Terraform API Management Fails

Question

Terraform API Management Fails

Weatherburn, Guy (Contractor) 21

When I use Terraform to provision an API Management instance I get the following error:

azurerm_api_management.API-Management-001-apim: Still creating... [37m30s elapsed]
╷
│ Error: waiting for creation/update of API Management Service "Guys-POC-DEV-1-00-001-apim-001" (Resource Group "Guys-POC-DEV-1.00-001-rg"): Future#WaitForCompletion: the number of retries has been exceeded: StatusCode=400 -- Original Error: Code="ActivationFailed" Message="API Management service uses Azure SQL Server internally to store configuration for your service.\nThe service deployment failed to connect to an Azure SQL Server on port 1433 from inside the Virtual Network. \n 1. Please ensure an Azure SQL Server DNS can be resolved, if using a Custom DNS Server.\n2. Please ensure that there is no NSG / Firewall blocking outbound port access on 1433 from the Virtual Network subnet where deployment is being attempted.\nPlease review other common network configuration and troubleshooting information at https://aka.ms/apim-vnet-common-issues"
│
│ with azurerm_api_management.API-Management-001-apim,
│ on API-Management-001.tf line 13, in resource "azurerm_api_management" "API-Management-001-apim":
│ 13: resource "azurerm_api_management" "API-Management-001-apim" {

It appears to be trying to connect to an SQL resource but I find no requirement for this anywhere. The Microsoft.SQL endpoint is set for the Subnet and The VNet is configure to let out port 1443. Am I missing something?

Michael Ward 1 Reputation point

2022-10-26T20:13:49.127+00:00

so you probably put port 1443 in your outbound NSG rule instead of 1433; Don't feel bad, I've done it before also...

Accepted answer

0 additional answers

Your answer

Michael Ward 1 Reputation point

2022-10-26T20:13:49.127+00:00

so you probably put port 1443 in your outbound NSG rule instead of 1433; Don't feel bad, I've done it before also...

Answer 1

MayankBargali-MSFT 70,936 Moderator

Hi @Weatherburn, Guy (Contractor)

Welcome to Microsoft Q&A! Thanks for posting the question.

As per the error looks like the outbound 1433 port is blocked. There are a couple of NSG rules that are required for APIM to be deployed and function correctly in a VNET as mentioned in this document. You need to add the rule as mentioned in the document to ensure there are no issues when trying to connect to SQL endpoints.

Source Port: *
Destination Port:1433
Protocol: TCP
Source Service Tag:Virtual Network
Destination Service Tag: SQL

If you are using a custom DNS server in a VNET then we recommend you remove the Azure Default DNS server from the list and instead configure Query forwarding on your custom DNS servers to send queries to the Azure Default DNS server. The reason that we recommend this is due to the fact that the DNS servers on the VNET are cycled through so if the Azure Default DNS server gets selected on the rotation it will not be able to resolve any custom DNS entries that you have added to your custom DNS servers. More information on this topic can be found in this document.

Weatherburn, Guy (Contractor) 21 Reputation points

2021-06-01T08:48:47.24+00:00

The final paragragh of my question stated that I had opened the ports (1443 included) that the document you mentioned and I have already seen. I had also set the required endpoints. My question was really pointing at the fact that when I put an APIM on a Vnet/Subnet it appears to require an SQL instance in the first place. Nothing I could find, despite googling and other methods for a couple of days, gave no reason/explanation for this behavior.
MayankBargali-MSFT 70,936 Reputation points Moderator

2021-06-01T09:38:19.513+00:00

@Weatherburn, Guy (Contractor) ·APIM uses SQL internally and this is an implementation detail that is purposefully abstracted away from the service users and therefore you will not find any documentation stating this. Only you will able to see the document that states that there are some outbound port needed for APIM to be deployed and function correctly.
Weatherburn, Guy (Contractor) 21 Reputation points

2021-06-03T08:05:48.273+00:00

So APIMs talk back to something that Azure provides and I was not aware of this and the docs do not make this clear. So at least I think we need an update to the docs stating the reason for the port 1433 opening in a little more detail.
MayankBargali-MSFT 70,936 Reputation points Moderator

2021-06-03T09:05:52.31+00:00

@Weatherburn, Guy (Contractor) Sure. I will work with the content team if we can clarify more in our document.

Share via

Terraform API Management Fails

0 additional answers

Your answer