Webapp Private Endpoint deployment is failing

[shankyps]

Team,
I am trying to deploy private endpoint for a webapp and it is failing with this error
{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.","details":[{"code":"PrivateEndpointIpConfigurationMissingMemberNamesRequiredByFps","message":"Private Endpoint /subscriptions/XYZ/resourceGroups/shashankrg/providers/Microsoft.Network/privateEndpoints/abc-prd-pep contains static ipconfigurations: [PrivateIPAddress: 10.10.5.10, GroupId: , MemberName: sites] and its missing these membernames/groupids requested by Private Link service [GroupId: sites, MemberName: sites]. Private Endpoint needs to be reconfigured with missing memberNames."}]}

This is my code,I am leveraging module that I have for PEP

module privateendpoint 'private-endpoint1.0.1.bicep' = {
  scope: resourceGroup(resourceGroups.name)
  dependsOn: [
    appservice_site

    ]
  name: 'private-endpoint'
  params: {
    groupId: [
      'sites'
    ]
    name: appservice.privateEndpointName
    privateIPAddress:'10.10.5.10'
    location:resourceGroups.location
    serviceResourceId: appservice_site.outputs.resourceId
    targetSubnetResourceId: network.id
    privateDnsZoneGroups: appservice.privateDnsZoneGroups
    memberName:'sites'
  }
}

Based on this article member name should be mentioned as sites
https://docs.microsoft.com/en-us/azure/private-link/manage-private-endpoint?tabs=manage-private-link-powershell#determine-groupid-and-membername

[brwilkinson]

@shankyps please share the module code as well.

[brwilkinson]

here is an example of a parameter file that references using a private link on a storage account.

https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/tenants/AOA/ACU1.T5.parameters.json#L424

            "PrivateLinkInfo": [
              {
                "Subnet": "snMT02",
                "groupID": "blob"
              },
              {
                "Subnet": "snMT02",
                "groupID": "file"
              }
            ],

This is a common format that is setup to work on any resource type.

here is the storage template where it calls to create the private link.

https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/SA-Storage.bicep#L417

module vnetPrivateLink 'x.vNetPrivateLink.bicep' = if (contains(storageInfo, 'privatelinkinfo')) {
  name: 'dp${Deployment}-SA-privatelinkloop-${storageInfo.name}'
  params: {
    Deployment: Deployment
    DeploymentURI: DeploymentURI
    PrivateLinkInfo: storageInfo.privateLinkInfo
    providerType: SA.type
    resourceName: SA.name
  }
}

The above is a generic module that works for most private link resource types.

This is the actual module

https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/x.vNetPrivateLink.bicep

There is also a call to create the DNS records via this ...

https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/SA-Storage.bicep#L430

module privateLinkDNS 'x.vNetprivateLinkDNS.bicep' = if (contains(storageInfo, 'privatelinkinfo')) {
  name: 'dp${Deployment}-SA-registerPrivateDNS-${storageInfo.name}'
  scope: resourceGroup(HubRGName)
  params: {
    PrivateLinkInfo: storageInfo.privateLinkInfo
    providerURL: environment().suffixes.storage // '.core.windows.net'
    providerType: SA.type
    resourceName: SA.name
    Nics: contains(storageInfo, 'privatelinkinfo') && length(storageInfo) != 0 ? array(vnetPrivateLink.outputs.NICID) : array('')
  }
}

The DNS one is a little bit interesting since it does lookups to the correct GroupId based on the Resource type.

[brwilkinson]

https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/tenants/AOA/ACU1.T5.parameters.json#L1638

Adding web app as well, it uses the same modules.

            "privateLinkInfo": [
              {
                "Subnet": "snFE01",
                "groupID": "sites"
              }
            ]

[brwilkinson]

@shankyps please provide an update? will mark as answered if you don't provide an update.