Problem with IP Restriction rules in azurerm_app_service resource #2488

alexeyklots · 2018-12-11T13:45:24Z

Hi,

We stepped into the strange problem while working with "IP Restriction" azurerm_app_service resource functionality. There is a need to manage this IP Restriction rules externally by using PowerShell script and not with Terraform. Below are detailed steps we followed:

We successfully applied needed restriction rules via script.
Then we decided to change tags (basically any change) for app_service resource via TF. After that rules became broken and we see this:
I've tried to add IP Restriction list to Lifecycle->Ignore Changes part of the app_service resource, like this:
lifecycle {
ignore_changes = [
"site_config.0.scm_type",
"site_config.0.ip_restriction"
]
}
But this does not help whenever we change IP restriction rules externally and then apply TF, rules became broken.
At the same time, looks like, current implementation of azurerm_app_service resource IP Restriction part is using old Azure API 2016-08-01 instead of 2018-02-01 (https://docs.microsoft.com/en-us/azure/app-service/app-service-ip-restrictions). In old API you need just to specify 2 parameters: ip_address and subnet_mask. But for new API ip_restriction consists of the next parameters:
{
"ipAddress": "131.107.159.0/24",
"action": "Allow",
"tag": "Default",
"priority": 100,
"name": "allowed access"
}
So basically when TF Apply run against app_service resource it is using old API and this just break IP Restriction rules at all.

So I have two questions:

How can we ignore changes for IP Restriction rules applied externally?
What is the best way to handle such case?

Community Note

Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
If you are interested in working on this issue or have submitted a pull request, please leave a comment

Terraform (and AzureRM Provider) Version

Terraform v0.11.7

provider.azurerm v1.19.0
provider.random v2.0.0
provider.template v1.0.0

Affected Resource(s)

azurerm_app_service

Terraform Configuration Files

# Copy-paste your Terraform configurations here - for large Terraform configs,
# please use a service like Dropbox and share a link to the ZIP file. For
# security, you can also encrypt the files using our GPG public key: https://keybase.io/hashicorp

Debug Output

Panic Output

Expected Behavior

Actual Behavior

Steps to Reproduce

terraform apply

Important Factoids

References

#0000

The text was updated successfully, but these errors were encountered:

najgel · 2019-02-04T15:58:18Z

Up until last week this was a nuisance but today when I logged in to check a azure web app in the portal the iprestrictions blade is broken because of this. The gui fails because of a null reference when trying to apply "tolower" to a property which makes me suspect the name property of the rule. If I use https://resources.azure.com/ to find the ip restriction rule in the app and add a name property to the rule the iprestrictions blade loads normally.

jamie3 · 2019-02-05T19:50:23Z

We are experiencing the same issues.

snerting · 2019-02-07T14:30:18Z

This bug do our use of Terraform terrible. Without possible to add priority and name, our app service, would not work. This bug cause us to must add a manual step, where we must remember config this in portal after apply.

jamie3 · 2019-02-07T14:34:02Z

In cases like this we usually use Powershell script.

turjachaudhuri · 2019-03-08T15:23:57Z

Has this issue been fixed yet?

alexeyklots · 2019-03-08T19:24:36Z

@turjachaudhuri, unfortunately no, it has to be fixed in next release (1.23) but it was moved to 1.25 release...

turjachaudhuri · 2019-06-11T09:44:25Z

Has this issue been fixed ? in Azure provider 1.25 version ? Or in any later version ? Can somebody let me know.

terryjoycenhs · 2019-06-11T09:50:08Z

No it hasn't which is annoying as it would be really useful to label the IP addresses in the portal.

alastairtree · 2019-08-09T09:37:31Z

While we wait for this to be updated the following code using azurerm templates can set the IpSecurityRestrictions and scmIpSecurityRestrictions properties on the site config on every terraform apply if added in addition to an existing app service resource deployment.

resource "azurerm_template_deployment" "ipwhitelist" {
  name                = "${var.application}-ipwhitelist"
  resource_group_name = var.resource_group_name
  template_body       = <<JSON
{
  "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
  "contentVersion": "1.0.0.0",
  "variables": {
     "_force_terraform_to_always_redeploy": "${timestamp()}"
  },
  "resources": [{
     "type":"Microsoft.Web/sites/config",
         "apiVersion":"2018-11-01",
         "name":"${azurerm_app_service.app_service.name}/web",
         "location":"[resourceGroup().location]",
         "properties":{
            "IpSecurityRestrictions":[
               {
                  "ipAddress":"${local.some_address_to_allow}",
                  "action":"Allow",
                  "tag":"Default",
                  "priority":300,
                  "name":"Allow_My_Proxy",
                  "description":"useful info"
               }
            ],
          "scmIpSecurityRestrictions":[
               {
                  "ipAddress":"${local.some_address_to_allow}",
                  "action":"Allow",
                  "tag":"Default",
                  "priority":300,
                  "name":"Allow_My_Proxy",
                  "description":"useful info"
               }
            ]
         }
    }
  ]
}
JSON
  deployment_mode     = "Incremental"
}

ravulachetan · 2019-08-13T20:49:08Z

Is there a way to use ip_restriction with Type as 'Virtual Network' using Terraform?

