Specifying user-assigned managed identity in Azure Function Terraform script

Question

I'm deploying Azure Function using Terraform script with AzAPI provider (because Flex Consumption plan isn't supported by AzureRM yet). The Function needs be assigned a user-assigned managed identity. My code is below

resource "azapi_resource" "function_apps" {
  type  = "Microsoft.Web/sites@2024-04-01"
  schema_validation_enabled = false
  location = var.location
  name = var.FunctionAppName
  parent_id = var.resourcegroup
  body = {
    kind = "functionapp,linux",
    identity = {
      type = "UserAssigned"
      userAssignedIdentities = {

      }
    }
    ...

variable "myManagedIdentity" {
  type = string
  default = "/subscriptions/{subscriptionId}/resourcegroups/{resourceGroupName}/providers/Microsoft.ManagedIdentity/userAssignedIdentities/{identityName}"
}

According to this documentation, it says that userAssignedIdentities accepts object and it should be the dictionary referencing to managed identity resource ID. I have that declared as myManagedIdentity variable but I don't know how to put it in the userAssignedIdentities object.

The example in said documentation doesn't help much:

identity = {
    type = "string"
    userAssignedIdentities = {
      {customized property} = {
      }
    }
  }

Thanks.

Answer 1

It says that userAssignedIdentities accepts object and it should be the dictionary referencing to managed identity resource ID. I have that declared as myManagedIdentity variable but I don't know how to put it in the userAssignedIdentities object.

In order to achieve the above requirement regarding the addition of userAssignedIdentities object according to its format, use below given terraform code. I have successfully able to deploy it without any issues.

variable "usManagedIdentity" {
  type = string
  default = "/subscriptions/f7bxxx2832b014/resourceGroups/caronew/providers/Microsoft.ManagedIdentity/userAssignedIdentities/newuser"
}
terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
      version = "2.2.0"
    }
  }
}

provider "azapi" {
  # Configuration options
}
provider "azurerm"{
features{}
subscription_id = "f7xxxx014"
}
resource "azurerm_resource_group" "sample" {
  name     = "flex-function-rgnew"
  location = "East US"
}

resource "azurerm_service_plan" "sample" {
  name                = "flex-funsdction-plan"
  resource_group_name = azurerm_resource_group.sample.name
  location            = azurerm_resource_group.sample.location
  os_type             = "Linux"
  sku_name            = "FC1"
}
resource "azurerm_storage_account" "sample" {
  name                     = "flexfuncssdsda"
  resource_group_name      = azurerm_resource_group.sample.name
  location                 = azurerm_resource_group.sample.location
  account_tier             = "Standard"
  account_replication_type = "LRS"
}

resource "azurerm_storage_container" "sample" {
  name                  = "my-flex-consumpeedtion-app"
  storage_account_name  = azurerm_storage_account.sample.name
  container_access_type = "private"
}
resource "azapi_resource" "sample" {
  type      = "Microsoft.Web/sites@2023-12-01"
  name      = "my-flex-consumption-appjh"
  location  = azurerm_resource_group.sample.location
  parent_id = azurerm_resource_group.sample.id

  body = {
    kind = "functionapp,linux"
    identity = {
      type = "UserAssigned"
      userAssignedIdentities = {
        "${var.usManagedIdentity}" = {}
      }
     }
    properties = {
      serverFarmId           = azurerm_service_plan.sample.id
      httpsOnly              = true
      functionAppConfig = {
        deployment = {
          storage = {
            type  = "blobContainer"
            value = "${azurerm_storage_account.sample.primary_blob_endpoint}${azurerm_storage_container.flex_function.name}"
            authentication = {
              type = "UserAssignedIdentity"
              userAssignedIdentityResourceId = "/subscriptions/f7bxxx2b014/resourceGroups/caronew/providers/Microsoft.ManagedIdentity/userAssignedIdentities/newuser"
            }
          }
        }
        runtime = {
          name    = "python"
          version = "3.11"
        }
        scaleAndConcurrency = {
          instanceMemoryMB     = 512
          maximumInstanceCount = 20
          triggers = {}
        }
      }

      siteConfig = {
        appSettings = [
          {
            name  = "FUNCTIONS_EXTENSION_VERSION"
            value = "~4"
          },
          
          {
            name  = "AzureWebJobsDashboard__accountName"
            value = azurerm_storage_account.sample.name
          },
          {
            name  = "AzureWebJobsStorage__accountName"
            value = azurerm_storage_account.sample.name
          }
        ]
      }
    }
  }
}

Deployment succeeded:

Reference blog for deploying a flex consumption plan function app with terraform.