search

Azure / bicep

Bicep is a declarative language for describing and deploying Azure resources
MIT License
3.21k stars 745 forks source link

Successful Deployment fails validation on resourcegroupID in compiled JSON #3142

Closed kevball2 closed 3 years ago

kevball2 commented 3 years ago

Bicep version 0.4.63

Describe the bug A validation error occurs in Azure Devops using the ARMTemplateDeployment action

To Reproduce Steps to reproduce the behavior:

Run pipeline and validation will fail with the following error - ##[error]Deployment template validation failed: 'The template variable 'resourceGroupId' is not valid: The template function 'RESOURCEGROUP' is not expected at this location.

Additional context When deploying the Bicep file is does succeed to deploy all resources successfully. Just want to clean up the validation portion if possible.

Related Bicep code - 

resource roleassignment 'Microsoft.Authorization/roleAssignments@2020-04-01-preview' = [for user in userAssignment: {
    name: guid(user.roleDefinitionId, resourceGroupId)
    properties: {
      principalType: 'Group'
      roleDefinitionId: subscriptionResourceId('Microsoft.Authorization/roleDefinitions', user.roleDefinitionId)
      principalId: user.groupObjId
    }
}]

Related JSON output

{
      "copy": {
        "name": "roleassignment",
        "count": "[length(parameters('userAssignment'))]"
      },
      "type": "Microsoft.Authorization/roleAssignments",
      "apiVersion": "2020-04-01-preview",
      "name": "[guid(parameters('userAssignment')[copyIndex()].roleDefinitionId, variables('resourceGroupId'))]",
      "properties": {
        "principalType": "Group",
        "roleDefinitionId": "[subscriptionResourceId('Microsoft.Authorization/roleDefinitions', parameters('userAssignment')[copyIndex()].roleDefinitionId)]",
        "principalId": "[parameters('userAssignment')[copyIndex()].groupObjId]"
      }
    }
alex-frankel commented 3 years ago

Can you provide a complete reproducible code sample? We need a bit more detail from the emitted JSON to figure out what might be happening.

kevball2 commented 3 years ago

@alex-frankel Here is the bicep parameter file I used

bicepfiles.zip

alex-frankel commented 3 years ago

Sorry for not getting back to you sooner! I was not able to repro with what you provided. What client/command are you using to deploy?

When I deploy this file with the following command I get an error, but different than the one you got.

az deployment group create -f .\keyvault.bicep -g brittle-hollow -p .\parameters-dev.json

Your error shows that you did not pass the initial validation, but I was able to progress pass that stage and hit a (very unhelpful) runtime error message:

Deployment failed. Correlation ID: 750c4820-713a-4e36-a214-08f656366327. {
  "error": {
    "code": "BadRequest",
    "message": "Bad JSON content found in the request."
  }
}

My next step would be to reach out to the relevant resource provider team (key vault in this case) with the correlation ID to debug further. Any chance you have already opened a support case for this one and/or already resolved it?

kevball2 commented 3 years ago

The error I received was during a validation step during an Azure DevOps Pipeline. Running the files from the CLI I was able to deploy successfully. It is possible I gave you older files (Sorry if so). I did find a solution to my issue though. Previously the validation step was targeting the Subscription instead of the Resource group. After updating to target the proper RG the bicep file passed validation 

- task: AzureResourceManagerTemplateDeployment@3
        displayName: 'Validate Template with dev parameters'
        inputs:
          deploymentScope: 'Resource Group'
          azureResourceManagerConnection: 'Dev / Test'
          subscriptionId: 'DevTest_SubId'
          action: 'Create Or Update Resource Group'
          resourceGroupName: 'rg-shared-dev'
          location: 'North Central US'
          templateLocation: 'Linked artifact'
          csmFile: 'template.json'
          csmParametersFile: 'parameters-dev.json'
          deploymentMode: 'Validation'

Thanks for following up on this, I had used this to solve another deployment issue but had forgot about this one.

Old pipeline step log for reference, 

2021-06-08T18:40:09.0847977Z ##[section]Starting: Validate APIM Templates
2021-06-08T18:40:09.0860076Z ==============================================================================
2021-06-08T18:40:09.0860469Z Task         : ARM template deployment
2021-06-08T18:40:09.0860847Z Description  : Deploy an Azure Resource Manager (ARM) template to all the deployment scopes
2021-06-08T18:40:09.0861166Z Version      : 3.184.1
2021-06-08T18:40:09.0861622Z Author       : Microsoft Corporation
2021-06-08T18:40:09.0862015Z Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/deploy/azure-resource-group-deployment
2021-06-08T18:40:09.0862466Z ==============================================================================
2021-06-08T18:40:09.3862164Z (node:1661) [DEP0005] DeprecationWarning: Buffer() is deprecated due to security and usability issues. Please use the Buffer.alloc(), Buffer.allocUnsafe(), or Buffer.from() methods instead.
2021-06-08T18:40:09.3865365Z ARM Service Connection deployment scope - Subscription
2021-06-08T18:40:09.4298159Z Creating deployment parameters.
2021-06-08T18:40:09.4311976Z The detected encoding for file '/home/vsts/work/1/s/template.json' is 'utf-8'
2021-06-08T18:40:09.4323850Z The detected encoding for file '/home/vsts/work/1/s/parameters-dev.json' is 'utf-8'
2021-06-08T18:40:09.5617014Z Starting template validation.
2021-06-08T18:40:09.5648761Z Deployment name is template-20210608-184009-cf60
2021-06-08T18:40:09.7448824Z There were errors in your deployment. Error code: InvalidTemplate.
2021-06-08T18:40:09.7512665Z ##[error]Deployment template validation failed: 'The template variable 'resourceGroupId' is not valid: The template function 'RESOURCEGROUP' is not expected at this location. Please see https://aka.ms/arm-template-expressions for usage details.. Please see https://aka.ms/arm-template-expressions for usage details.'.
2021-06-08T18:40:09.7528150Z ##[error]Check out the troubleshooting guide to see if your issue is addressed: https://docs.microsoft.com/en-us/azure/devops/pipelines/tasks/deploy/azure-resource-group-deployment?view=azure-devops#troubleshooting
2021-06-08T18:40:09.7529994Z ##[error]Task failed while creating or updating the template deployment.
2021-06-08T18:40:09.7559726Z ##[section]Finishing: Validate APIM Templates