JleruOHeP · 2020-04-16T23:23:56Z

To add it as VNet restriction you use virtual_network_subnet_id :

    ip_restriction {
      virtual_network_subnet_id = "${data.azurerm_subnet.app_gateway_subnet.id}"
    }

But was there any progress on adding names and priorities?

sebader · 2020-05-01T13:18:50Z

@JleruOHeP yes, there is just now an open PR for names and priorities :) #6705

Eslam10 · 2020-07-31T13:29:12Z

I am facing the same issue, was this fixed ?

martinjt · 2020-10-06T18:01:56Z

I'm pretty sure that this now works, other than some issues with changing between ip and subnet.

    ip_restriction {
      ip_address                = 10.0.0.0/8
      priority                  = 1000
      name                      = "InternalAppSubnet"
      action                    = "Allow"
      virtual_network_subnet_id = null
      subnet_id                 = null
    }

or

    ip_restriction {
      ip_address                = null
      priority                  = 1000
      name                      = "InternalAppSubnet"
      action                    = "Allow"
      virtual_network_subnet_id = var.connected_subnet_id
      subnet_id                 = var.connected_subnet_id
    }

Note setting both virtual_network_subnet_id and subnet_id to the same value

alexmanie · 2020-11-20T14:19:19Z

Hi @martinjt ,
What about working with "Service Tag" Access Restrictions?

Seems those rules are not supported yet. I'm right?

martinjt · 2020-11-21T00:21:27Z

I've not seen that in the terraform docs.

mrboogiee · 2021-01-20T10:25:05Z

have just upgraded to v2.43 and tried to get this working with the documentation on https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/function_app but ran into the following issues with the below configuration:

 site_config {
    ip_restriction = [
      {
        name="Allow manual triggering from somewhere"
        ip_address = "1.2.3.4/24"
        action = "Allow"
        priority = "400"
      },
      {
        name = "Allow trigger from LogicApp"
        service_tag = "LogicApps"
        action = "Allow"
        priority = "300"
      },      
    ]  
  }

This resulted in the following error when executing plan:

Error: Incorrect attribute value type

  on functions.tf line 190, in resource "azurerm_function_app" "function":
 190:     ip_restriction = [
 191:       {
 192:         name="Allow manual triggering from somewhere"
 193:         ip_address = "1.2.3.4/24"
 194:         action = "Allow"
 195:         priority = "400"
 196:       },
 197:       {
 198:         name = "Allow trigger from LogicApp"
 199:         service_tag = "LogicApps"
 200:         action = "Allow"
 201:         priority = "300"
 202:       },
 203:     ]

Inappropriate value for attribute "ip_restriction": element 0: attributes
"service_tag", "subnet_id", and "virtual_network_subnet_id" are required.

If I then add the apparently (although the documentation says otherwise) required fields with empty values like below:

  site_config {
    ip_restriction = [
      {
        name="Allow manual triggering from somewhere"
        ip_address = "1.2.3.4/24"
        action = "Allow"
        priority = "400"
        service_tag = ""
        subnet_id = ""
        virtual_network_subnet_id = ""
      },
      {
        name = "Allow trigger from LogicApp"
        service_tag = "LogicApps"
        action = "Allow"
        priority = "300"
        ip_address = ""
        subnet_id = ""
        virtual_network_subnet_id = ""
      },
    ]
  }

I run into the following errors when executing plan:

Warning: "site_config.0.ip_restriction.0.subnet_id": [DEPRECATED] This field has been deprecated in favour of `virtual_network_subnet_id` and will be removed in a future version of the provider

  on functions.tf line 173, in resource "azurerm_function_app" "function":
 173: resource "azurerm_function_app" "function" {



Warning: "site_config.0.ip_restriction.1.subnet_id": [DEPRECATED] This field has been deprecated in favour of `virtual_network_subnet_id` and will be removed in a future version of the provider

  on functions.tf line 173, in resource "azurerm_function_app" "function":
 173: resource "azurerm_function_app" "function" {



