Question 105140 in Azure Question posted in
The official documentation to get you started can be found here.

Unable to create Service Bus Authorization Rule in Azure

We are using terraform version of 0.12.19 and azurerm provider version 2.10.0 for deploying the service bus and its queues and authorization rules. So when we ran the terraform apply it created the service bus and queue but it throwed the below error for the creation of authorization rules.

But when we checked the azure portal these authorization rules were present and in tf state file as well we were able to find the entries of both the resources and they had a parameter Status as "Tainted" in it.. So when we tried to run the apply again to see if will recreate/replace the existing resources but it was failing with the same error. Now we are unable to proceed further as even when we run the plan for creating the new resources its failing at this point and not letting us proceed further.

We even tried to untainted it and run the apply but it seems still we are getting this issue though the resources doesn’t have the status tainted parameter in tf state. Can you please help us here the solution so that we can resolve this. (We can’t move forward to new version of terraform cli as there are so many modules dependent on it and it will impact our production deployments as well.)

Error: Error making Read request on Azure ServiceBus Queue Authorization Rule "" (Queue "sample-check-queue" / Namespace "sample-check-bus" / Resource Group "My-RG"): servicebus.QueuesClient#GetAuthorizationRule: Invalid input: autorest/validation: validation failed: parameter=authorizationRuleName constraint=MinLength value="" details: value length must be greater than or equal to 1
azurerm_servicebus_queue_authorization_rule.que-sample-check-lsr: Refreshing state… [id=/subscriptions//resourcegroups/My-RG/providers/Microsoft.ServiceBus/namespaces/sample-check-bus/queues/sample-check-queue/authorizationrules/lsr]

Below is the service_bus.tf file code:

provider "azurerm" {
 version  = "=2.10.0"
 features {}
}
provider "azurerm" {
 features {}
 alias = "cloud_operations"
}

resource "azurerm_servicebus_namespace" "service_bus" {
name                = "sample-check-bus"
resource_group_name = "My-RG"
location            = "West Europe"
sku                 = "Premium"
capacity            = 1
zone_redundant      = true
tags = {
source = "terraform"
}
}

resource "azurerm_servicebus_queue" "que-sample-check" {
name                                    = "sample-check-queue"
resource_group_name                     = "My-RG"
namespace_name                          = azurerm_servicebus_namespace.service_bus.name                        
dead_lettering_on_message_expiration    = true
requires_duplicate_detection            = false
requires_session                        = false
enable_partitioning                     = false
default_message_ttl                     = "P15D"
lock_duration                           = "PT2M"
duplicate_detection_history_time_window = "PT15M"
max_size_in_megabytes                   = 1024
max_delivery_count                      = 05
}

resource "azurerm_servicebus_queue_authorization_rule" "que-sample-check-lsr" {
name                = "lsr"
resource_group_name = "My-RG"
namespace_name      = azurerm_servicebus_namespace.service_bus.name
queue_name          = azurerm_servicebus_queue.que-sample-check.name
listen              = true
send                = true
}

resource "azurerm_servicebus_queue_authorization_rule" "que-sample-check-AsyncReportBG-AsncRprt" {
name                = "AsyncReportBG-AsncRprt"
resource_group_name = "My-RG"
namespace_name      = azurerm_servicebus_namespace.service_bus.name
queue_name          = azurerm_servicebus_queue.que-sample-check.name
listen              = true
send                = true
manage              = false
}
Tags:

3

Answers


  1. Chosen as BEST ANSWER
    0

    Thanks all for your inputs and suggestions.

    Code is working fine now with the terraform provider version 2.56.0 and terraform cli version 0.12.19. Please let me know if any concerns.


  2. 0

    I have tried the below terraform code to create authorization rules and could create them successfully:

    1. I have followed this azurerm_servicebus_queue_authorization_rule |
      Resources | hashicorp/azurerm | Terraform Registry       having latest
      version of hashicorp/azurerm terraform provider.

