Unable to Create Service Connector Between Azure Function App and MySQL Flexible Server in VNet

Ofek Waiz 0

Hello,

I'm trying to set up a service connector between an Azure Function App and a MySQL Flexible Server, but I’m encountering difficulties because the database server is within a Virtual Network (VNet).

Steps Tried:

Used the Azure CLI command:

bash

az extension add --name serviceconnector-passwordless --upgrade
az functionapp connection create mysql-flexible --connection <connection-name> --source-id <function-app-resource-id> --target-id <mysql-resource-id> --client-type nodejs --system-identity

However, I received this error:

"Service principal 'systemAssignedIdentity' doesn't exist"

Attempted to use a containerized app within the same VNet to execute the CLI command but encountered similar issues.

Tried creating the connector via the Azure Portal, but it reported:

"The database server is in Virtual Network and Cloud Shell can't connect to it."

Question:

How can I connect to the VNet from my local environment or any other environment and execute the Azure CLI command to set up the service connector? Is there an Azure API or a recommended method to achieve this without needing to use a containerized function app?

Any guidance would be greatly appreciated.

Environment Details:

Azure Function App: Non-containerized
MySQL Flexible Server: Within a VNet

Thank you!

1 answer

Pinaki Ghatak 5,390 Reputation points Microsoft Employee

2024-11-27T09:57:31.4333333+00:00

Hello @Ofek Waiz

Firstly, the error message you received indicates that the system-assigned identity for your Function App does not exist.

You can try enabling the system-assigned identity for your Function App by running the following Azure CLI command:

az functionapp identity assign --name --resource-group

Once you have enabled the system-assigned identity for your Function App, you can try creating the service connector again using the Azure CLI command you mentioned earlier. If you are still encountering issues, you can try connecting to the VNet from your local environment using a VPN or ExpressRoute connection.

Once you are connected to the VNet, you should be able to execute the Azure CLI command to create the service connector.

Alternatively, you can try using the Azure Portal to create the service connector. To do this, you will need to create a Virtual Network Service Endpoint for your MySQL Flexible Server and then create the service connector using the Azure Portal.

You can find more information on how to do this in the following article: Create and manage virtual networks for Azure Database for MySQL - Flexible Server using the Azure CLIL.

I hope that this response has addressed your query and helped you overcome your challenges. If so, please mark this response as Answered. This will not only acknowledge our efforts, but also assist other community members who may be looking for similar solutions.
Please sign in to rate this answer.
Ofek Waiz 0 Reputation points

2024-11-27T12:50:03.1033333+00:00

Hey @Pinaki Ghatak
Thank you for your response and guidance!

I have already enabled the system-assigned identity for my Function App using the Azure Portal, and I confirmed it is active. I also verified that the Function App and MySQL Flexible Server are within the same Virtual Network.

However, when attempting to create the service connector via the Azure CLI, I still encounter the error: Service principal 'systemAssignedIdentity' doesn't exist.

Could you clarify what could be causing this issue despite the identity being enabled?

Additionally, while I understand connecting via VPN or ExpressRoute to execute commands locally, my preference is to handle everything programmatically or within Azure services. If there’s a way to create the service connector via the Azure SDK or another Azure API, could you please point me to the appropriate resources or examples?

I appreciate your suggestion about using Virtual Network Service Endpoints for the MySQL Flexible Server. Since the database is already in a VNet, do I still need to explicitly configure this, or is it automatically handled in this scenario?

Thanks in advance for your assistance!

Sai Raghunadh M 1,605 Reputation points Microsoft Vendor

2024-11-28T17:22:02.8466667+00:00

Hi @Ofek Waiz

Is your issue resolved?

Sai Raghunadh M 1,605 Reputation points Microsoft Vendor

2024-11-29T10:33:41.2833333+00:00

Hi @Ofek Waiz

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Sai Raghunadh M 1,605 Reputation points Microsoft Vendor

2024-12-02T17:35:57.3066667+00:00

Hi @Ofek Waiz

Thank you for the additional details. Based on the information you've provided, I understand you’ve already enabled the system-assigned identity for your Function App, and it’s within the same VNet as your MySQL Flexible Server.

Here are a few more things to check or try to resolve the issue:

The error you’re seeing, "Service principal 'systemAssignedIdentity' doesn't exist", typically occurs if the Azure CLI is unable to detect the system-assigned identity. Here are additional steps you can try:

Reassign the Identity: Try reassigning the identity using the following CLI command to ensure its linked correctly:

az functionapp identity assign --name <function-app-name> --resource-group <resource-group-name>

Since both the Function App and the MySQL Flexible Server are in the same VNet, it should generally allow connectivity. However, verify that the VNet Integration is configured for the Azure Function App:

In the Azure Portal, go to your Function App, and under Networking, check that VNet Integration is enabled for the correct VNet and subnet.

Since your MySQL Flexible Server is already within the VNet, you do not need to configure Virtual Network Service Endpoints separately unless you’re using a different subnet or there’s specific network isolation in place. However, if you're planning to extend your setup or if there are additional network security concerns, configuring the Service Endpoints may be beneficial for secure access to Azure services within the VNet.

I hope this information helps, please do let us know if you have any Queries.

