Certs service deployment failed updating `static_website`

[jonnyry]

I received the following error deploying the certs shared service.

I've deleted and redeployed several times and don't think its a transient network error.

485d2dd8-79ba-4e3d-91cb-6582148a7d04: Error message: 
 
 Error: updating `static_website`: executing request: Put "https://stwebcertsmytre.blob.core.windows.net/?comp=properties&restype=service": HTTP response was nil; connection may have been reset 
  
   with azurerm_storage_account.staticweb, 
   on staticweb.tf line 2, in resource "azurerm_storage_account" "staticweb": 
    2: resource "azurerm_storage_account" "staticweb" { 
  
 error running command /cnab/app/terraform /usr/bin/terraform apply -auto-approve -input=false -var cert_name=nexus-ssl -var domain_prefix=nexus -var enable_cmk_encryption=false -var key_store_id= -var tre_id=mytre -var tre_resource_id=485d2dd8-79ba-4e3d-91cb-6582148a7d04: exit status 1 Error: error running command /cnab/app/terraform /usr/bin/terraform apply -auto-approve -input=false -var cert_name=nexus-ssl -var domain_prefix=nexus -var enable_cmk_encryption=false -var key_store_id= -var tre_id=mytre -var tre_resource_id=485d2dd8-79ba-4e3d-91cb-6582148a7d04: exit status 1 1 error occurred:   * mixin execution failed: package command failed /cnab/app/cnab/app/mixins/terraform/runtimes/terraform-runtime install 
 
 Error: updating `static_website`: executing request: Put "https://stwebcertsmytre.blob.core.windows.net/?comp=properties&restype=service": HTTP response was nil; connection may have been reset 
  
   with azurerm_storage_account.staticweb, 
   on staticweb.tf line 2, in resource "azurerm_storage_account" "staticweb": 
    2: resource "azurerm_storage_account" "staticweb" { 
  
 error running command /cnab/app/terraform /usr/bin/terraform apply -auto-approve -input=false -var cert_name=nexus-ssl -var domain_prefix=nexus -var enable_cmk_encryption=false -var key_store_id= -var tre_id=mytre -var tre_resource_id=485d2dd8-79ba-4e3d-91cb-6582148a7d04: exit status 1 Error: error running command /cnab/app/terraform /usr/bin/terraform apply -auto-approve -input=false -var cert_name=nexus-ssl -var domain_prefix=nexus -var enable_cmk_encryption=false -var key_store_id= -var tre_id=mytre -var tre_resource_id=485d2dd8-79ba-4e3d-91cb-6582148a7d04: exit status 1    1 error occurred:  * mixin execution failed: package command failed /cnab/app/cnab/app/mixins/terraform/runtimes/terraform-runtime install 
 
 Error: updating `static_website`: executing request: Put "https://stwebcertsmytre.blob.core.windows.net/?comp=properties&restype=service": HTTP response was nil; connection may have been reset 
  
   with azurerm_storage_account.staticweb, 
   on staticweb.tf line 2, in resource "azurerm_storage_account" "staticweb": 
    2: resource "azurerm_storage_account" "staticweb" { 
  
 error running command /cnab/app/terraform /usr/bin/terraform apply -auto-approve -input=false -var cert_name=nexus-ssl -var domain_prefix=nexus -var enable_cmk_encryption=false -var key_store_id= -var tre_id=mytre -var tre_resource_id=485d2dd8-79ba-4e3d-91cb-6582148a7d04: exit status 1 Error: error running command /cnab/app/terraform /usr/bin/terraform apply -auto-approve -input=false -var cert_name=nexus-ssl -var domain_prefix=nexus -var enable_cmk_encryption=false -var key_store_id= -var tre_id=mytre -var tre_resource_id=485d2dd8-79ba-4e3d-91cb-6582148a7d04: exit status 1    1 error occurred:  * container exit code: 1, message: <nil>   ; Command executed: porter install "485d2dd8-79ba-4e3d-91cb-6582148a7d04" --reference mytreacr.azurecr.io/tre-shared-service-certs:v0.7.5 --param arm_environment="public" --param arm_use_msi="true" --param azure_environment="AzureCloud" --param cert_name="nexus-ssl" --param domain_prefix="nexus" --param enable_cmk_encryption="false" --param id="485d2dd8-79ba-4e3d-91cb-6582148a7d04" --param key_store_id="" --param tfstate_container_name="tfstate" --param tfstate_resource_group_name="rg-mytre-mgmt" --param tfstate_storage_account_name="mytremgmtstore" --param tre_id="mytre" --force --credential-set arm_auth --credential-set aad_auth

[jonnyry]

Tried running on a seperate fresh TRE instance and same issue occured.

[jonnyry]

OK this appears to be the issue, the RP is being blocked from accessing the storage account:

Manually adding the storage service tag in to the nrc-resource-processor-subnet allows the certs service to install successfully.