# Azure apim named\_value: One or more fields contain incorrect values

**URL:** <https://discuss.hashicorp.com/t/azure-apim-named-value-one-or-more-fields-contain-incorrect-values/63868>\
**Category:** Azure\
**Created:** [March 20, 2024, 8:59pm UTC](https://discuss.hashicorp.com/t/azure-apim-named-value-one-or-more-fields-contain-incorrect-values/63868 "2024-03-20T20:59:59Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![djangofan](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/djangofan/32/40888_2.png) [@djangofan](https://discuss.hashicorp.com/u/djangofan)\
**Post date:** [March 20, 2024, 9:00pm UTC](https://discuss.hashicorp.com/t/azure-apim-named-value-one-or-more-fields-contain-incorrect-values/63868/1 "2024-03-20T21:00:00Z")

</div>

I am trying to create a azure APIM named value, mapped to a KeyVault secret, using Terraform so that my Azure Defender Cloud scan no longer flags it insecure. I’m using Terraform CLI version 1.2.6, not the latest version 1.7.5+.

I simplified down what I am trying to do into this example BUT I am getting an error when I configure it this way, using the documentation at : [Terraform Registry](https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/api_management_named_value)

```auto
resource "azurerm_api_management_named_value" "named_value_kvtest2" {
  name = "kvtest2"
  api_management_name = azurerm_api_management.apim.name
  resource_group_name = azurerm_resource_group.rg.name
  display_name = "kvtest2"
  value_from_key_vault {
    secret_id = "https://{...}.vault.azure.net/secrets/{...}/{...}."
  }
}

```

And here is the error:

```auto
│ Error: creating or updating Named Value (Subscription: "{...}"
│ Resource Group Name: "{...}"
│ Service Name: "{...}"
│ Named Value: "kvtest2"): performing CreateOrUpdate: unexpected 
        status 400 with error: ValidationError: One or more fields 
        contain incorrect values:
│ 
│ with azurerm_api_management_named_value.named_value_kvtest2,
│ on {...}.tf line 106, in resource 
     "azurerm_api_management_named_value" "named_value_kvtest2":
│ 106: resource "azurerm_api_management_named_value" 
    "named_value_kvtest2" {

```

It just simply is not possible that one of the fields, as documented, is missing or set wrong. I made sure of that with the example above.

---

<div class="post-metadata">

**Author:** ![djangofan](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/djangofan/32/40888_2.png) [@djangofan](https://discuss.hashicorp.com/u/djangofan)\
**Post date:** [March 22, 2024, 4:09pm UTC](https://discuss.hashicorp.com/t/azure-apim-named-value-one-or-more-fields-contain-incorrect-values/63868/2 "2024-03-22T16:09:44Z")

</div>

Ok, I finally solved it.

There was an issue with “variable expansion”, that was hard to believe, but this was my workaround, by doing the expansion outside the block within a “locals” block.

```auto
locals {
  named_value_key_name = "${local.myfunc_name}-${var.environment}-key"
  vault_key_name = "MYFUNC-DEV-KEY"
}

resource "azurerm_api_management_named_value" "named_value_myfunc" {
  depends_on = [
    azurerm_key_vault_secret.vault_value_myfunc_api
  ]
  name = local.named_value_key_name
  resource_group_name = azurerm_api_management.apim.resource_group_name
  api_management_name = azurerm_api_management.apim.name
  display_name = local.named_value_key_name
  secret = true
  value_from_key_vault {
    secret_id = "${azurerm_key_vault.app_secrets.vault_uri}secrets/${local.vault_key_name}"
  }
}

```

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/hashicorp/original/1X/79bf76adfd92a75631996933098f9ce29d37abf3.svg) [@system](https://discuss.hashicorp.com/u/system)\
**Post date:** [September 18, 2024, 4:09pm UTC](https://discuss.hashicorp.com/t/azure-apim-named-value-one-or-more-fields-contain-incorrect-values/63868/3 "2024-09-18T16:09:53Z")

</div>

Closed on September 18, 2024, 4:09pm UTC

This topic was automatically closed 180 days after the last reply. New replies are no longer allowed.