The property 'properties.publicNetworkAccess' is not valid on Azure App Configuration service

[spDhairya]

Hello all,

I am trying to create multiple azure resources through bicep secured behind VNet with no public network access. One such component is Azure app configuration service. I am using api spec 2020-07-01-preview and documentation referred at https://docs.microsoft.com/en-us/azure/templates/microsoft.appconfiguration/2020-07-01-preview/configurationstores?tabs=bicep . When I try to build with az bicep build --file main.bicep command, it succeeds giving no warnings or error in my schema. However on deploying, it fails with message The property 'properties.publicNetworkAccess' is not valid. The bicep module deployed is

@minlength(5)
@maxlength(50)
@description('Resource name for app configuration')
param resourceName string // ex: appcs-shipment-dev

// https://docs.microsoft.com/en-us/azure/templates/microsoft.appconfiguration/2020-07-01-preview/configurationstores?tabs=bicep
resource configurationStores 'Microsoft.AppConfiguration/configurationStores@2020-07-01-preview' = {
name: resourceName
location: resourceGroup().location // Use same location as the resource group
sku: {
name: 'standard'
}
properties: {
publicNetworkAccess: 'Disabled'
}
}

output configurationStoresId string = configurationStores.id

Any idea what is wrong? I believe the property publicNetworkAccess and its value Disabled should be correct?

[brwilkinson]

In order to configure the publicNetworkAccess to Disabled, you first need to configure the Privatelink on the app configuration instance.

publicNetworkAccess --> Control permission for data plane traffic coming from public networks while private endpoint is enabled. - Enabled or Disabled"

Information on configuring private link is here:
https://docs.microsoft.com/en-us/azure/templates/microsoft.appconfiguration/2020-07-01-preview/configurationstores/privateendpointconnections?tabs=bicep

[brwilkinson]

Sure here is a sample config for AppConfig, along with references to Modules for the privateLink and privatelinkDNS registration

https://github.com/brwilkinson/AzureDeploymentFramework/blob/dev/ADF/bicep/AppConfig.bicep

The object that defines the App config is here:
https://github.com/brwilkinson/AzureDeploymentFramework/blob/5218fbbbf9aef14af6ebb6e738d5518f7084e9b3/ADF/tenants/AOA/azuredeploy.1.ACU1.T5.parameters.json#L525

PrivateLink is a little complex with the groupID's etc. However hopefully that gets you started.

[spDhairya]

Once again, thanks for sharing sample. On deeper look, i see template x.vNetPrivateLink.bicep uses Microsoft.Network/privateEndpoints@2019-11-01', however sample you provided uses 'Microsoft.AppConfiguration/configurationStores/privateEndpointConnections@2020-07-01-preview'.

On looking more for the error i got with my template - " incorrect segment lengths. A nested resource type must have identical number of segments as its resource name. A root resource type must have segment length one greater than its resource name" I could see since Microsoft.AppConfiguration/configurationStores/privateEndpointConnections is child resource of Microsoft.AppConfiguration/configurationStores. I have to name my resource as name: '${resourceName}/pvt' instead of name: 'pvt-${resourceName}'. Is my understanding correct? Even changing this does not help. I still get error The property 'properties.publicNetworkAccess' is not valid.

[brwilkinson]

Feel free to share your sample of what you have.

[brwilkinson]

Also given this maybe the first time configuring private link you should become familiar with what it is, why you use and how to configure other relevant items, such as the private DNS zones.

https://docs.microsoft.com/en-us/azure/azure-app-configuration/concept-private-endpoint

Time spent reading/planning will save you time in putting the configuration together in the end.

[brwilkinson]

Hi @spDhairya

Did you find any extra info out about the value 'publicNetworkAccess' ? After some more testing it does seem redundant, in that you need to set private link first to use it, then once you have that private link, you cannot get public access anyway.