Hello, I need a bit of help with azurerm_app_service, specifically configuring the app service to use either a system assigned or user assigned account to pull images from Azure ACR.
We ran into an issue with Azure App services and Azure ACR, when using admin credentials to connect to the ACR. Microsoft recommended we don’t use admin creds when connecting to the ACR, so I have been looking into alternatives.
I would like to use a SystemAssigned identity or a UserAssigned Identity with ACRPull permissions, but I cannot seem to get the configuration correct to do so. I can get as far as within the Azure App service, deployment center section, for authentication “Managed Identity” is select, but in the “Identity” dropdown my UserAssigned managed identity is not select (it is in the list under user assigned).
Within azurerm_app_service I have configured the following:
site_config
{
acr_use_managed_identity_credentials = true
acr_user_managed_identity_client_id = azurerm_user_assigned_identity.acr_assigned_id.principal_id
…
}
Based on looking at the Terraform plans, within azurerm_app_service I have also set:
identity {
type = "SystemAssigned, UserAssigned"
identity_ids = [azurerm_user_assigned_identity.acr_assigned_id.id]
}
azurerm_user_assigned_identity.acr_assigned_id refers to a managed identity that I have created with ACRPull permissions via:
resource “azurerm_role_assignment” “acrpull_daemon” {
scope = azurerm_app_service.daemon.id
role_definition_name = "AcrPull"
principal_id = azurerm_user_assigned_identity.acr_assigned_id.principal_id
}
#Creates user assigned ID (aka managed ID)
resource “azurerm_user_assigned_identity” “acr_assigned_id” {
name = format("%s-%s-id", var.environment, var.resource_name)
resource_group_name = azurerm_resource_group.rg.name
location = azurerm_resource_group.rg.location
}
So how can I get my user assigned managed identity selected within the Deployment Center, “Identity” dropdown? Or, if within the “Identity” dropdown I could select “System Assigned” that may also work.
Thank you in advance!