Azure / deployment-stacks

Contains Deployment Stacks CLI scripts and releases
MIT License
87 stars 7 forks source link

New-AzSubscriptionDeploymentStack on par with New-AzDeployment #46

Closed slavizh closed 1 year ago

slavizh commented 2 years ago

Is your feature request related to a problem? Please describe. New-AzSubscriptionDeploymentStack should have the same features that New-AzDeployment has + the additional Deployment stacks feature. For example the things that are currently missing:

Deployment stacks error

{
  "Code": "DeploymentStackUpdateFailed",
  "Message": "One or more stages of deploymentStack update failed.",
  "Target": null,
  "Details": [
    {
      "Code": "DeploymentStackDeploymentFailed",
      "Message": "One or more resources could not be deployed.",
      "Target": null,
      "Details": [
        {
          "Code": "DeploymentFailed",
          "Message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
          "Target": null,
          "Details": [
            {
              "Code": "DeploymentFailed",
              "Message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
              "Target": null,
              "Details": null,
              "AdditionalInfo": null
            }
          ],
          "AdditionalInfo": null
        }
      ],
      "AdditionalInfo": null
    }
  ],
  "AdditionalInfo": null
}

Deployments error:

New-AzDeployment: 16:04:57 - The deployment 'lz-policy-management2' failed with error(s). Showing 2 out of 2 error(s).
Status Message: At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details. (Code: DeploymentFailed)
 - {
  "error": {
    "code": "PolicyParameterValueNotAllowed",
    "message": "The value 'audit2' is not allowed for policy parameter 'effect' in policy definition 'data-lake-storage-enc'. The allowed values are 'audit, deny'."
  }
} (Code:BadRequest)
Status Message: At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details. (Code: DeploymentFailed)
 - {
  "status": "Failed",
  "error": {
    "code": "ResourceDeploymentFailure",
    "message": "The resource operation completed with terminal provisioning state 'Failed'.",
    "details": [
      {
        "code": "DeploymentFailed",
        "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
        "details": [
          {
            "code": "BadRequest",
            "message": "{\r\n  \"error\": {\r\n    \"code\": \"PolicyParameterValueNotAllowed\",\r\n    \"message\": \"The value 'audit2' is not allowed for policy parameter 'effect' in policy definition 'data-lake-storage-enc'. The allowed values are 'audit, deny'.\"\r\n  }\r\n}"
          }
        ]
      }
    ]
  }
} (Code:Conflict)
CorrelationId: 6239bd4b-32ea-4cec-9e32-803e9352bd24

Describe the solution you'd like Mock up of what would the end result should be. Note that in the mock up I have shown both error and successful (as there is output) deployed stack.

New-AzDeploymentStack: 16:04:57 - The deployment 'lz-policy-management2' failed with error(s). Showing 2 out of 2 error(s).
Status Message: At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details. (Code: DeploymentFailed)
 - {
  "error": {
    "code": "PolicyParameterValueNotAllowed",
    "message": "The value 'audit2' is not allowed for policy parameter 'effect' in policy definition 'data-lake-storage-enc'. The allowed values are 'audit, deny'."
  }
} (Code:BadRequest)
Status Message: At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details. (Code: DeploymentFailed)
 - {
  "status": "Failed",
  "error": {
    "code": "ResourceDeploymentFailure",
    "message": "The resource operation completed with terminal provisioning state 'Failed'.",
    "details": [
      {
        "code": "DeploymentFailed",
        "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
        "details": [
          {
            "code": "BadRequest",
            "message": "{\r\n  \"error\": {\r\n    \"code\": \"PolicyParameterValueNotAllowed\",\r\n    \"message\": \"The value 'audit2' is not allowed for policy parameter 'effect' in policy definition 'data-lake-storage-enc'. The allowed values are 'audit, deny'.\"\r\n  }\r\n}"
          }
        ]
      }
    ]
  }
} (Code:Conflict)
CorrelationId: 6239bd4b-32ea-4cec-9e32-803e9352bd24

