SubnetsHaveNoServiceEndpointsConfigured error when deplying cosmosdb account

Question

I'm trying to deploy cosmosdb account with mongodb on azure with terraform. But 'terraform apply' times out with SubnetsHaveNoServiceEndpointsConfigured error.

Error: creating CosmosDB Account "geo-db-2pv0c" (Resource Group "geo"): waiting for the CosmosDB Account "geo-db-2pv0c" (Resource Group "geo") to finish creating/updating: Code="BadRequest" Message="Database account creation failed. Operation Id: b2f838e87b6c, Error : {\r\n "error": {\r\n "code": "SubnetsHaveNoServiceEndpointsConfigured",\r\n "message": "Subnets geo-internal-1 of virtual network /subscriptions/b5a3431d77a5/resourceGroups/geo/providers/Microsoft.Network/virtualNetworks/geo-network do not have ServiceEndpoints for Microsoft.AzureCosmosDB resources configured. Add Microsoft.AzureCosmosDB to subnet's ServiceEndpoints collection before trying to ACL Microsoft.AzureCosmosDB resources to these subnets.",\r\n "details": []\r\n }\r\n}\r\nActivityId: 95817ee8-801f-415d-ad06-06fd9af4130d, Microsoft.Azure.Documents.Common/2.14.0, Microsoft.Azure.Documents.Common/2.14.0, Microsoft.Azure.Documents.Common/2.14.0, Microsoft.Azure.Documents.Common/2.14.0, Microsoft.Azure.Documents.Common/2.14.0, Microsoft.Azure.Documents.Common/2.14.0, Microsoft.Azure.Documents.Common/2.14.0" │ │ with azurerm_cosmosdb_account.db, │ on azure_cosmosdb.tf line 9, in resource "azurerm_cosmosdb_account" "db": │ 9: resource "azurerm_cosmosdb_account" "db" {

There is no info on this error and how to that endpoint to a subnet. Anyone knows how to do that?

resource "azurerm_cosmosdb_account" "db" {
  name                = "geofriends-db-${random_string.random-name.result}"
  location            = azurerm_resource_group.geofriends.location
  resource_group_name = azurerm_resource_group.geofriends.name
  offer_type          = "Standard"
  kind                = "MongoDB"

  enable_automatic_failover = true

  is_virtual_network_filter_enabled = true

  virtual_network_rule {
    id = azurerm_subnet.subnet-internal-1.id
  }

  capabilities {
    name = "EnableMongo"
  }

  capabilities {
    name = "MongoDBv3.4"
  }

  consistency_policy {
    consistency_level       = "BoundedStaleness"
    max_interval_in_seconds = 300
    max_staleness_prefix    = 100000
  }

  geo_location {
    prefix            = "cosmosdb-s${random_string.random-name.result}-failover"
    location          = var.failover_location
    failover_priority = 1
  }

  geo_location {
    prefix            = "cosmosdb-s${random_string.random-name.result}-main"
    location          = azurerm_resource_group.geofriends.location
    failover_priority = 0
  }
}

Answer 1

The service endpoint is an Azure requirement; there's no change you could make to the CosmosDB deployment which will get around that.

Assuming you are also deploying the vnet and subnet through Terraform, then I guess you need to specify the service endpoint when you do so; see azurerm_subnet.