zip_deploy_file publishing failed with status code 401 Unauthorized

[uday31in]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Terraform Version

1.13.0

AzureRM Provider Version

3.100.0

Affected Resource(s)/Data Source(s)

azurerm_linux_function_app

Terraform Configuration Files

resource "azurerm_linux_function_app" "shortclip_function" {
  name                                           = var.shortclip_function_service_name
  resource_group_name                            = var.resource_group_name
  location                                       = var.location
  storage_account_name                           = data.azurerm_storage_account.functions_storage.name
  storage_uses_managed_identity                  = true
  webdeploy_publish_basic_authentication_enabled = true
  # ftp_publish_basic_authentication_enabled       = true
  service_plan_id = azurerm_service_plan.service_plan.id
  identity {
    # type = "SystemAssigned"
    type         = "UserAssigned"
    identity_ids = [var.user_assigned_identity_id]
  }
  app_settings = {
    AzureWebJobsStorage            = data.azurerm_storage_account.functions_storage.name
    APPINSIGHTS_INSTRUMENTATIONKEY = var.instrumentation_key
    ENABLE_ORYX_BUILD              = true
    # WEBSITE_RUN_FROM_PACKAGE                     = azurerm_storage_blob.shortclip_function_blob.url
    # WEBSITE_RUN_FROM_PACKAGE_BLOB_MI_RESOURCE_ID = var.user_assigned_identity_id
    SCM_DO_BUILD_DURING_DEPLOYMENT = true
    WEBSITE_RUN_FROM_PACKAGE       = 1
    FUNCTIONS_WORKER_RUNTIME       = "python"
    AzureWebJobsFeatureFlags       = "EnableWorkerIndexing"
    TaskHubName                    = "shortclip"
    AZURE_OPEN_AI_BASE_URL         = var.cognitive_service_endpoint
  }
  site_config {
    application_stack {
      python_version = "3.11"
    }
  }
  zip_deploy_file = data.archive_file.rag_video_tagging.output_path 
}

