Azure Container App Fails to Pull Image from ACR: UNAUTHORIZED Authentication Required

Question

I am trying to deploy an Azure Container App using Terraform that pulls an image from my Azure Container Registry (ACR), but I'm encountering an authentication error. The error message indicates that the image is invalid because authentication is required to pull from ACR.

resource "azurerm_container_app" "container_app" {
  name                         = var.ContainerAppName
  resource_group_name          = var.ResourceGroup
  container_app_environment_id = azurerm_container_app_environment.container_app_env.id
  revision_mode                = "Single"

  template {
    container {
      name   = "app-name"
      image  = "${azurerm_container_registry.acr.login_server}/${var.ImageName}:latest"
      cpu    = 0.25
      memory = "0.5Gi"
    }
  }

  ingress {
    external_enabled           = true
    allow_insecure_connections = true
    target_port                = 80
    transport                  = "auto" # or "tcp" if using TCP
    traffic_weight {
      percentage      = 100
      latest_revision = true
    }
  }
}

I am currently trying to authenticate using Authenticating to Azure with the Azure CLI and will switch to Authenticating using a Service Principal with a Client Secret later on.

Error I am facing:

Error: creating Container App (Subscription: "<SUBSCRIPTION_ID>"
Resource Group Name: "<RESOURCE_GROUP_NAME>"
Container App Name: "<CONTAINER_APP_NAME>"): polling after CreateOrUpdate: polling failed: the Azure API returned the following error:

Status: "Failed"
Code: "ContainerAppOperationError"
Message: "Failed to provision revision for container app '<CONTAINER_APP_NAME>'. Error details: The following field(s) are either invalid or missing. Field 'template.containers.<CONTAINER_NAME>.image' is invalid with details: 'Invalid value: \"<ACR_LOGIN_SERVER>/<IMAGE_NAME>:latest\": GET https:?scope=repository%3A<IMAGE_NAME>%3Apull&service=<ACR_LOGIN_SERVER>: UNAUTHORIZED: authentication required, visit https://aka.ms/acr/authorization for more information.';.."
Activity Id: ""

API Response:

----[start]----
{"id":"/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.App/locations/<LOCATION>/containerappOperationStatuses/<OPERATION_STATUS_ID>","name":"<OPERATION_STATUS_ID>","status":"Failed","error":{"code":"ContainerAppOperationError","message":"Failed to provision revision for container app '<CONTAINER_APP_NAME>'. Error details: The following field(s) are either invalid or missing. Field 'template.containers.<CONTAINER_NAME>.image' is invalid with details: 'Invalid value: \"<ACR_LOGIN_SERVER>/<IMAGE_NAME>:latest\": GET https:?scope=repository%3A<IMAGE_NAME>%3Apull&service=<ACR_LOGIN_SERVER>: UNAUTHORIZED: authentication required, visit https://aka.ms/acr/authorization for more information.';.."},"startTime":"<TIMESTAMP>"}
-----[end]-----

with azurerm_container_app.container_app,
on main.tf line 41, in resource "azurerm_container_app" "container_app":
41: resource "azurerm_container_app" "container_app" {

creating Container App (Subscription: "<SUBSCRIPTION_ID>"
Resource Group Name: "<RESOURCE_GROUP_NAME>"
Container App Name: "<CONTAINER_APP_NAME>"): polling after CreateOrUpdate: polling failed: the Azure API returned the following error:

Status: "Failed"
Code: "ContainerAppOperationError"
Message: "Failed to provision revision for container app '<CONTAINER_APP_NAME>'. Error details: The following field(s) are either invalid or missing. Field 'template.containers.<CONTAINER_NAME>.image' is invalid with details: 'Invalid value: \"<ACR_LOGIN_SERVER>/<IMAGE_NAME>:latest\": GET https:?scope=repository%3A<IMAGE_NAME>%3Apull&service=<ACR_LOGIN_SERVER>: UNAUTHORIZED: authentication required, visit https://aka.ms/acr/authorization for more information.';.."
Activity Id: ""

API Response:

----[start]----
{"id":"/subscriptions/<SUBSCRIPTION_ID>/providers/Microsoft.App/locations/<LOCATION>/containerappOperationStatuses/<OPERATION_STATUS_ID>","name":"<OPERATION_STATUS_ID>","status":"Failed","error":{"code":"ContainerAppOperationError","message":"Failed to provision revision for container app '<CONTAINER_APP_NAME>'. Error details: The following field(s) are either invalid or missing. Field 'template.containers.<CONTAINER_NAME>.image' is invalid with details: 'Invalid value: \"<ACR_LOGIN_SERVER>/<IMAGE_NAME>:latest\": GET https:?scope=repository%3A<IMAGE_NAME>%3Apull&service=<ACR_LOGIN_SERVER>: UNAUTHORIZED: authentication required, visit https://aka.ms/acr/authorization for more information.';.."},"startTime":"<TIMESTAMP>"}
-----[end]-----

(REMOVED SENSITIVE INFORMATION)

Please remember <IMAGE_NAME> exists at <ACR_LOGIN_SERVER> with admin enabled, verified from UI.

Answer 1

The app is launching from Azure Container App, not your Terraform environment, therefore you need to provide the credentials to Azure Container App or using identity. You need to create "secret" and use "secret name" as reference.

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/container_app#registry

The authentication details must also be supplied, identity and username/password_secret_name are mutually exclusive.

These two blocks should be in azurerm_container_app resource block (like ingress and template):

...
registry {
    server               = "${azurerm_container_registry.acr.login_server}"
    username             = "${azurerm_container_registry.acr.admin_username}"
    password_secret_name = "registry-credentials"
}
secret {
  name = "registry-credentials"
  value = "${azurerm_container_registry.acr.admin_password}"
}
...

Based on your configuration, you may need identity in secret block.