Allow azurerm_private_endpoint without request-message

[cmergenthaler]

Is there an existing issue for this?

• I have searched the existing issues

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment and review the contribution guide to help.

Description

The current azurerm provider implementation forbids creating a private endpoint without a request_message specified when setting is_manual_connection to true . The fact that this is actually possible using the azure cli makes it hard to import an already existing resource as the provider does not allow applying the pe-resource again:

private_service_connection:private-link is invalid, the "request_message" attribute must not be empty

New or Affected Resource(s)/Data Source(s)

azurerm_private_endpoint

Potential Terraform Configuration

resource "azurerm_private_endpoint" "private_endpoint" {
  name                = "my-private-endpoint"
  location            = var.location
  resource_group_name = var.network_resource_group_name
  subnet_id           = var.subnet_id

  private_service_connection {
    name                           = "private-link"
    private_connection_resource_id = "private-link-res-id"
    is_manual_connection           = true
    request_message                = "" # This is currently not allowed
  }
}

References

No response

[liuwuliuyun]

@cmergenthaler Thanks for raising this issue. I've give it a try and I think the limitation is from the Azure REST API we are using here.
If we try to give it an empty string, following error will be raised by API, therefore we enforce the string to be non-empty in AzureRM provider.

        Error: validating the configuration for Private Endpoint (Subscription: "85b3dbca-5974-4067-9669-67a141095a76"
        Resource Group Name: "acctestRG-privatelink-231130142151408020"
        Private Endpoint Name: "acctest-privatelink-231130142151408020"): "private_service_connection":"acctestPLS-231130142151408020" is invalid, the "request_message" attribute must not be empty

I shall communicate with Azure CLI team and comment on this thread later.

[liuwuliuyun]

Hi @cmergenthaler , I did some further digging about this issue. Since request_message is an optional property. Although you could not create a manual connection by terraform without specifying request_message but you should be able to import one created by CLI.

I create a private endpoint using following CLI command.

az network private-endpoint create -g yunliu-resources -n yunliu-endpoint --vnet-name yunliu-network --subnet yunliu-service --private-connection-resource-id "/subscriptions/xxx/resourceGroups/yunliu-resources/providers/Microsoft.Network/privateLinkServices/yunliu-privatelink" --manual-request t --connection-name yunliu-privateserviceconnection -l westeurope

And I successfully import it by

terraform import azurerm_private_endpoint.yunliu /subscriptions/xxx/resourceGroups/yunliu-resources/providers/Microsoft.Network/privateEndpoints/yunliu-endpoint

with adding following template to .tf file

resource "azurerm_private_endpoint" "yunliu" {
  name                = "yunliu-endpoint"
  location            = azurerm_resource_group.yunliu.location
  resource_group_name = azurerm_resource_group.yunliu.name
  subnet_id           = azurerm_subnet.yunliu_service.id

  private_service_connection {
    name                           = "yunliu-privateserviceconnection"
    private_connection_resource_id = azurerm_private_link_service.yunliu.id
    is_manual_connection           = true
  }
}

Running terraform plan to confirm no change.

No changes. Your infrastructure matches the configuration.

Full .tf config file I use

provider "azurerm" {
  features {}
}

resource "azurerm_resource_group" "yunliu" {
  name     = "yunliu-resources"
  location = "West Europe"
}

resource "azurerm_virtual_network" "yunliu" {
  name                = "yunliu-network"
  address_space       = ["10.0.0.0/16"]
  location            = azurerm_resource_group.yunliu.location
  resource_group_name = azurerm_resource_group.yunliu.name
}

resource "azurerm_subnet" "yunliu_service" {
  name                 = "yunliu-service"
  resource_group_name  = azurerm_resource_group.yunliu.name
  virtual_network_name = azurerm_virtual_network.yunliu.name
  address_prefixes     = ["10.0.1.0/24"]

  enforce_private_link_service_network_policies = true
}

resource "azurerm_subnet" "yunliu_endpoint" {
  name                 = "yunliu-endpoint"
  resource_group_name  = azurerm_resource_group.yunliu.name
  virtual_network_name = azurerm_virtual_network.yunliu.name
  address_prefixes     = ["10.0.2.0/24"]

  enforce_private_link_endpoint_network_policies = true
}

resource "azurerm_public_ip" "yunliu" {
  name                = "yunliu-pip"
  sku                 = "Standard"
  location            = azurerm_resource_group.yunliu.location
  resource_group_name = azurerm_resource_group.yunliu.name
  allocation_method   = "Static"
}

resource "azurerm_lb" "yunliu" {
  name                = "yunliu-lb"
  sku                 = "Standard"
  location            = azurerm_resource_group.yunliu.location
  resource_group_name = azurerm_resource_group.yunliu.name

  frontend_ip_configuration {
    name                 = azurerm_public_ip.yunliu.name
    public_ip_address_id = azurerm_public_ip.yunliu.id
  }
}

resource "azurerm_private_link_service" "yunliu" {
  name                = "yunliu-privatelink"
  location            = azurerm_resource_group.yunliu.location
  resource_group_name = azurerm_resource_group.yunliu.name

  nat_ip_configuration {
    name      = azurerm_public_ip.yunliu.name
    primary   = true
    subnet_id = azurerm_subnet.yunliu_service.id
  }

  load_balancer_frontend_ip_configuration_ids = [
    azurerm_lb.yunliu.frontend_ip_configuration.0.id,
  ]
}

resource "azurerm_private_endpoint" "yunliu" {
  name                = "yunliu-endpoint"
  location            = azurerm_resource_group.yunliu.location
  resource_group_name = azurerm_resource_group.yunliu.name
  subnet_id           = azurerm_subnet.yunliu_service.id

  private_service_connection {
    name                           = "yunliu-privateserviceconnection"
    private_connection_resource_id = azurerm_private_link_service.yunliu.id
    is_manual_connection           = true
  }
}

[cmergenthaler]

Hey @liuwuliuyun,
thanks for checking out and sorry for my late response!
Yes, you can import the previously created PE, and you also don't see any differences between terraform and infrastructure. But unfortunately your terraform script would be faulty when trying to setup the infrastructure from plain again. So you won't be able to provision the infrastructure by just applying the terraform script.

[liuwuliuyun]

Hi @cmergenthaler, in general, if you would like to manage your infra using Terraform, it is not recommended to change managed infra using other tools.
So if you would like to create from plain, you could add any request_message here so that it works. If you already made changes using cli and you do not want to change current infra. You are able to import this to Terrafrom using above command. I am not sure I understand your use case here.
The reason for AzureRM provider behaves differently with Azure CLI could be that we use different Azure REST API versions. AzureRM provider is using the lastest stable version 2023-06-01 here which does not allow empty request_message.

[Lonache]

As of 2024-06-12 (v3.107.0) this issue still happens; the issue arises in my case for manual private endpoints that I lack permission to approve and where I can't even see the resource group that they ultimately link to, which not an atypical scenario. In the Azure portal, I find I must create such endpoints by resource ID. I can't specify the resource group and navigate in.