Why does my BICEP template, fail to create authorization rules consistently?

Question

I've created a bicep template for deploying the Azure Service Bus which includes creation of multiple topics, subscriptions, filters, and authorisation rules.

I'm attempting to deploy 24 authorisation rules in a serial for loop after the rest of the servicebus has been created. The first time deployment will always fail with one or two authorisation rules returning with the error MessagingGatewayTooManyRequests or AuthorizationRuleNotFound. A subsequent deployment will always work as expected.

I have tried only using a template that only deploys authorisation rules, and have run into the same problem. The first 18 rules were created almost instantly, then after that they start to show as duplicated in the azure portal and fail.

I have found that I can get closer to my goal by splitting up the policies into multiple dependent deployments, which does slow down the request speed due to the physical overhead from creating a new deployment. I'd rather create a pure solution that is low effort, easy to maintain, and doesn't abuse the limitations of ARM deployments in order to succeed.

Please see the cut down version of my module below;

@description('The namespace of the servicebus resource')
param namespace string = 'myservicebus'

@description('An array of shared access policy configurations for service bus topics')
param sharedAccessPolicies array = [
  {
    topicName: 'mytopic'
    policyName: 'listen-policy'
    policyRights: ['Listen']
    secretName: 'sb-mytopic-listen' 
  }
  {
    topicName: 'mytopic'
    policyName: 'send-policy'
    policyRights: ['Send']
    secretName: 'sb-mytopic-send'
  }
]

@batchSize(1)
resource topic_auth_rule 'Microsoft.ServiceBus/namespaces/topics/authorizationRules@2021-11-01' = [for policy in sharedAccessPolicies: {
  name: '${namespace}/${policy.topicName}/${policy.policyName}'
  properties: {
    rights: policy.policyRights
  }
}]

I've found a similar post around this issue which is what lead to my current solution. Although I don't understand why this single API endpoint is so aggressively rate limited.

Any advice on this would be much appreciated.

Answer 1

The above code in my question now works as expected. I spent the past month talking to multiple levels of Microsoft support, I managed to get in touch with the ARM team who looked into and resolved the problem.

The alternative solution which I was suggested was to individually register each resource and create a huge dependency chain, see example below.

resource topic_auth_rule_listen 'Microsoft.ServiceBus/namespaces/topics/authorizationRules@2021-11-01' = {
  name: '${namespace}/mytopic/listen-policy'
  properties: {
    rights: [ 'Listen' ]
  }
}

resource topic_auth_rule_send 'Microsoft.ServiceBus/namespaces/topics/authorizationRules@2021-11-01' = {
  name: '${namespace}/mytopic/send-policy'
  properties: {
    rights: [ 'Send' ]
  }
  dependsOn: [ topic_auth_rule_listen ]
}

...