In bicep, how to property and securly set `hidden-link` in tags?

Question

When using bicep to link the Azure Function to an Application Insights, I add this entry in config/appsettings of the Function:

APPINSIGHTS_INSTRUMENTATIONKEY: reference(appInsightsId, '2015-05-01').InstrumentationKey

However, when I run az deployment group what-if command, I notice that there are three tags of hidden-link in the Azure Function:

hidden-link: /app-insights-resource-id
hidden-link: /app-insights-instrumentation-key
hidden-link: /app-insights-conn-string

According to this answer, these tags seems mandatory to deployment. But I am confused why does action of "set application insights" need to set these hidden properties.

Q: Do I need to include these three hidden-links in my bicep template? What are they used for?

Accepted Answer

@Shunlei Tang

Yes, setting up the APPINSIGHTS_INSTRUMENTATIONKEY within the appSettings of a Function App, is sufficient to create this association/links, without the need to manually including the hidden-link tags. Azure handles the linking of resources, which simplifies the template and avoids potential misconfigurations.

In my settingup I didn't have hidden-links tags explicitly added to my appinsight block.

resource applicationInsights 'Microsoft.Insights/components@2020-02-02' = {
  name: applicationInsights.name
  tags: tags   // tags here is the normal resource tags, not hidden-links
  xxxxx
}

And I have a separate resource block appsettings for my function app slot

resource functionAppName_Slot_appsettings 'Microsoft.Web/sites/slots/config@2022-09-01' = {
  parent: functionAppSlot
  name: function.appsettingsName
  properties: {
    APPLICATIONINSIGHTS_CONNECTION_STRING: applicationInsights.properties.ConnectionString
  xxx
  } 
}

When I check the function apps JSON on portal, hidden-links tags are automatically added by Azure, confirming the automatic integration.

    "tags": {
        "tag1": "xxxxxx",
        "tag2": "xxxx",
        "tag3": "xxxx",
        "tagx": "BVT",
        "hidden-link: /app-insights-resource-id": "/subscriptions/xxxx/resourceGroups/name-of-rG/providers/microsoft.insights/components/appinsightsName",
        "hidden-link: /app-insights-instrumentation-key": "kayValue",
        "hidden-link: /app-insights-conn-string": "InstrumentationKey=keyValue;IngestionEndpoint=https://uksouth-1.in.applicationinsights.azure.com/;LiveEndpoint=https://uksouth.livediagnostics.monitor.azure.com/;ApplicationId=appIdvalue"
    },

Answer

@Shunlei Tang

NO, You don't need to include these 3 hidden-links in your bicep template, as they are automatically set by Azure with reference(appInsightsId, '2015-05-01').InstrumentationKey in place, as seen in your what-if output which previews your deployment.

The hidden-link tag is used to link Application Insights to the function app resource, so that's totally expected, without this the expected string for APPINSIGHTS_INSTRUMENTATIONKEY will not be passed.

You can review the documentation on Hidden Tags.

Answer

Hi, Welcome to MS Q&A
Yes, you need to include hidden-link tags for Application Insights in your Bicep template. These tags are used to create a hidden link between the Application Insights resource and the function app resource. This is necessary for the function app to access the Application Insights resource.

User's image

References:

Automate resource deployment for your function app in Azure Functions (consumption-plan)

Please accept answer , if it helps

Kindly check and let us know

Thanks
Deepanshu

Share via

In bicep, how to property and securly set `hidden-link` in tags?

2 additional answers

Your answer