS substituted)? Also make sire the sas, or your link points directly to your file to deploy and not a folder

Carl in 't Veld Over a year ago

Can you add to your answer how we can update the deployment logs? Currently through oneDeploy we can't trace back to the exact pipeline run.

sebrosander · Accepted Answer · 2022-08-31 04:42:21Z

Using the earlier suggested solution, I ran into the following error:

"ERROR: Bad Request({"error":{"code":"BadRequest","message":"System.NullReferenceException: Object reference not set to an instance of an object.\r\n at Kudu.Services.Deployment.PushDeploymentController.<OneDeploy>d__13.MoveNext() in C:\\Kudu Files\\Private\\src\\master\\Kudu.Services\\Deployment\\PushDeploymentController.cs:line 187"}}"

I solved this by adjusting "packageUri": ${ARTIFACTURL} to "packageUri": "'"${ARTIFACTURL}"'".

The full working task for me looks like following:

- task: AzureCLI@2
        displayName: Azure CLI
        inputs:
          azureSubscription: 'customer a'
          scriptType: bash
          scriptLocation: inlineScript
          inlineScript: |
            EXPIRY=$(date -u -d "$EXPIRY_TIME" '+%Y-%m-%dT%H:%MZ')
            az storage blob upload -f $(Pipeline.Workspace)/**/*.zip --account-name $ACCOUNT -c $CONTAINER
            ZIP_URL=$(az storage blob generate-sas --full-uri --permissions r --expiry $EXPIRY --account-name $ACCOUNT -c $CONTAINER -n s.zip | xargs)
            az rest --method PUT --uri https://management.azure.com/subscriptions/${SUBSCRIPTIONID}/resourceGroups/${GROUP}/providers/Microsoft.Web/sites/${WEBAPP}/extensions/onedeploy?api-version=2022-03-01 --body '{"properties": {"type": "zip", "packageUri": "'"${ZIP_URL}"'" }}'

Tyler2P · Accepted Answer · 2023-03-09 16:01:58Z

1

If above doesn't work then replace " with '. Below works for me

az rest --method PUT --uri https://management.azure.com/subscriptions/${SUBSCRIPTIONID}/resourceGroups/${GROUP}/providers/Microsoft.Web/sites/${WEBAPP}/extensions/onedeploy?api-version=2022-03-01 --body "{'properties': {'type': 'zip','packageUri': '${ZIP_URL}' }}"

edited Mar 9, 2023 at 16:01

Tyler2P

2,37030 gold badges26 silver badges34 bronze badges

answered Mar 1, 2023 at 16:09

Mohit

111 bronze badge

Collectives™ on Stack Overflow

Deploy to an Azure Web App with a private endpoint

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

3 Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related