Error: expected "site_config.0.ip_restriction.0.service_tag" to not be an empty string, got

  on functions.tf line 173, in resource "azurerm_function_app" "function":
 173: resource "azurerm_function_app" "function" {



Error: expected "site_config.0.ip_restriction.0.subnet_id" to not be an empty string, got

  on functions.tf line 173, in resource "azurerm_function_app" "function":
 173: resource "azurerm_function_app" "function" {



Error: expected "site_config.0.ip_restriction.0.virtual_network_subnet_id" to not be an empty string, got

  on functions.tf line 173, in resource "azurerm_function_app" "function":
 173: resource "azurerm_function_app" "function" {



Error: expected "site_config.0.ip_restriction.1.virtual_network_subnet_id" to not be an empty string, got

  on functions.tf line 173, in resource "azurerm_function_app" "function":
 173: resource "azurerm_function_app" "function" {



Error: expected "site_config.0.ip_restriction.1.ip_address" to be a valid IPv4 Value, got : invalid CIDR address:

  on functions.tf line 173, in resource "azurerm_function_app" "function":
 173: resource "azurerm_function_app" "function" {



Error: expected "site_config.0.ip_restriction.1.subnet_id" to not be an empty string, got

  on functions.tf line 173, in resource "azurerm_function_app" "function":
 173: resource "azurerm_function_app" "function" {

mrboogiee · 2021-01-20T10:27:27Z

for completeness sake, the documentation currently says the following:

A ip_restriction block supports the following:

ip_address - (Optional) The IP Address used for this IP Restriction in CIDR notation.

service_tag - (Optional) The Service Tag used for this IP Restriction.

virtual_network_subnet_id - (Optional) The Virtual Network Subnet ID used for this IP Restriction.

NOTE:
One of either ip_address, service_tag or virtual_network_subnet_id must be specified

name - (Optional) The name for this IP Restriction.

priority - (Optional) The priority for this IP Restriction. Restrictions are enforced in priority order. By default, the priority is set to 65000 if not specified.

action - (Optional) Does this restriction Allow or Deny access for this IP range. Defaults to Allow.

Sebs030 · 2021-02-15T08:51:22Z

I am running into the same issue as @mrboogiee
When following the documentaton with optional params and only setting the ip_adress i get following error

Error: Incorrect attribute value type

  on maint.tf line 113, in resource "azurerm_app_service" "microservice":
 113:     ip_restriction = [{
 114:       action     = "Allow"
 115:       ip_address = "${azurerm_app_service.gateway.outbound_ip_address_list[0]}/32"
 116:       name       = "Allow Gateway Access from IP"
 117:       priority   = 100
 118:     }]

Inappropriate value for attribute "ip_restriction": element 0: attributes
"service_tag", "subnet_id", and "virtual_network_subnet_id" are required.

When adding these params as per error message with some dummy values i get the following error:

Error: Error expanding site_config for App Service "5i-terraform-user-svc" (Resource Group "5i-terraform"): only one of ip_address, service_tag or virtual_network_subnet_id can be set for an IP restriction

I got it working with

    ip_restriction = [{
      ip_address                = "${azurerm_app_service.gateway.outbound_ip_address_list[0]}/32"
      name                      = "Allow Gateway Access from IP"
      action                    = "Allow"
      virtual_network_subnet_id = null
      subnet_id                 = null
      priority                  = 100
      service_tag               = null
    }]

vanmash · 2021-08-06T17:14:39Z

Any chances it might be fixed anytime soon?

rellis-of-rhindleton · 2022-08-26T20:16:57Z

I don't like leaving maybe-this-is-related comments in an issue, but... well, this could be related to the original issue. This issue was opened when azurerm_app_service was the resource; we are using the new azurerm_linux_web_app but apparently it works the same way.

I can't get Terraform to clear the ip_restriction list. I can change the entries by specifying different values. But I can't remove all entries.

If I specify an empty list (ip_restriction = []), the plan will show that the entry will be removed, and the apply will succeed. Yet the entry remains. This repeats indefinitely; the plan says the entry will be removed, but it is not.

Apparently ip_restriction uses Attributes-as-Blocks syntax underneath, so simply removing the blocks from the configuration -- or using dynamic blocks, which does the same thing -- causes Terraform to ignore any existing entries rather than remove them. For that kind of block you have to specify an empty list. But I tried just removing the blocks anyway, and it does indeed ignore the existing entry; the plan shows no action.