### Debug Output/Panic Output

```shell
module.functions.azurerm_linux_function_app.shortclip_function: Still creating... [50s elapsed]
2024-04-26T19:40:30.437+0100 [TRACE] dag/walk: vertex "provider[\"registry.terraform.io/hashicorp/azurerm\"] (close)" is waiting for "module.functions.azurerm_linux_function_app.shortclip_function"
2024-04-26T19:40:31.552+0100 [TRACE] dag/walk: vertex "module.functions (close)" is waiting for "module.functions.azurerm_linux_function_app.shortclip_function"
2024-04-26T19:40:32.628+0100 [TRACE] dag/walk: vertex "root" is waiting for "provider[\"registry.terraform.io/hashicorp/azurerm\"] (close)"
2024-04-26T19:40:35.438+0100 [TRACE] dag/walk: vertex "provider[\"registry.terraform.io/hashicorp/azurerm\"] (close)" is waiting for "module.functions.azurerm_linux_function_app.shortclip_function"
2024-04-26T19:40:36.554+0100 [TRACE] dag/walk: vertex "module.functions (close)" is waiting for "module.functions.azurerm_linux_function_app.shortclip_function"
2024-04-26T19:40:37.629+0100 [TRACE] dag/walk: vertex "root" is waiting for "provider[\"registry.terraform.io/hashicorp/azurerm\"] (close)"
2024-04-26T19:40:38.286+0100 [DEBUG] provider.terraform-provider-azurerm_v3.100.0_x5: AzureRM Request: 
GET /subscriptions/be25820a-df86-4794-9e95-6a45cd5c0941/resourceGroups/up13-dev-ingestion/providers/Microsoft.Web/sites/up13-dev-func-shortclip/config/publishingcredentials?api-version=2023-01-01 HTTP/1.1
Host: management.azure.com
User-Agent: HashiCorp/go-azure-sdk (Go-http-Client/1.1 webapps/2023-01-01) HashiCorp Terraform/1.4.5 (+https://www.terraform.io) Terraform Plugin SDK/2.10.1 terraform-provider-azurerm/3.100.0 pid-222c6c49-1b0a-5959-a213-6608f9eb8820
Accept: application/json; charset=utf-8; IEEE754Compatible=false
Content-Type: application/json; charset=utf-8
Odata-Maxversion: 4.0
Odata-Version: 4.0
X-Ms-Correlation-Request-Id: 9bcb34b4-f994-23bd-397f-0936071e7c91
Accept-Encoding: gzip: timestamp=2024-04-26T19:40:38.286+0100
2024-04-26T19:40:38.286+0100 [DEBUG] provider.terraform-provider-azurerm_v3.100.0_x5: GET https://management.azure.com/subscriptions/be25820a-df86-4794-9e95-6a45cd5c0941/resourceGroups/up13-dev-ingestion/providers/Microsoft.Web/sites/up13-dev-func-shortclip/config/publishingcredentials?api-version=2023-01-01: timestamp=2024-04-26T19:40:38.286+0100
2024-04-26T19:40:38.390+0100 [DEBUG] provider.terraform-provider-azurerm_v3.100.0_x5: AzureRM Response for https://management.azure.com/subscriptions/be25820a-df86-4794-9e95-6a45cd5c0941/resourceGroups/up13-dev-ingestion/providers/Microsoft.Web/sites/up13-dev-func-shortclip/config/publishingcredentials?api-version=2023-01-01: 
HTTP/2.0 404 Not Found
Cache-Control: no-cache
Date: Fri, 26 Apr 2024 18:40:38 GMT
Expires: -1
Pragma: no-cache
Server: Microsoft-IIS/10.0
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Content-Type-Options: nosniff
X-Ms-Correlation-Request-Id: 9bcb34b4-f994-23bd-397f-0936071e7c91
X-Ms-Ratelimit-Remaining-Subscription-Reads: 11988
X-Ms-Request-Id: 5d370373-6ad1-44d4-a042-d3787b46cc2e
X-Ms-Routing-Request-Id: UKSOUTH:20240426T184038Z:5d370373-6ad1-44d4-a042-d3787b46cc2e
X-Powered-By: ASP.NET
Content-Length: 0: timestamp=2024-04-26T19:40:38.390+0100
2024-04-26T19:40:38.391+0100 [DEBUG] provider.terraform-provider-azurerm_v3.100.0_x5: AzureRM Request: 
POST /subscriptions/be25820a-df86-4794-9e95-6a45cd5c0941/resourceGroups/up13-dev-ingestion/providers/Microsoft.Web/sites/up13-dev-func-shortclip/config/publishingcredentials/list?api-version=2023-01-01 HTTP/1.1
Host: management.azure.com
User-Agent: HashiCorp/go-azure-sdk (Go-http-Client/1.1 webapps/2023-01-01) HashiCorp Terraform/1.4.5 (+https://www.terraform.io) Terraform Plugin SDK/2.10.1 terraform-provider-azurerm/3.100.0 pid-222c6c49-1b0a-5959-a213-6608f9eb8820
Content-Length: 0
Content-Type: application/json; charset=utf-8
X-Ms-Correlation-Request-Id: 9bcb34b4-f994-23bd-397f-0936071e7c91
Accept-Encoding: gzip: timestamp=2024-04-26T19:40:38.390+0100
2024-04-26T19:40:38.391+0100 [DEBUG] provider.terraform-provider-azurerm_v3.100.0_x5: POST https://management.azure.com/subscriptions/be25820a-df86-4794-9e95-6a45cd5c0941/resourceGroups/up13-dev-ingestion/providers/Microsoft.Web/sites/up13-dev-func-shortclip/config/publishingcredentials/list?api-version=2023-01-01: timestamp=2024-04-26T19:40:38.390+0100
module.functions.azurerm_linux_function_app.shortclip_function: Still creating... [1m0s elapsed]
