NamedValue not getting replaced in Connection String for APIM Bicep

[sajid08]

Bicep version
v0.31.92

Describe the bug
I have a namedValue defined for APIM that in turn refers it's value from a key vault secret, but when I try to use that namedValue in the connection string for Application Insights logger, it fails with this error.

"Validation failed for logger-id 'appi_logger_smi'. Exception Received 'Invalid instrumentation key for Application Insights Logger"

To Reproduce
Define a NamedValue like this

resource apim_name_appi_instrumentation_key 'Microsoft.ApiManagement/service/namedValues@2023-05-01-preview' = {
  parent: apim_name_resource
  name: 'appi-instrumentation-key'
  properties: {
    displayName: 'appi-instrumentation-key'
    keyVault: {
      secretIdentifier: 'https://${kv_name}.vault.azure.net/secrets/appi-instrumentation-key'
    }
    tags: []
    secret: true
  }
}

then try to access it in the logger.

resource aiLoggerWithSystemAssignedIdentity 'Microsoft.ApiManagement/service/loggers@2022-08-01' = {
  name: 'appi_logger_smi'
  parent: apim_name_resource
  properties: {
    loggerType: 'applicationInsights'
    description: 'Application Insights logger with system-assigned managed identity'
    credentials: {
      connectionString: 'InstrumentationKey=@{{appi-instrumentation-key}};IngestionEndpoint=https://uksouth-1.in.applicationinsights.azure.com/'
      identityClientId: 'systemAssigned'
    }
    isBuffered: true
    resourceId: appi_externalid
  }
  dependsOn: [
    apim_name_appi_instrumentation_key
  ]
}

Additional context
Add any other context about the problem here.

[levimatheri]

I think it might be due to how the named-value is referenced. Try removing the @, i.e. connectionString: 'InstrumentationKey={{appi-instrumentation-key}};IngestionEndpoint=https://uksouth-1.in.applicationinsights.azure.com/'

[sajid08]

I think it might be due to how the named-value is referenced. Try removing the @, i.e. connectionString: 'InstrumentationKey={{appi-instrumentation-key}};IngestionEndpoint=https://uksouth-1.in.applicationinsights.azure.com/'

Yes, I tried that first, it fails with validation error

[miqm]

I think you can't use connection string with api-management. I think it only supports instrumentationKey like this:

resource applicationInsightsLogger 'Microsoft.ApiManagement/service/loggers@2020-12-01' = {
  parent: apiManagement
  name: applicationInsightsName
  properties: {
    loggerType: 'applicationInsights'
    credentials: {
      instrumentationKey: '{{${applicationInsightsNamedValue.properties.displayName}}}'
    }
  }
}

I'm using this widely and it works like a charm the named value can be a KV reference, it doesn't really matter as the API-M fetches the value into it's store and then it's used in policies or in above.

[levimatheri]

Seems like they do support connectionString, at least they provide an example of it in the documentation.

[riosengineer]

+1 I am also facing a similar issue.

If I deploy like:

    loggers: [
      {
        name: 'applicationInsights'
        loggerType: 'applicationInsights'
        isBuffered: true
        credentials: {
           connectionString: applicationInsights.outputs.connectionString
           identityClientId: 'systemAssigned'
        }
        resourceId: applicationInsights.outputs.resourceId
      }
    ]

APIM will generate a namedValue with a guid containing my connection string. If I redeploy the template, it will generate another (new) namedValue. This sucks.

If I try with my own named value defined (that contains the connection string):

  loggers: [
    {
      name: 'applicationInsights'
      loggerType: 'applicationInsights'
      isBuffered: true
      credentials: {
         connectionString: {{applicationInsightsConnectionString}}
         identityClientId: 'systemAssigned'
      }
      resourceId: applicationInsights.outputs.resourceId
    }
  ]

It will deploy the logger but the identityClientId value becomes {{applicationInsightsConnectionString}} instead of systemAssigned and therefore, it is not valid and no metrics stream to application insights.

Is this a resource provider issue?

@levimatheri

[GABRIELNGBTUC]

I believe you are expected to put the instrumentation key in full because if you try to use variable substitution using the rest API, you get the following error:

Exception Received 'The connection string is not valid: There was an error parsing the Connection String: Input contains invalid delimiters and cannot be parsed. Expected example: 'key1=value1;key2=value2;key3=value3'

This is triggered by the brackets used by variable substitution. However, variable substitution is supported for the identityClientId field (automatically generated).

Also, I see that you are using AAD authentication to the application insights resource so you could simply put the connection string in plain text and disable local authentication on the application insights resource. Once local authentication is disabled, the connection string loses a lot of sensibility (as long as you don't reactivate it of course).