Ofek Waiz 0 Reputation points

2024-12-03T08:53:39.87+00:00

Hi @Sai Raghunadh M ,

Thank you for your response and suggestions. Here's an update on what I have tried:

Reassigning the Identity: I ran the provided CLI command to reassign the system-assigned identity for my Function App. The command executed successfully, and I received the following response (with sensitive details omitted):
{ "principalId": "<principal-id>", "tenantId": "<tenant-id>", "type": "SystemAssigned, UserAssigned", "userAssignedIdentities": { "/subscriptions/<subscription-id>/resourcegroups/<resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<identity-name1>": { "clientId": "<client-id>", "principalId": "<principal-id>" }, "/subscriptions/<subscription-id>/resourcegroups/<resource-group>/providers/Microsoft.ManagedIdentity/userAssignedIdentities/<identity-name2>": { "clientId": "<client-id>", "principalId": "<principal-id>" } }
Does it confirm that the identity is successfully assigned?

Networking Configuration: I verified that both the Function App and the MySQL Flexible Server are within the same Virtual Network (ofek-function-app-group-vnet). However, they are on different subnets:

MySQL is on the default subnet.

The Function App is on the default3 subnet. Since the subnets are within the same Virtual Network, I believe this should not prevent connectivity.

Despite these steps, I am still encountering the error: "Service principal 'systemAssignedIdentity' doesn't exist."

Could the subnet configuration be affecting the service connector creation? If so, are there additional steps I need to take to ensure communication across subnets, such as explicit route configurations or other VNet-level settings?

Additionally, if there’s another potential root cause for this error, I’d appreciate any further insights or guidance.

Thank you for your support!

Sai Raghunadh M 1,605 Reputation points Microsoft Vendor

2024-12-04T10:10:34.6233333+00:00

Hi @Ofek Waiz

It appears that you have already enabled the system-assigned identity for your Function App, which is excellent. However, there are instances where the CLI might not recognize it even after activation. I suggest reassigning the identity to ensure it is properly configured:

az functionapp identity assign --name <your-function-app-name> --resource-group <your-resource-group>

Additionally, ensure that the identity has the appropriate permissions to access the MySQL Flexible Server. You can assign either the Contributor or Reader role as follows:

az role assignment create --assignee <identity-principal-id> --role "Contributor" --scope /subscriptions/<subscription-id>/resourceGroups/<resource-group>/providers/Microsoft.DBforMySQL/servers/<mysql-server-name>

If your Function App and MySQL server are located in different subnets, please ensure that there are no Network Security Groups (NSGs) or route tables obstructing communication between them.

I hope this information helps, please do let us know if you have any Queries.

NIKHILA NETHIKUNTA 4,005 Reputation points Microsoft Vendor

2024-12-05T18:38:31.5866667+00:00

Hi @Ofek Waiz
We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help.

Ofek Waiz 0 Reputation points

2024-12-09T09:23:31.1666667+00:00

Hey @Sai Raghunadh M , @NIKHILA NETHIKUNTA
Thank you for your response. I understand the importance of reassigning the identity, and I would like to clarify that I have already followed this step multiple times, including using the exact command you provided a couple of times (it seems you told me that the command worked properly but than you just told me to run it again). Each time, the system-assigned identity is successfully assigned, and the CLI confirms this with the expected output.

Additionally, I have already ensured the following:

The system-assigned identity has been successfully configured for the Function App.

Both the Function App and MySQL Flexible Server are located in the same Virtual Network but in different subnets (default3 for the Function App and default for MySQL). There are no NSGs or route tables blocking communication between these subnets.

I have rechecked the necessary permissions, and I can confirm that the identity has been assigned the Contributor role for the MySQL Flexible Server's scope.

Despite these efforts, the error persists: "Service principal 'systemAssignedIdentity' doesn't exist."

I would appreciate it if we could move beyond reassigning the identity and explore alternative troubleshooting steps or root causes for this issue. Are there additional diagnostics we can run to pinpoint why the service principal is not being recognized during the service connector creation?

Looking forward to your insights.

Thank you,
Ofek

Sai Raghunadh M 1,605 Reputation points Microsoft Vendor

2024-12-10T07:53:33.8933333+00:00

Hi @Ofek Waiz

It appears you have diligently followed the steps, yet you are still encountering the error "Service principal 'systemAssignedIdentity' doesn't exist" despite enabling and verifying the system-assigned identity and networking configurations. Considering the complexity of this issue, let's proceed with some advanced troubleshooting steps and additional configurations to help resolve this.

To determine if the issue is related to the local network environment, you can test the connection from an Azure VM within the same VNet. Follow these steps:

Create a temporary Azure VM in the same VNet as your Function App and MySQL Flexible Server.

Install the Azure CLI on the VM.

SSH into the VM and run the CLI command to verify if the identity is detected correctly.

This can help confirm whether the problem is related to the local environment or network.

Investigate Potential Service Principal (SP) Issues

The error you are encountering points to a service principal issue. If the system-assigned identity is not being recognized, there might be a problem with how Azure is linking your Function App to the service principal. Please verify the following:

Confirm the Existence of the Service Principal:

az ad sp show --id <principal-id>

If this command does not return any information, it may indicate that Azure has not properly created the service principal for your system-assigned identity.

Recreate the Service Principal: In rare instances, you may need to manually create the service principal for the managed identity (although Azure should automatically handle this). You can do this by executing:

az ad sp create-for-rbac --name <name-of-sp>

However, this should not be necessary in most cases because Azure should handle this for you automatically.

I hope this information helps, please do let us know if you have any Queries.

Sai Raghunadh M 1,605 Reputation points Microsoft Vendor

2024-12-11T14:15:20.4933333+00:00

Hi @Ofek Waiz

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. In case if you have any resolution please do share that same with the community as it can be helpful to others. Otherwise, will respond with more details and we will try to help
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Unable to Create Service Connector Between Azure Function App and MySQL Flexible Server in VNet

1 answer

Your answer