Open johnpetersjr opened 6 months ago
It looks like your workaround of changing the batch size to 1 should have solved the issue, but since it didn't, it is most likely a Microsoft.ManagedIdentity RP issue. Please open a support ticket if you would like this to be streamlined, otherwise we will try to route it to the right team.
It looks like your workaround of changing the batch size to 1 should have solved the issue, but since it didn't, it is most likely a Microsoft.ManagedIdentity RP issue. Please open a support ticket if you would like this to be streamlined, otherwise we will try to route it to the right team.
Done and done, thanks!
Thanks for the feedback! We are routing this to the appropriate team for follow-up. cc @varunkch. Please see https://aka.ms/biceptypesinfo for troubleshooting help.
FYI I received feedback from Microsoft Support that this is not currently supported, and is in the works on their roadmap.
I encountered this Issuer and subject combination already exists for this Managed Identity
error when trying to create/update one single Federated Credential on one Managed Identity (ie not a concurrency problem), when they're in a resource group other than the one that the main bicep deployment is running as. I was attempting to define them in a module and then run the module with a scope: resourceGroup(otherResourceGroupName)
attribute, and it would throw the error if the FedCred already existed, destroying the idempotency of the bicep deployment.
However it seems to work fine if I simply separate things out into two different deployments based on resource group, which is an acceptable work-around for me.
FYI I received feedback from Microsoft Support that this is not currently supported, and is in the works on their roadmap.
Also keen to see this implemented. Have a few use cases that would benefit from this being supported. Currently I can work around this by retriggering the deployment but really not the best as the deployment will always fail.
I filed a property/type issue here, but I'm wondering if this is really a feature request? (Or I am just doing this all wrong)
I am running into some difficulties deploying multiple federatedIdentityCredentials to a managed identity using Bicep. Seems that I cannot deploy an array of federatedCredentials at the same time, as you will get this error:
So I changed my logic to use a batchSize of 1, to loop through the array, but now I've lost idempotency... each iteration through the batch doesn't know about pre-existing federatedCredentials, and the bicep deployment fails with this error:
Which destroys my whole purpose of building FederatedCredentials in Managed Identities via an IaC bicep pipeline.
Is there another way to use Bicep to create Managed Identities, and assign a list of Federated Credentials to them, and keep them in sync? I really wanted to use the '--mode Complete' and have Bicep create / update / delete any managed identities, and their federated identity credentials, in one fell swoop / from one Bicep MI repo.
Bicep Repro
main.bicep
managed_identity_federated_credentials.bicep
BicepParam File
Last comment on this, I think I might just need to figure out how to do a dependsOn in Bicep for an array of federated credentials, but not quite sure how to go about that. Looks like I've run into a known limitation, that terraform has a solution for, but not clear how to solve for this in Bicep:
https://learn.microsoft.com/en-us/entra/workload-id/workload-identity-federation-considerations#concurrent-updates-arent-supported-user-assigned-managed-identities
Seems like someone else had a similar issue, and this was solved with a dependsOn statement like this:
https://github.com/Azure/bicep/issues/10928
But since I'm looping through an unknown number of array elements, I am too new to this to know how to refer to the previous array element to 'depend' on? Is this possible?
Thanks in advance for any help!