synapse bicep code failing with Values for request parameters are invalid: keyvaultproperties.keyvaulturi

MrFlinstone 581

I have got a synapse workspace bicep code below, trying to add double encryption but currently faced with the error below.Tried different things to no avail, the issue here is that the code was decompiled from an ARM template, so not sure if the key syntax is correct.

key: {

  name: 'default'

  keyVaultUrl: 'https://my-keyvault.vault.azure.net/keys/my-key/xxxxxxxx'



}

{"code":"DeploymentFailed","message":"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.","details":[{"code":"InvalidValuesForRequestParameters","message":"Values for request parameters are invalid: keyvaultproperties.keyvaulturi."}]}

resource create_synapse_workspace 'Microsoft.Synapse/workspaces@2021-06-01' = {

  name: synapse_workspace_name

  location: location

  tags: my_tags

  identity: {

    type: 'SystemAssigned,UserAssigned'

    userAssignedIdentities: {

      '${synapse_identity.id}': {}

    }

  }

  properties: {

    defaultDataLakeStorage: {

      createManagedPrivateEndpoint: false

      accountUrl: accountURL

      filesystem: filesystem

    }

    // encryption: {}



    encryption: {

      cmk: {

        kekIdentity: {

          userAssignedIdentity: mi

          useSystemAssignedIdentity: false

        }

        key: {

          name: 'default'

          keyVaultUrl: 'https://my-keyvault.vault.azure.net/keys/my-key/xxxxxxxx'



        }

      }

    }

    managedVirtualNetwork: 'default'

    managedResourceGroupName: null 

    sqlAdministratorLogin: adminaccount

    sqlAdministratorLoginPassword: adminpassword

    privateEndpointConnections: [

    ]

    managedVirtualNetworkSettings: {

      preventDataExfiltration: false

    }

    workspaceRepositoryConfiguration: {

      accountName: account_name

      collaborationBranch: branch

      repositoryName: repo

      rootFolder: folder

      type: type

    }



    trustedServiceBypassEnabled: false    

    publicNetworkAccess: 'Disabled'

  }



}

Chandra Boorla 2,755 Reputation points Microsoft Vendor

2024-07-17T07:08:43.66+00:00

Hi @MrFlinstone

Thanks for the question and using MS Q&A platform.

The error message indicates that the deployment failed due to invalid values for request parameters, specifically the keyvaultproperties.keyvaulturi.

This suggests that the URL provided for the key vault is not in the correct format. In the provided code, the key vault URL is specified as https://my-keyvault.vault.azure.net/keys/my-key/xxxxxxxx.

This URL should be in the format https://<keyVaultName>.vault.azure.net/keys/<keyName>/<keyVersion>. Make sure to replace <keyVaultName>, <keyName>, and <keyVersion> with the actual values for your key vault, key name, and key version, respectively.
For more information, please refer: Object identifiers

Additionally, review the other properties in the create_synapse_workspace resource to ensure they are correctly configured and valid.

I hope this information helps, please do let us know if you have any further queries.
Chandra Boorla 2,755 Reputation points Microsoft Vendor

2024-07-18T08:42:12.11+00:00

Hi @MrFlinstone

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.
MrFlinstone 581 Reputation points

2024-07-18T09:13:46.8433333+00:00

Thank you for the response, if the keyvault URL is provided in the format specified above i.e https://<keyVaultName>.vault.azure.net/keys/<keyName>/<keyVersion> I then get the error

The key vault URL should be a valid URL and no version should be provided for the key https://<keyVaultName>.vault.azure.net/keys/<keyName>/<keyVersion>

If the key version is removed, I get the error.

Could not perform a Get operation on the workspace encryption key. Make sure that the secret identifier is a valid key URL ad the workspace managed identity has get WrapKey and the UnwrapKey access to the keyvault access policies or through RBAC.

The user managed identity has got key vault administrator role, and as such I am not convinced RBAC is the issue. There is a restriction where if a firewall is in place, user managed identities may not work. The environment is behind a private endpoint and there are routes in place that routes traffic via a firewall.

https://learn.microsoft.com/en-us/azure/synapse-analytics/security/workspaces-encryption
Chandra Boorla 2,755 Reputation points Microsoft Vendor

2024-07-19T17:56:06.18+00:00

Hi @MrFlinstone

The error you're experiencing with the keyvaultproperties.keyvaulturi parameter is likely due to the values provided for the Key Vault properties are incorrect. Here are few troubleshooting steps that might help you.

Double-check the values you are passing to ensure they are correct and properly formatted. Sometimes, even a small typo can cause this error.

Make sure that all necessary resources are created and available before you reference them in your deployment. For example, if you’re using a customer-managed key, ensure the Key Vault and the key itself are properly set up and accessible.

For details, please refer: https://stackoverflow.com/questions/68008085/creating-sas-token-with-arm-template-error-invalidvaluesforrequestparameters

If you’re using a deployment script or template, ensure that the resources are being deployed in the correct order. Sometimes, deploying the identity block first and then the customer-managed key block can resolve the issue.

For details, please refer: https://github.com/hashicorp/terraform-provider-azurerm/issues/16374

From the above error message, it complains that your UserAssignedIdentity (I know errror says Managed Identity, which means User Assigned Managed Identity with regards to your scenario) doesn't have the Get permission on the AzureKeyVault. I see you already stated that UserAssignedIdentity has already been authorized for the keyvalut, but could you please re-confirm if the required policies/permissions are granted?

For additional information please refer: https://learn.microsoft.com/en-us/azure/templates/microsoft.keyvault/vaults/accesspolicies?pivots=deployment-language-bicep

I hope this information helps, please do let us know if you have any further queries.
Chandra Boorla 2,755 Reputation points Microsoft Vendor

2024-07-22T07:49:11.07+00:00

Hi @MrFlinstone

Just wanted to check whether your query got answered and was just checking back to see if you have a resolution yet. In case if you have any resolution, please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Share via

synapse bicep code failing with Values for request parameters are invalid: keyvaultproperties.keyvaulturi

Your answer