2024-04-26T19:40:38.626+0100 [DEBUG] provider.terraform-provider-azurerm_v3.100.0_x5: AzureRM Response for https://management.azure.com/subscriptions/be25820a-df86-4794-9e95-6a45cd5c0941/resourceGroups/up13-dev-ingestion/providers/Microsoft.Web/sites/up13-dev-func-shortclip/config/publishingcredentials/list?api-version=2023-01-01: 
HTTP/2.0 200 OK
Content-Length: 709
Cache-Control: no-cache
Content-Type: application/json
Date: Fri, 26 Apr 2024 18:40:38 GMT
Expires: -1
Pragma: no-cache
Server: Microsoft-IIS/10.0
Strict-Transport-Security: max-age=31536000; includeSubDomains
X-Aspnet-Version: 4.0.30319
X-Content-Type-Options: nosniff
X-Ms-Correlation-Request-Id: 9bcb34b4-f994-23bd-397f-0936071e7c91
X-Ms-Ratelimit-Remaining-Subscription-Resource-Requests: 11997
X-Ms-Request-Id: 15ad3612-5855-4909-b3cd-4e0ebc6bba25
X-Ms-Routing-Request-Id: UKSOUTH:20240426T184039Z:d51ae164-f4c1-4205-8367-4948a7d037dd
X-Powered-By: ASP.NET

{"id":"/subscriptions/be25820a-df86-4794-9e95-6a45cd5c0941/resourceGroups/up13-dev-ingestion/providers/Microsoft.Web/sites/up13-dev-func-shortclip/publishingcredentials/$up13-dev-func-shortclip","name":"up13-dev-func-shortclip","type":"Microsoft.Web/sites/publishingcredentials","location":"UK South","properties":{"name":null,"publishingUserName":"$up13-dev-func-shortclip","publishingPassword":"jRtaRFg7rDN0nZoNHn9KdFqiwCE38bykTF3B6Mbx93vCtXzvHKBYGdhRiTBw","publishingPasswordHash":null,"publishingPasswordHashSalt":null,"metadata":null,"isDeleted":false,"scmUri":"https://$up13-dev-func-shortclip:jRtaRFg7rDN0nZoNHn9KdFqiwCE38bykTF3B6Mbx93vCtXzvHKBYGdhRiTBw@up13-dev-func-shortclip.scm.azurewebsites.net"}}: timestamp=2024-04-26T19:40:38.626+0100
2024-04-26T19:40:39.773+0100 [TRACE] provider.terraform-provider-azurerm_v3.100.0_x5: Called downstream: tf_resource_type=azurerm_linux_function_app tf_rpc=ApplyResourceChange @caller=github.com/hashicorp/terraform-plugin-sdk/v2@v2.29.0/helper/schema/resource.go:910 @module=sdk.helper_schema tf_provider_addr=provider tf_req_id=b5f93b58-1332-b866-4cb6-13cc66663260 timestamp=2024-04-26T19:40:39.772+0100
2024-04-26T19:40:39.773+0100 [TRACE] provider.terraform-provider-azurerm_v3.100.0_x5: Received downstream response: @module=sdk.proto tf_provider_addr=provider tf_rpc=ApplyResourceChange tf_req_id=b5f93b58-1332-b866-4cb6-13cc66663260 @caller=github.com/hashicorp/terraform-plugin-go@v0.19.0/tfprotov5/internal/tf5serverlogging/downstream_request.go:40 diagnostic_error_count=1 diagnostic_warning_count=0 tf_proto_version=5.4 tf_req_duration_ms=61371 tf_resource_type=azurerm_linux_function_app timestamp=2024-04-26T19:40:39.773+0100
2024-04-26T19:40:39.773+0100 [ERROR] provider.terraform-provider-azurerm_v3.100.0_x5: Response contains error diagnostic: tf_provider_addr=provider tf_resource_type=azurerm_linux_function_app @caller=github.com/hashicorp/terraform-plugin-go@v0.19.0/tfprotov5/internal/diag/diagnostics.go:58 diagnostic_detail="publishing source (modules/functions/rag.zip) to site App Service (Subscription: "be25820a-df86-4794-9e95-6a45cd5c0941"
Resource Group Name: "up13-dev-ingestion"
Site Name: "up13-dev-func-shortclip"): publishing failed with status code 401 Unauthorized" diagnostic_severity=ERROR diagnostic_summary="publishing source (modules/functions/rag.zip) to site App Service (Subscription: "be25820a-df86-4794-9e95-6a45cd5c0941"
Resource Group Name: "up13-dev-ingestion"
Site Name: "up13-dev-func-shortclip"): publishing failed with status code 401 Unauthorized" tf_proto_version=5.4 tf_req_id=b5f93b58-1332-b866-4cb6-13cc66663260 @module=sdk.proto tf_rpc=ApplyResourceChange timestamp=2024-04-26T19:40:39.773+0100
2024-04-26T19:40:39.773+0100 [TRACE] provider.terraform-provider-azurerm_v3.100.0_x5: Served request: tf_proto_version=5.4 tf_provider_addr=provider tf_req_id=b5f93b58-1332-b866-4cb6-13cc66663260 tf_resource_type=azurerm_linux_function_app @caller=github.com/hashicorp/terraform-plugin-go@v0.19.0/tfprotov5/tf5server/server.go:872 @module=sdk.proto tf_rpc=ApplyResourceChange timestamp=2024-04-26T19:40:39.773+0100
2024-04-26T19:40:39.774+0100 [TRACE] maybeTainted: module.functions.azurerm_linux_function_app.shortclip_function encountered an error during creation, so it is now marked as tainted
2024-04-26T19:40:39.774+0100 [TRACE] NodeAbstractResouceInstance.writeResourceInstanceState to workingState for module.functions.azurerm_linux_function_app.shortclip_function
2024-04-26T19:40:39.774+0100 [TRACE] NodeAbstractResouceInstance.writeResourceInstanceState: writing state object for module.functions.azurerm_linux_function_app.shortclip_function
2024-04-26T19:40:39.775+0100 [TRACE] evalApplyProvisioners: module.functions.azurerm_linux_function_app.shortclip_function is tainted, so skipping provisioning
