can not update identity of Microsoft.App/managedEnvironments@2025-02-02-preview via azapi_update_resource

[s-nakagaki]

terraform: v1.12.2
azapi: 2.5.0

I tried this. terraform validate said An argument named "identity" is not expected here.

resource "azapi_update_resource" "container_apps_environment" {
  type      = "Microsoft.App/managedEnvironments@2025-02-02-preview"
  name      = azurerm_container_app_environment.main.name
  parent_id = data.azurerm_resource_group.main.id
  identity = {
    type = "UserAssigned"
    identity_ids = [
      azurerm_user_assigned_identity.container_apps.id
    ]
  }
  body = {

I tried this. terraform validate said Success! The configuration is valid.

resource "azapi_update_resource" "container_apps_environment" {
  type      = "Microsoft.App/managedEnvironments@2025-02-02-preview"
  name      = azurerm_container_app_environment.main.name
  parent_id = data.azurerm_resource_group.main.id
  body = {
    identity = {
      type = "UserAssigned"
      identity_ids = [
        azurerm_user_assigned_identity.container_apps.id
      ]
    }

but ah, terraform apply said

│ --------------------------------------------------------------------------------
│ RESPONSE 400: 400 Bad Request
│ ERROR CODE: MissingIdentityIds
│ --------------------------------------------------------------------------------
│ {
│   "error": {
│     "code": "MissingIdentityIds",
│     "message": "The identity ids must not be null or empty for 'UserAssigned' identity type."
│   }
│ }

What should I do?

thanks

[ms-henglu]

Hi @s-nakagaki ,

Thank you for taking time to report this issue.

The issue you're experiencing is related to the correct format for user-assigned identities when updating a Container Apps managed environment.

The Problem: You're trying to use identity_ids property, but this doesn't match the Azure API schema for Container Apps managed environments. The API error "MissingIdentityIds" indicates that the user-assigned identities are not being passed correctly.

The Solution: For Microsoft.App/managedEnvironments@2025-02-02-preview, you need to use userAssignedIdentities as a dictionary where the keys are the full ARM resource IDs of the user-assigned identities, and the values are empty objects {}.

Here's the correct format:

resource "azapi_update_resource" "container_apps_environment" {
  type      = "Microsoft.App/managedEnvironments@2025-02-02-preview"
  name      = azurerm_container_app_environment.main.name
  parent_id = data.azurerm_resource_group.main.id
  body = {
    identity = {
      type = "UserAssigned"
      userAssignedIdentities = {
        (azurerm_user_assigned_identity.container_apps1.id) = {}
        (azurerm_user_assigned_identity.container_apps2.id) = {}
      }
    }
  }
}