So you’re trying to use the Terraform azurerm_function_app_host_keys resource to get the keys from an Azure function after deployment. Sadly, as of 03/2021, this can fail intermittently 😢 (See issue 1 and 2).+

[Edit: Hopefully this issue is resolved by this PR once released so worth reviewing once the change is released]

These errors can look something like these below:

You can work around this by using my previous workaround with ARM templates but it’s a bit clunky so I was looking at another way to do it.

There is an AWESOME project by Scott Winkler called Shell Provider, it lets you write a custom Terraform provider using scripts. You can implement data types and full resources with CRUD support.

Looking into the errors returned by the azurerm_function_app_host_keys resource they’re intermittent and look like they’re related to a timing issue. Did you know the curl command support retrying out of the box?

TIL: curl has inbuilt support for retrying failed requests pic.twitter.com/axNxOEmuwC

— Lawrence Gripper (@lawrencegripper) March 8, 2021

So using the Shell provider we can create a simple script to make the REST request to the Azure API and use curls inbuilt retry support to have the request retried with an exponential back-off until it succeeds or 5mins is up!

Warning: This script uses –retry-all-errors which is only available in v7.71 and above. The version shipped with the distro your using might not be up-to-date user curl --version to check.

Here is a rough example of what you end up with:

	terraform {
	required_providers {
	shell = {
	source = "scottwinkler/shell"
	version = "1.7.7"
	}
	}
	}
	resource "azurerm_function_app" "functions" {
	name = "${var.function_name}–${var.random_string}-premium"
	location = var.resource_group_location
	resource_group_name = var.resource_group_name
	app_service_plan_id = var.app_service_plan_id
	version = "~3"
	storage_account_name = var.storage_account_name
	storage_account_access_key = var.storage_account_key
	identity {
	type = "SystemAssigned"
	}
	site_config {
	# Ensure we use all the mem on the box and not only 3.5GB of it!
	use_32_bit_worker_process = false
	pre_warmed_instance_count = 1
	}
	app_settings = merge({
	StorageContainerName = var.test_storage_container_name
	https_only = true
	FUNCTIONS_WORKER_RUNTIME = "dotnet"
	HASH = base64encode(filesha256(local.func_zip_path))
	WEBSITE_RUN_FROM_PACKAGE = "https://${var.storage_account_name}.blob.core.windows.net/${var.deployment_container_name}/${azurerm_storage_blob.appcode.name}${var.storage_sas}"
	# Route outbound requests over VNET see: https://docs.microsoft.com/en-us/azure/azure-functions/functions-networking-options#regional-virtual-network-integration
	WEBSITE_DNS_SERVER = "168.63.129.16"
	WEBSITE_VNET_ROUTE_ALL = 1
	}, var.app_settings)
	}
	data "azurerm_subscription" "current" {
	}
	data "shell_script" "functions_key" {
	lifecycle_commands {
	read = file("${path.module}/readkey.sh")
	}
	environment = {
	FUNC_NAME = azurerm_function_app.functions.name
	RG_NAME = var.resource_group_name
	SUB_ID = data.azurerm_subscription.current.subscription_id
	}
	depends_on = [azurerm_function_app.functions]
	}

view raw main.tf hosted with ❤ by GitHub

	output "function_master_key" {
	# Try is used here to ensure destroy works as expected. On destroy the map will be
	# empty so try instead returns an empty string
	# See: https://www.terraform.io/docs/language/functions/try.html
	value = try(data.shell_script.functions_key.output["masterKey"], "")
	}
	output "function_hostname" {
	value = azurerm_function_app.functions.default_hostname
	}
	output "function_name" {
	value = azurerm_function_app.functions.name
	}

view raw output.tf hosted with ❤ by GitHub

	#!/bin/bash
	set -e
	# Get a token so we can call the ARM api
	TOKEN=$(az account get-access-token -o json | jq -r .accessToken)
	# Attempt to list the keys with exponential backoff and do this for 5mins max
	# –fail required see https://github.com/curl/curl/issues/6712
	curl "https://management.azure.com/subscriptions/$SUB_ID/resourceGroups/$RG_NAME/providers/Microsoft.Web/sites/$FUNC_NAME/host/default/listkeys?api-version=2018-11-01" \
	–compressed -H 'Content-Type: application/json;charset=utf-8' \
	-H "Authorization: Bearer $TOKEN" -d "{}" \
	–retry 8 –retry-max-time 360 –retry-all-errors –fail –silent

view raw readkeys.sh hosted with ❤ by GitHub