Azure API Management fails to deploy

Question

I've been trying to deploy a Azure API Management into an existing subnet via Terraform for a couple days without any luck. I deployed an Azure API Management with the exact configuration to a couple weeks ago with no issue at all, so this is very weird.

I have the correct NSG rules and I have enabled the correct service endpoints.

Creating the API Management via Terraform it returns this error:

Unable to activate API service at this time. Please make sure the all the requirements for setting up vnet injection are met as specified in the doc https://aka.ms/apimvnet. Otherwise, this could be temporary issue in the region. Please check https://aka.ms/azurestatus for any issues. If the issue persists after retry, please open a support case for your API management service using the Azure portal.Please provide correlationId 2d1352b6-b8ad-eebf-dc8e-029e00d85865 and TimeStamp 4/12/2024 12:44:55 PM.

I see this error in the console:

Service activation failed. Please look at the details in Activity Log on the left side. In case you are deploying into VNET please make sure prerequisites are followed as described on https://aka.ms/apimvnet

In the activity logs I see a number of these errors:

• Operation name Get token
• Time stamp Fri Apr 12 2024 13:53:37 GMT+0100 (British Summer Time)
• Event initiated by chrisxxxxxx@xxxxxxx
• Error code InvalidOperation
• Message Invalid API Management service state: ActivationFailed

I also tried to create the APIM via the portal and I received this error:

Error code: InvalidAuthenticationTokenTenant

Error message: The access token is from the wrong issuer 'https://sts.windows.net/33e01921-xxxxxxxxxxxxxx/'. It must match the tenant 'https://sts.windows.net/0a77c881-xxxxxxxxxxxxxxx/' associated with this subscription. Please use the authority (URL) 'https://login.windows.net/0a77c881-xxxxxxxxxxxxx' to get the token. Note, if the subscription is transferred to another tenant there is no impact to the services, but information about new tenant could take time to propagate (up to an hour). If you just transferred your subscription and see this error message, please try back later.

As mentioned, I deployed an Azure API Management with the exact configuration to a couple weeks ago with no issue at all, so I don't know what else I should do. Would anyone have any ideas?

Answer 1

@Chris B Thanks for reaching out and apologies for the inconvenience due to this issue. I am able to reproduce this issue inhouse and confirmed that this is a Bug in the standard V2 APIM. Created a work item to fix this bug and being tracked internally. We don't have an exact ETA at the moment will revert back to you as soon as I have an update.

Feel free to add a comment if any questions.

Please accept as Yes if the answer provided is useful, so that you can help others in the community looking for remediation for similar issues.