search

Azure / deployment-stacks

Contains Deployment Stacks CLI scripts and releases
MIT License
89 stars 7 forks source link

Documentation is incorrect on how to pass "-DenySettingsExcludedAction" in Powershell #167

Open GABRIELNGBTUC opened 3 months ago

GABRIELNGBTUC commented 3 months ago

Describe the bug In the following example from the documentation, the DenySettingsExcludedAction is passed as a string with spaces as an action separator

New-AzResourceGroupDeploymentStack -Name "<deployment-stack-name>" -ResourceGroupName "<resource-group-name>" -TemplateFile "<bicep-file-name>" -ActionOnUnmanage "detachAll" -DenySettingsMode "denyDelete" -DenySettingsExcludedAction "Microsoft.Compute/virtualMachines/write Microsoft.StorageAccounts/delete" -DenySettingsExcludedPrincipal "<object-id>,<object-id>"

However, when re-running the command by replacing New-AzResourceGroupDeploymentStack with Set-AzResourceGroupDeploymentStack, the deployment will fail with Error: Code=DeploymentStackDenyAssignmentFailure; Message=The deny assignment of one or more resources could not be added or removed.

When re-running the command by passing something like:

Set-AzResourceGroupDeploymentStack -Name "<deployment-stack-name>" -ResourceGroupName "<resource-group-name>" -TemplateFile "<bicep-file-name>" -ActionOnUnmanage "detachAll" -DenySettingsMode "denyDelete" -DenySettingsExcludedAction "Microsoft.Compute/virtualMachines/write Microsoft.StorageAccounts/delete".Split(" ") -DenySettingsExcludedPrincipal "<object-id>,<object-id>"

The command will succeed, showing that DenySettingsExcludedAction actually expects a String[] and not a string separated by spaces

To Reproduce Steps to reproduce the behavior:

  1. Run the command from the documentation to create a stack with DenySettingsExcludedAction set for 2 different actions
  2. Wait until the stack state is "success"
  3. Rerun the same command with Set-AzResourceGroupDeploymentStack instead
  4. Stack state fails with error: 'action1 action2' does not match any of the actions supported by the providers. on each resource in the stack

Expected behavior The New-AzResourceGroupDeploymentStack and Set-AzResourceGroupDeploymentStack return an error during parameter validation if -DenySettingsExcludedAction is not a string array

Repro Environment Host OS: Linux Powershell Version: 7.4.2

Server Debugging Information Correlation ID: 8a765b50-5790-4f84-a481-3d00190fb109 Tenant ID: f661a5c5-d1f9-4034-950d-39a1392e8c24 Timestamp of issue (please include time zone): 2024-06-14T07:53:24.8940941Z UTC Data Center (eg, West Central US, West Europe): West Europe