search

Azure / bicep-types-az

Bicep type definitions for ARM resources
MIT License
83 stars 26 forks source link

Front Door CDN: "sku" property will only work on initial deployment when using Premium SKU. Subsequent deployments will fail due to sku being read only #2105

Open ameltzer-MSFT opened 5 months ago

ameltzer-MSFT commented 5 months ago

Resource Type

Microsoft.Cdn/profiles

Api Version

2023-05-01

Issue Type

Resource fails to deploy

Other Notes

This does not repro when using standard SKU, only premium SKU.

When deploying a premium SKU CDN Profile, the initial deployment works fine. Subsequent deployments will fail in ARM with an error like this:

Property 'profile.sku' is read-only and cannot be changed

The 'sku' property cannot be removed from the bicep template as this emits a warning:

The specified "resource" declaration is missing the following required properties: "sku". If this is an inaccuracy in the documentation, please report it to the Bicep Team.bicephttps://aka.ms/bicep-type-issues

Suppressing this warning will cause the deployment to fail in validation.

This breaks deployments with this resource because only the initial deployment will work and subsequent deployments will fail.

As mentioned before, this does not reproduce when using "Standard" SKU, only "Premium" SKU (probably because you can go from Standard to Premium, but once you're Premium you can't go back).

Bicep Repro

// Profile
resource frontDoorProfile 'Microsoft.Cdn/profiles@2023-05-01' = {
  name: frontDoorProfileName
  location: 'global'
  tags: union(resourceGroup().tags, { ComponentName: 'FrontDoorCDN-Profile' })
  sku: {
    name: 'Premium_AzureFrontDoor'
  }
}

Confirm

ameltzer-MSFT commented 5 months ago

I was able to work around this problem by doing something like this:

// Required properties
param frontDoorSkuName string
param frontDoorProfileName string

// Work around deployment breaking for premium SKU if it already exists
resource frontDoorProfileExisting 'Microsoft.Cdn/profiles@2023-05-01' existing = if (frontDoorSkuName == 'Premium_AzureFrontDoor') {
    name: frontDoorProfileName
}

// Profile
resource frontDoorProfile 'Microsoft.Cdn/profiles@2023-05-01' = if (frontDoorProfileExisting.id == null) {
  name: frontDoorProfileName
  location: 'global'
  tags: union(resourceGroup().tags, { ComponentName: 'FrontDoorCDN-Profile' })
  sku: {
    name: frontDoorSkuName
  }
}

However, it seems like this should have been handled gracefully by Bicep/ARM internally without needing to resort to this kind of workaround :).