    2. This maybe even related to arguments queue_name. arguments of
      resources changed to queue_id in 3.X.X versions

        provider "azurerm" {
  features {
      resource_group {
      prevent_deletion_if_contains_resources = false
   }
  }
}

 resource "azurerm_resource_group" "example" {
name     = "xxxx"  
location = "xx"
  }

 provider "azurerm" {
   features {}
  alias = "cloud_operations"
 }

  resource "azurerm_servicebus_namespace" "service_bus" {
 name                = "sample-check-bus"
 resource_group_name = azurerm_resource_group.example.name
 location            = azurerm_resource_group.example.location
 sku                 = "Premium"
 capacity            = 1
 zone_redundant      = true
 tags = {
source = "terraform"
  }
  }

  resource "azurerm_servicebus_queue" "que-sample-check" {
 name                                    = "sample-check-queue"
 #resource_group_name                     = "My-RG"
 namespace_id = azurerm_servicebus_namespace.service_bus.id
 #namespace_name                          = 
  azurerm_servicebus_namespace.service_bus.name                        
 dead_lettering_on_message_expiration    = true
 requires_duplicate_detection            = false
 requires_session                        = false
 enable_partitioning                     = false
 default_message_ttl                     = "P15D"
 lock_duration                           = "PT2M"
 duplicate_detection_history_time_window = "PT15M"
 max_size_in_megabytes                   = 1024
  max_delivery_count                      = 05
 }

resource "azurerm_servicebus_queue_authorization_rule" "que-sample-check-lsr" 
 {
 name                = "lsr"
 #resource_group_name = "My-RG"
  #namespace_name      = azurerm_servicebus_namespace.service_bus.name
  queue_id = azurerm_servicebus_queue.que-sample-check.id
  #queue_name          = azurerm_servicebus_queue.que-sample-check.name
  listen              = true
  send                = true
  manage              = false
 }

resource "azurerm_servicebus_queue_authorization_rule" "que-sample-check- AsyncReportBG-AsncRprt" {
 name                = "AsyncReportBG-AsncRprt"
#resource_group_name = "My-RG" 
#namespace_name      = azurerm_servicebus_namespace.service_bus.name 
queue_id = azurerm_servicebus_queue.que-sample-check.id
#queue_name          = azurerm_servicebus_queue.que-sample-check.name
listen              = true
send                = true
 manage              = false
}

    enter image description here

    Authorization rules created without error:

    enter image description here

    Please try to change the name of the authorization rule named “lsr” with increased length and also please try to create one rule at a time in your case .

    Login or Signup to reply.
  3. 0

    First, you need to add azapi to provider.tf file.
    It’s recommended to use latest version or simply don’t specify it.

    provider.tf

    terraform {
  backend "local" {}
  required_providers {
    azurerm = {
      source = "hashicorp/azurerm"
      version = "3.31.0"
    }
    azapi = {
      source = "azure/azapi"
    }
  }
}

provider "azurerm" {
  features {}
}

provider "azapi" {
}

    After that, you need to define an azure servicebus topic before shared policies element, because it needs topic’s id.

    servicebus.tf

    resource "azurerm_servicebus_namespace" "service-bus" {
  name                = "sample-check-bus"
  location            = azurerm_resource_group.example.location
  resource_group_name = azurerm_resource_group.example.name
  sku                 = "Standard"

  tags = {
    source = "terraform"
  }
}

resource "azurerm_servicebus_topic" "service-bus-topic" {
  name         = "sample-check-bus-topic"
  namespace_id = azurerm_servicebus_namespace.service-bus.id

  enable_partitioning = true
  depends_on = [
    azurerm_servicebus_namespace.service-bus
  ]
}

resource "azapi_resource" "service-bus-authorization-rule" {
  type = "Microsoft.ServiceBus/namespaces/topics/authorizationRules@2022-01-01-preview"
  name = "sample-check-bus-authorization-rules"
  parent_id = azurerm_servicebus_topic.service-bus-topic.id
  body = jsonencode({
    properties = {
      rights = [
        "Listen",
        "Manage",
        "Send"
      ]
    }
  })
  depends_on = [
    azurerm_servicebus_topic.service-bus-topic
  ]
}

    After that, api or service that uses the service-bus will be able to create queues (if "Manage" permission is enabled). "Listen" and "Send" permissions are default ones and "Send" is mandatory.

    If you prefer to have static queues, you can disable "Manage" and create queues in terraform. Up to you.

    Login or Signup to reply.
Please signup or login to give your own answer.

Back To Top
Search