title: ARM deployment failed for event grid subscription on endpoint webhook url
body: <p>Using terraform and Azure ARm template , I am trying to create an azure event grid subscription on a function.</p>
  
  <p>This the ARM using for the event grid subscription:</p>
  
  <pre><code>{
      "$schema": "https://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json",
      "contentVersion": "1.0.0.0",
      "parameters": {
          "eventGridTopicName": {
              "type": "string",
              "metadata": {
                  "description": "The name of the Event Grid custom topic."
              }
          },
          "eventGridSubscriptionName": {
              "type": "string",
              "metadata": {
                  "description": "The name of the Event Grid custom topic's subscription."
              }
          },
          "eventGridSubscriptionUrl": {
              "type": "string",
              "metadata": {
                  "description": "The webhook URL to send the subscription events to. This URL must be valid and must be prepared to accept the Event Grid webhook URL challenge request. (RequestBin URLs are exempt from this requirement.)"
              }
          },
          "location": {
              "type": "string",
              "defaultValue": "[resourceGroup().location]",
              "metadata": {
                  "description": "The location in which the Event Grid resources should be deployed."
              }
          }
      },
      "resources": [{
              "name": "[parameters('eventGridTopicName')]",
              "type": "Microsoft.EventGrid/topics",
              "location": "[parameters('location')]",
              "apiVersion": "2018-01-01"
          },
          {
              "name": "[concat(parameters('eventGridTopicName'), '/Microsoft.EventGrid/', parameters('eventGridSubscriptionName'))]",
              "type": "Microsoft.EventGrid/topics/providers/eventSubscriptions",
              "location": "[parameters('location')]",
              "apiVersion": "2018-01-01",
              "properties": {
                  "destination": {
                      "endpointType": "WebHook",
                      "properties": {
                          "endpointUrl": "[parameters('eventGridSubscriptionUrl')]"
                      }
                  },
                  "filter": {
                      "includedEventTypes": [
                          "All"
                      ]
                  }
              },
              "dependsOn": [
                  "[parameters('eventGridTopicName')]"
              ]
          }
      ]
  }
  </code></pre>
  
  <p>Following the documentation <a href="https://docs.microsoft.com/en-us/azure/azure-functions/functions-bindings-event-grid#version-2x-runtime" rel="nofollow noreferrer">here</a> in order to create the subscription, we have to recover a system key in order to create the complete webhook endpoint. So following this post <a href="https://stackoverflow.com/questions/57355443/recover-output-value-of-azure-arm-template-with-terraform-output">here</a>, I have used an ARM template to recover the system key called <code>evengrid_extension</code>.</p>
  
  <p>So everything goes well except during the arm deployment of the eventgrid subscription. I have this error:</p>
  
  <blockquote>
    <p>Error waiting for deployment: Code="DeploymentFailed"
    Message="At least one resource deployment operation failed. Please
    list deployment operations for details. Please see
    <a href="https://aka.ms/arm-debug" rel="nofollow noreferrer">https://aka.ms/arm-debug</a> for usage details." 
    Details=[{"code":"Conflict","message":"{\r\n<br>
        \"status\": \"Failed\",\r\n<br>
        \"error\": {\r\n    \"code\": \"ResourceDeploymentFailure\",\r\n<br>
        \"message\": \"The resource operation completed with terminal provisioning state 'Failed'.\",\r\n<br>
        \"details\": [\r\n      {\r\n<br>
            \"code\": \"Url validation\",\r\n<br>
            \"message\": \"The attempt to validate the provided endpoint <a href="https://myFunctionName.azurewebsites.net/runtime/webhooks/eventgrid" rel="nofollow noreferrer">https://myFunctionName.azurewebsites.net/runtime/webhooks/eventgrid</a>
    failed. 
                         \For more details, visit https:
    //aka.ms/esvalidation.\"\r\n      }\r\n    ]\r\n  }\r\n}"}]</p>
  </blockquote>
  
  <p>I check my code n terraform in order to be sure that I am using the right value for all parameters in this arm template and everything is ok. I have the right topic name, the right endpoint with all value filled in. So I don't understand what I am missing here. I was wondering too if I am using the right system key. I know that there are a system key named <strong>durabletask_extension</strong>, and another one named <strong>eventgrid_extension</strong>. But in fact I have tried with both and the same error occured.</p>
  
  <hr>
  
  <p><strong>Update</strong></p>
  
  <p>Just notice that the keys i-e <strong>durabletask_extension</strong> and <strong>eventgrid_extension</strong> are both system keys. So in my arm template to recover these works well and I recover the right system key by using only <strong>eventgrid_extension</strong>.</p>
  
  <hr>
  
  <p>Here my code for terraform:</p>
  
  <pre><code>resource "azurerm_eventgrid_topic" "eventgrid_topic" {
    name                = "topicName"
    location            = var.main_location
    resource_group_name = azurerm_resource_group.name
  }
  
  resource "azurerm_template_deployment" "eventgrid_subscription" {
    name                = "EventGridSbscription"
    resource_group_name = azurerm_resource_group.environment.name
  
    template_body = file("./arm/event-grid-subscription.json")
  
    parameters = {
      eventGridTopicName = "${azurerm_eventgrid_topic.eventgrid_topic.name}"
      eventGridSubscriptionName = "eventgrid-myFunctionName"
      eventGridSubscriptionUrl = "https://${azurerm_function_app.function.name}.azurewebsites.net/runtime/webhooks/eventgrid?functionName=${azurerm_function_app.function.name}&amp;code=${lookup(azurerm_template_deployment.function_key.outputs, "systemKey")}"
      location = var.main_location
    }
  
    deployment_mode = "Incremental"
  
    depends_on = [
      azurerm_template_deployment.function_key
    ]
  }
  </code></pre>
  
  <p>So I do not understand why my susbription deployment failed, or what I am missing in order to automate this settings with terraform.</p>
  
  <p>Following the doc <a href="https://docs.microsoft.com/en-us/azure/event-grid/security-authentication#checklist" rel="nofollow noreferrer">here</a> I understand too that:</p>
  
  <blockquote>
    <p>If you don't have access to the application code (for example, if
    you're using a third-party service that supports webhooks), you can
    use the manual handshake mechanism. Make sure you're using the
    2018-05-01-preview API version or later (install Event Grid Azure CLI
    extension) to receive the validationUrl in the validation event. To
    complete the manual validation handshake, get the value of the
    validationUrl property and visit that URL in your web browser. If
    validation is successful, you should see a message in your web browser
    that validation is successful. You'll see that event subscription's
    provisioningState is "Succeeded".</p>
  </blockquote>
  
  <p>So, there is a way to make a validation using terraform or another way to automate this validation ?</p>