Per the linked Terraform doc, attributes as blocks is a legacy implementation and this might explain why things don't work, but of course now I'm just speculating.

jaysson1710 · 2022-09-29T01:43:12Z

Hi guys,
I'm using dynamic block and get the same result
" only one of ip_address, service_tag, or virtual_network_subnet_id can be specified"

dynamic "ip_restriction" {
      for_each = var.ip_whitelist
      content {
        action = "Allow"
        ip_address = ip_restriction.value
        name = "Allow_vsts${index(var.ip_whitelist, "${ip_restriction.value}")}"
        priority = index(var.ip_whitelist, "${ip_restriction.value}") + 102
        service_tag = "Default"
      }
      
    }

have anybody used this approach?

katbyte · 2023-07-19T17:00:22Z

Hey all i am going to close this because the azurerm_app_service has been superceeded by the azurerm_linux_web_app and azurerm_windows_web_app resources.

If this is still an issue with v3.x of the provider and the new resources do let us know by opening a new issue, thanks!

katbyte added bug service/app-service labels Dec 12, 2018

tombuildsstuff added this to the 1.23.0 milestone Feb 9, 2019

tombuildsstuff modified the milestones: 1.23.0, 1.25.0 Mar 5, 2019

alexeyklots closed this as completed Mar 8, 2019

alexeyklots reopened this Mar 8, 2019

tombuildsstuff modified the milestones: v1.25.0, v1.24.0 Mar 14, 2019

tombuildsstuff modified the milestones: v1.24.0, Future Mar 28, 2019

mikhailshilkov mentioned this issue May 28, 2019

Hiding App Service behind a VNet pulumi/pulumi-azure#263

Closed

sawyerh mentioned this issue Jun 18, 2019

Support App Service "Access Restrictions" functionality #3685

Closed

midgleyc mentioned this issue Jul 1, 2019

Updating an app service with an access restriction rule involving a VNet crashes #3760

Closed

mcdafydd mentioned this issue Jan 14, 2020

Better container support for linux web apps CLEAResult/cr-azurerm_app_service#2

Merged

catriona-m added the v/1.x (legacy) label Jul 19, 2023

katbyte closed this as completed Jul 19, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Problem with IP Restriction rules in azurerm_app_service resource #2488

Problem with IP Restriction rules in azurerm_app_service resource #2488

alexeyklots commented Dec 11, 2018

najgel commented Feb 4, 2019

jamie3 commented Feb 5, 2019

snerting commented Feb 7, 2019

jamie3 commented Feb 7, 2019

turjachaudhuri commented Mar 8, 2019

alexeyklots commented Mar 8, 2019

turjachaudhuri commented Jun 11, 2019

terryjoycenhs commented Jun 11, 2019

alastairtree commented Aug 9, 2019

ravulachetan commented Aug 13, 2019

JleruOHeP commented Apr 16, 2020

sebader commented May 1, 2020

Eslam10 commented Jul 31, 2020

martinjt commented Oct 6, 2020

alexmanie commented Nov 20, 2020

martinjt commented Nov 21, 2020

mrboogiee commented Jan 20, 2021

mrboogiee commented Jan 20, 2021

Sebs030 commented Feb 15, 2021 •

edited

vanmash commented Aug 6, 2021

rellis-of-rhindleton commented Aug 26, 2022

jaysson1710 commented Sep 29, 2022

katbyte commented Jul 19, 2023

Problem with IP Restriction rules in azurerm_app_service resource #2488

Problem with IP Restriction rules in azurerm_app_service resource #2488

Comments

alexeyklots commented Dec 11, 2018

Community Note

Terraform (and AzureRM Provider) Version

Affected Resource(s)

Terraform Configuration Files

Debug Output

Panic Output

Expected Behavior

Actual Behavior

Steps to Reproduce

Important Factoids

References

najgel commented Feb 4, 2019

jamie3 commented Feb 5, 2019

snerting commented Feb 7, 2019

jamie3 commented Feb 7, 2019

turjachaudhuri commented Mar 8, 2019

alexeyklots commented Mar 8, 2019

turjachaudhuri commented Jun 11, 2019

terryjoycenhs commented Jun 11, 2019

alastairtree commented Aug 9, 2019

ravulachetan commented Aug 13, 2019

JleruOHeP commented Apr 16, 2020

sebader commented May 1, 2020

Eslam10 commented Jul 31, 2020

martinjt commented Oct 6, 2020

alexmanie commented Nov 20, 2020

martinjt commented Nov 21, 2020

mrboogiee commented Jan 20, 2021

mrboogiee commented Jan 20, 2021

Sebs030 commented Feb 15, 2021 • edited

vanmash commented Aug 6, 2021

rellis-of-rhindleton commented Aug 26, 2022

jaysson1710 commented Sep 29, 2022

katbyte commented Jul 19, 2023

Sebs030 commented Feb 15, 2021 •

edited