Forum Discussion
Bicep Error While Integration API Management with Function App
Team,
We are trying to automate the deployment of Azure Function App with Azure API Management so that when there is a schema change, we dont have to manually update the APIM with the functionApp schema changes.
Our API Management and Function App are inside different resource groups, but inside the same subscription. I have a main.bicep file withe following relevant parts.
main.bicep
targetScope = 'resourceGroup'
parameter definisions
Modules defined inside the bicep file like this
module functionapp 'modules/funcapp.bicep' = {
name: 'funappDeploy'
params: {
tags: tags
location: location
application: application
environment: environment
instrumentationKey: appinsight.outputs.instrumentationKey
storageAccountName: storageaccount.outputs.storageAccountName
functionSubNetId: networking.outputs.functionSubnetId
appInsightsConSting: appinsight.outputs.appInsightsConSting
}
}
module apimanagement 'modules/apimanagement.bicep' = {
name: 'apimdeploy'
params: {
application: application
environment: environment
}
}
API Management resource is already existing and API's including my relevant API is deployed inside. This was done early without automation. And here is my apimanagement.bicep
targetScope = 'resourceGroup'
param environment string
param application string = 'gcob-ncino'
var apimName = 'apim-rxx-${application}-${environment}'
var resourceGroupName = 'rg-rxx-apim-${application}-${environment}'
resource apiManagement 'Microsoft.ApiManagement/service@2024-05-01' existing = {
name: apimName
scope: resourceGroup(resourceGroupName)
}
resource apimApi 'Microsoft.ApiManagement/service/apis@2024-05-01' = {
name: 'yourApimApiName'
parent: apiManagement
properties: {
name: 'risk-rating' // This is the API name within APIM
path: '/' // The base path for this API
displayName: 'risk-rating'
}
}
resource apimBackend 'Microsoft.ApiManagement/service/backends@2024-05-01' = {
name: 'my-function-app'
parent: apiManagement
properties: {
protocol: 'https' // Or https
url: 'azfun-my-dev.azurewebsites.net'
}
}
resource apimApiBackendLink 'Microsoft.ApiManagement/service/apis/backends@2021-08-01' = {
name: 'my-function-app-link'
parent: apimApi
properties: {
backendId: apimBackend.id
}
}While deploying through the Azure DevOps, I see the below error in the pipeline.
A resource's computed scope must match that of the Bicep file for it to be deployable. This resource's scope is computed from the "scope" property value assigned to ancestor resource "apiManagement". You must use modules to deploy resources to a different scope. [https://aka.ms/bicep/core-diagnostics#BCP165]
Can someone suggest, how to fix this problem?
Thanks
DD
2 Replies
The portal "Import Function App" experience does more than create an APIM API. It discovers HTTP-triggered functions, creates or uses a host key, stores that key as an APIM named value, and wires the backend/API operation details. In Bicep you usually need to model those pieces explicitly.
The safer automation pattern is:
- Expose an OpenAPI definition from the Function App, or generate one during build.
- Deploy/import the APIM API from that OpenAPI document.
- Create a backend or named value for the Function host key.
- Add an APIM policy to send the function key, unless you are using managed identity/EasyAuth instead.
- If APIM and Function App are in different resource groups, use existing resources with the correct scope in Bicep.
If the Bicep error is around listKeys() or resource scope, check that the module/resource is scoped to the Function App resource group and that the API version supports the key operation you are calling.
Useful docs:
https://learn.microsoft.com/azure/api-management/import-function-app-as-api
https://learn.microsoft.com/azure/api-management/import-api-from-oas
https://learn.microsoft.com/azure/azure-functions/functions-openapi-definition- Consider module instead of apiManagement
- Change apimanagement.bicep to Subscription Scope instead of resourceGroup
targetScope = 'subscription'3. Modify module definition to specify the correct resource group:
module apimanagement 'modules/apimanagement.bicep' = { name: 'apimdeploy' scope: resourceGroup('rg-rxx-apim-${application}-${environment}') params: { application: application environment: environment } }4. Use dependsOn to ensure proper sequencing.