2024-04-26T19:40:39.775+0100 [TRACE] maybeTainted: module.functions.azurerm_linux_function_app.shortclip_function was already tainted, so nothing to do
2024-04-26T19:40:39.775+0100 [TRACE] NodeAbstractResouceInstance.writeResourceInstanceState to workingState for module.functions.azurerm_linux_function_app.shortclip_function
2024-04-26T19:40:39.775+0100 [TRACE] NodeAbstractResouceInstance.writeResourceInstanceState: writing state object for module.functions.azurerm_linux_function_app.shortclip_function
2024-04-26T19:40:39.775+0100 [TRACE] statemgr.Filesystem: have already backed up original terraform.tfstate to terraform.tfstate.backup on a previous write
2024-04-26T19:40:39.781+0100 [TRACE] statemgr.Filesystem: state has changed since last snapshot, so incrementing serial to 1098
2024-04-26T19:40:39.781+0100 [TRACE] statemgr.Filesystem: writing snapshot at terraform.tfstate
2024-04-26T19:40:39.789+0100 [ERROR] vertex "module.functions.azurerm_linux_function_app.shortclip_function" error: publishing source (modules/functions/rag.zip) to site App Service (Subscription: "be25820a-df86-4794-9e95-6a45cd5c0941"
Resource Group Name: "up13-dev-ingestion"
Site Name: "up13-dev-func-shortclip"): publishing failed with status code 401 Unauthorized
2024-04-26T19:40:39.789+0100 [TRACE] vertex "module.functions.azurerm_linux_function_app.shortclip_function": visit complete, with errors
2024-04-26T19:40:39.789+0100 [TRACE] dag/walk: upstream of "provider[\"registry.terraform.io/hashicorp/azurerm\"] (close)" errored, so skipping
2024-04-26T19:40:39.789+0100 [TRACE] dag/walk: upstream of "module.functions (close)" errored, so skipping
2024-04-26T19:40:39.789+0100 [TRACE] dag/walk: upstream of "root" errored, so skipping
2024-04-26T19:40:39.789+0100 [TRACE] statemgr.Filesystem: have already backed up original terraform.tfstate to terraform.tfstate.backup on a previous write
2024-04-26T19:40:39.795+0100 [TRACE] statemgr.Filesystem: state has changed since last snapshot, so incrementing serial to 1099
2024-04-26T19:40:39.795+0100 [TRACE] statemgr.Filesystem: writing snapshot at terraform.tfstate
╷
│ Error: publishing source (modules/functions/rag.zip) to site App Service (Subscription: "be25820a-df86-4794-9e95-6a45cd5c0941"
│ Resource Group Name: "up13-dev-ingestion"
│ Site Name: "up13-dev-func-shortclip"): publishing failed with status code 401 Unauthorized
│ 
│   with module.functions.azurerm_linux_function_app.shortclip_function,
│   on modules/functions/functions.tf line 99, in resource "azurerm_linux_function_app" "shortclip_function":
│   99: resource "azurerm_linux_function_app" "shortclip_function" {
│ 
│ publishing source (modules/functions/rag.zip) to site App Service (Subscription: "be25820a-df86-4794-9e95-6a45cd5c0941"
│ Resource Group Name: "up13-dev-ingestion"
│ Site Name: "up13-dev-func-shortclip"): publishing failed with status code 401 Unauthorized
╵
2024-04-26T19:40:39.805+0100 [TRACE] statemgr.Filesystem: removing lock metadata file .terraform.tfstate.lock.info
2024-04-26T19:40:39.806+0100 [TRACE] statemgr.Filesystem: unlocking terraform.tfstate using fcntl flock
2024-04-26T19:40:39.807+0100 [DEBUG] provider.stdio: received EOF, stopping recv loop: err="rpc error: code = Unavailable desc = error reading from server: EOF"
2024-04-26T19:40:39.810+0100 [DEBUG] provider: plugin process exited: path=.terraform/providers/registry.terraform.io/hashicorp/azurerm/3.100.0/darwin_arm64/terraform-provider-azurerm_v3.100.0_x5 pid=11800
2024-04-26T19:40:39.811+0100 [DEBUG] provider: plugin exited

Expected Behaviour

zip_deploy_file to work.

Actual Behaviour

│ publishing source (modules/functions/rag.zip) to site App Service (Subscription: "be25820a-df86-4794-9e95-6a45cd5c0941"
│ Resource Group Name: "up13-dev-ingestion"
│ Site Name: "up13-dev-func-shortclip"): publishing failed with status code 401 Unauthorized

Steps to Reproduce

create

Important Factoids

No response

References

No response

[xiaxyi]

Thanks @uday31in for raising this issue, as the error is returned by the api, may I know if you were able to publish the function via another clients that's mentioned in this doc https://learn.microsoft.com/en-us/azure/azure-functions/deployment-zip-push#rest

[uday31in]

It works on 2nd attempt after site is created.

1. Deploy azurerm_linux_function_app (without zip deploy)
2. re-run

[xiaxyi]

Thanks @uday31in for the response, are you suggesting that the 2nd attempt using Terraform was succeeded?

[uday31in]

Yes