AZ Deployment Group What-If -- Azure Bicep Output Not Produced For Modules with Dependencies

[AErmie]

Describe the bug

When using az deployment group what-if with Azure Bicep templates that are called via modules, only modules without any dependencies actually produce/show their output (ie. what will be created). All other resources are not listed, giving the incorrect assumption that they will not be created.

Command Name az deployment group what-if --resource-group GHES-aermie --template-file main.bicep

To Reproduce:

Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

Sample Bicep code

module nsgModule './nsg.bicep' = {
  name: 'nsgDeploy'
  params: {
    accountPrefix: accountPrefix
    location: location
    tags: tags
  }
}

module vnetModule './vnet.bicep' = {
  name: 'vnetDeploy'
  params: {
    accountPrefix: accountPrefix
    location: location
    tags: tags
    addressPrefix: addressPrefix
    ghes_subnetPrefix: ghes_subnetPrefix
    runners_subnetPrefix: runners_subnetPrefix
    ghes_nsgID: nsgModule.outputs.networkSecurityGroup_ID_GHES
    runners_nsgID: nsgModule.outputs.networkSecurityGroup_ID_Runners
  }
}

output networkSecurityGroup_ID_GHES string = nsgModule.outputs.networkSecurityGroup_ID_GHES
output networkSecurityGroup_Name_GHES string = nsgModule.outputs.networkSecurityGroup_Name_GHES
output networkSecurityGroup_Location_GHES string = nsgModule.outputs.networkSecurityGroup_Location_GHES
output networkSecurityGroup_SecurityRules_GHES string = nsgModule.outputs.networkSecurityGroup_SecurityRules_GHES
output networkSecurityGroup_ID_Runners string = nsgModule.outputs.networkSecurityGroup_ID_Runners
output networkSecurityGroup_Name_Runners string = nsgModule.outputs.networkSecurityGroup_Name_Runners
output networkSecurityGroup_Location_Runners string = nsgModule.outputs.networkSecurityGroup_Location_Runners
output networkSecurityGroup_SecurityRules_Runners string = nsgModule.outputs.networkSecurityGroup_SecurityRules_Runners

output virtualNetwork_Name string = vnetModule.outputs.virtualNetwork_Name
output virtualNetwork_Location string = vnetModule.outputs.virtualNetwork_Location
output virtualNetwork_AddressPrefix string = vnetModule.outputs.virtualNetwork_AddressPrefix
output virtualNetwork_SubnetAddressPrefix_GHES string = vnetModule.outputs.virtualNetwork_SubnetAddressPrefix_GHES
output virtualNetwork_SubnetAddressPrefix_Runners string = vnetModule.outputs.virtualNetwork_SubnetAddressPrefix_Runners

Expected Behavior

From the above-listed Bicep example, output for both the NSG and VNET is expected, but only output for the NSG is produced.

Environment Summary

Windows-10-10.0.19041-SP0
Python 3.8.9
Installer: MSI

azure-cli 2.27.1

Extensions:
aks-preview 0.5.25
portal 0.1.2

Additional Context

It may be related to Issue #19308

[ghost]

Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @armleads-azure.

Issue Details

---

## Describe the bug When using `az deployment group what-if` with Azure Bicep templates that are called via modules, only modules without any dependencies actually produce/show their output (ie. what will be created). All other resources are not listed, giving the incorrect assumption that they will not be created. **Command Name** `az deployment group what-if --resource-group GHES-aermie --template-file main.bicep` ## To Reproduce: Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information. ### Sample Bicep code ``` bicep module nsgModule './nsg.bicep' = { name: 'nsgDeploy' params: { accountPrefix: accountPrefix location: location tags: tags } } module vnetModule './vnet.bicep' = { name: 'vnetDeploy' params: { accountPrefix: accountPrefix location: location tags: tags addressPrefix: addressPrefix ghes_subnetPrefix: ghes_subnetPrefix runners_subnetPrefix: runners_subnetPrefix ghes_nsgID: nsgModule.outputs.networkSecurityGroup_ID_GHES runners_nsgID: nsgModule.outputs.networkSecurityGroup_ID_Runners } } output networkSecurityGroup_ID_GHES string = nsgModule.outputs.networkSecurityGroup_ID_GHES output networkSecurityGroup_Name_GHES string = nsgModule.outputs.networkSecurityGroup_Name_GHES output networkSecurityGroup_Location_GHES string = nsgModule.outputs.networkSecurityGroup_Location_GHES output networkSecurityGroup_SecurityRules_GHES string = nsgModule.outputs.networkSecurityGroup_SecurityRules_GHES output networkSecurityGroup_ID_Runners string = nsgModule.outputs.networkSecurityGroup_ID_Runners output networkSecurityGroup_Name_Runners string = nsgModule.outputs.networkSecurityGroup_Name_Runners output networkSecurityGroup_Location_Runners string = nsgModule.outputs.networkSecurityGroup_Location_Runners output networkSecurityGroup_SecurityRules_Runners string = nsgModule.outputs.networkSecurityGroup_SecurityRules_Runners output virtualNetwork_Name string = vnetModule.outputs.virtualNetwork_Name output virtualNetwork_Location string = vnetModule.outputs.virtualNetwork_Location output virtualNetwork_AddressPrefix string = vnetModule.outputs.virtualNetwork_AddressPrefix output virtualNetwork_SubnetAddressPrefix_GHES string = vnetModule.outputs.virtualNetwork_SubnetAddressPrefix_GHES output virtualNetwork_SubnetAddressPrefix_Runners string = vnetModule.outputs.virtualNetwork_SubnetAddressPrefix_Runners ``` ## Expected Behavior From the above-listed Bicep example, output for both the NSG and VNET is expected, but only output for the NSG is produced. ## Environment Summary ``` Windows-10-10.0.19041-SP0 Python 3.8.9 Installer: MSI azure-cli 2.27.1 Extensions: aks-preview 0.5.25 portal 0.1.2 ``` ## Additional Context It may be related to Issue #19308

Author:	AErmie
Assignees:	-
Labels:	`Service Attention`, `ARM`, `needs-triage`
Milestone:	-

[yonzhan]

route to service team

[ishepherd]

I suspect this is a known issue with what-if in ARM.

It might get a response from experts if you raise at https://github.com/Azure/bicep/issues. Please tag me if you do as I would love to see improvements in this area.