Hi everyone, I’m sure this must have come up numerous times before, but I must not be coming up with the correct search keywords, so apologies if this has been asked and answered already: I’m struggling with a “bidirectional dependency” situation while setting up an Azure Web App with a custom hostname binding, using an App Service Managed Certificate, which is a relatively new type of certificate resource that MS provisions and manages for your web app, for any hostname you can prove ownership of (using a CNAME record). To begin with, managed certificates are not yet a supported resource type in the Azure provider, so I’m creating that using a

TemplateDeployment

resource, which works well. I’m even able to get the thumbprint out of it, so all good there. However: • To create a managed certificate, the corresponding

CustomHostnameBinding

resource must already exist • To activate TLS for the

CustomHostnameBinding

, we need to specify the certificate thumbprint • To get the certificate thumbprint, we need to create the managed certificate • => circular dependency… How do we typically work around these things? Is there any way that I can create the

CustomHostnameBinding

resource, and then later in the same Pulumi program, update it with the properties for certificate thumbprint?

There’s no way to update the properties of a resource later in the program. This doesn’t quite make sense because resources are created at a later stage than the program execution, not line-by-line so to speak. Usually, circular dependencies are a sign of sub-optimal resource model. In your case, ideally, there would be a certificate resource to gen the thumbprint, a custom hostname binding resource, and a managed certificate resource. Aren’t you able to do so? I.e., can you set the thumbprint for the

TemplateDeployment

instead of getting it back as an output?

@tall-librarian-49374 no, because the managed certificate is newly created by MS at the time of deployment. The thumbprint is not known until after it’s been deployed.

Yeah, this sucks. Do you know if it’s possible to achieve with pure ARM templates? For Pulumi, I’m thinking maybe a dynamic provider that updates the binding.

It’s possible with ARM, but you have to use a nested template (which is pretty cumbersome).

I’m not sure, let me find the blog post I saw..

Yeah, it has two hostname bindings: one in the main without the cert, one in the linked with thumbprint

Yep

I wonder if the same would work in Pulumi? Or will it detect the existing binding and fail?

Hm… that’s interesting. You mean, Pulumi might detect the duplicate, before it even gets to Azure?

Yes. But the second one depends on the managed certificate.

Yes

Are you on 1.x or 2.x of Azure provider?

2.1.0

2.x become more strict with checking existing resources (there will be a blog post mentioning this, probably later today).

bah, ok

Ah, you are on .NET, I didn’t ask. Dynamic providers aren’t supported there yet 😞

🤯

Okay, so it worked as it should but then you don’t have a hack for your scenario

@tall-librarian-49374 I think I figured out a way. First, create hostname binding (without cert) Second, create template deployment (depends on hostname) which contains: • The certificate • The hostname binding again, but this time in template (depends on certificate, in ARM terms)

Makes sense

@powerful-football-81694 I need to add a custom domain on my AppService as well with a Managed Certificate. Whould it be possible for you to share some code on how you succeed to do that ?

@millions-journalist-34868 Yeah sure. It’s C# code, will that work for you?

Yes I am using C# as well

OK, let’s see

That is great, thanks for sharing.