Create a Relay Hybrid Connection from Azure Function App

Question

I want to create a Hybrid Connection from an Azure Relay from an Azure Function App.
I have made sure the Identity in my function app is set to system assigned. The Azure Relay also has my Function App the assigned role of owner.

I am failing to get the MSI token which I then intend to pass in the axios request to create the Hybrid Connection.

The error I am receiving when trying to retrieve the MSI token is: Error: connect EACCES 169.254.169.254:80.

Below is my code for retrieving the token.

const axios = require('axios');

const apiVersion = '2020-06-01';

const resource = 'https://relay.azure.net/';

let cachedResponse = null; 

// This function retrieves the MSI token

async function getMsiToken() {

    const endpoint = `http://169.254.169.254/metadata/identity/oauth2/token?api-version=${apiVersion}&resource=${encodeURIComponent(resource)}`;

    const headers = { 'Metadata': 'true' };

    try {

        const response = await axios.get(endpoint, { headers });

        cachedResponse = response.data;

        return response.data.access_token;

    } catch (error) {

        cachedResponse = error;

        return null; // explicitly return null to indicate a failure

    }

}

Answer 1

Hi - OK so you want to create the HC Relay via an ARM management (control plane) call from the function to facilitate comms from point A to point B (but not from the function itself, that's just a wrapper for creating the HC in this case?)

(Let me know if i got that right or wrong)

As it's a management operation the best practice would be to use the identity lib (your example was JS so you need the JS version linked above) to return a token - the managed identity would be fine as it's the identity the function runs under and that makes sense here

For RBAC , what role you need to grant the MSI , see here https://learn.microsoft.com/en-us/azure/azure-relay/authenticate-managed-identity#azure-built-in-roles-for-azure-relay