Id                : /subscriptions/<>/providers/Microsoft.Resources/deploymentStacks/lz-policy-management
Name              : lz-policy-management
ProvisioningState : failed
UpdateBehavior    : purgeResources
Location          : westeurope
CreationTime(UTC) : 30.11.2021 г. 13:39:03
ManagedResources  : /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/add-replace-tag-res-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/add-replace-tag-rgs-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/add-tag-to-res-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/add-tag-to-rgs-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/add-vms-to-backup-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/add-vms-to-backup-2
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/append-tagpair-frm-rg-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/append-tag-pair-rg-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/application-gateway-skus
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/apply-tag-default-val-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/approved-nsgs-on-nics
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/approved-nsgs-on-subnets
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/approved-subnets
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/approved-vm-skus
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/approved-vnets
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/audit-diagnostic-setting
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/audit-net-wat-exist
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/audit-vm-extension-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/audit-vm-extension-2
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/custom-vm-images-by-id
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/custom-vm-images-from-rg
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/data-lake-storage-enc
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/er-bandwidths
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/er-peering-locations
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/er-skus
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/hybrid-use-benefit-com
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/inherit-tag-rg-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/inherit-tag-rg-miss-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/inherit-tag-sub-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/inherit-tag-sub-miss-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/match-pattern-tag-val-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/match-pattern-tag-val-2
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/non-managed-vm-disks
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/peering-to-er-vnet
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/require-tag-res-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/require-tag-rgs-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/require-tag-sub-1
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/sql-azure-ad-admin-set
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/sql-db-level-auditing
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/sql-db-level-threat-de
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/sql-db-ltb-retention
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/sql-db-skus
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/sql-db-stb-retention
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/sql-server-version-12
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/sql-srv-level-audit-set
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/sql-srv-threat-det
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/sql-trp-data-encrypt
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/str-blob-encryption
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/str-cool-access-tiering
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/str-file-encryption
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/str-https-traffic
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/str-skus
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/tag-value-pair-res
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/tag-value-pair-rgs
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/udr-tables-vnets
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/vm-extensions
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyAssignments/vm-platform-images
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/add-vms-to-backup
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/application-gateway-skus
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/approved-nsgs-on-nics
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/approved-nsgs-on-subnets
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/approved-subnets
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/approved-vm-skus
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/approved-vnets
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/audit-net-wat-exist
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/audit-vm-extension-lnx
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/audit-vm-extension-win
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/custom-vm-images-by-id
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/custom-vm-images-from-rg
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/data-lake-storage-enc
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/er-bandwidths
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/er-peering-locations
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/er-skus
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/hybrid-use-benefit-com
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/match-pattern-tag-val
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/non-managed-vm-disks
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/peering-to-er-vnet
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/require-tag-on-sub
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/sql-db-level-auditing
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/sql-db-level-threat-det
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/sql-db-ltb-retention
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/sql-db-skus
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/sql-db-stb-retention
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/sql-server-version-12
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/sql-srv-threat-det
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/str-blob-encryption
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/str-cool-access-tiering
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/str-file-encryption
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/str-https-traffic
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/str-skus
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/tag-value-pair-res
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/tag-value-pair-rgs
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/udr-tables-vnets
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/vm-extensions
                    /subscriptions/ <>/providers/Microsoft.Authorization/policyDefinitions/vm-platform-images
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/1113df4b-d981-5cf8-a0c5-5fcbad9d2158
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/249e5b3a-8a4e-59c4-97a2-eac0f37c899f
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/2a1a7799-8bf8-51a1-8a16-9a488506e821
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/355d6a9f-ebca-5c0b-be6b-aca0ddf8e603
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/3a98d47e-a0db-56dc-9775-1be7fde16ddc
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/3b7c27e7-6967-5b3b-9bb5-3aaf19eb9923
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/477b3b73-72d0-5542-bd01-56bf10412131
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/4b2467e9-46b8-593c-8af5-9acf6b5e0a95
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/6c4c6920-e059-5200-9a3f-5543ce5487ad
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/78ddf0bb-fbea-575d-b745-cee3067cce94
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/9420bdd5-a7cb-5b4c-b774-7570e2e1fae2
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/a1cc539a-9d77-5920-8d79-110e75f91b57
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/b7999000-91df-53ad-80fb-9e93f4f7a695
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/bc0d9b8c-ffde-5b4e-92fe-19ecacec5da1
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/dc9b944e-cc24-5da7-a7d9-4a9cb19e0989
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/e8d31600-570d-5fb3-9395-f887ef78db12
                    /subscriptions/ <>/providers/Microsoft.Authorization/roleAssignments/f885477b-36e2-5b12-8415-11c86360d06a
DeploymentId      : /subscriptions/ <>/providers/Microsoft.Resources/deployments/lz-policy-management-2021-12-06-16-16-34-61cc3
SnapshotId        : /subscriptions/ <>/providers/Microsoft.Resources/deploymentStacks/lz-policy-management/snapshots/2021-12-06-16-16-34-61cc3
Parameters              :
                          Name                   Type                       Value
                          =====================  =========================  ==========
                          managementGroupName    String
                          policies               Object                     {
                            "backup": {
                              "addVmsToBackup": [
                                {
                                  "imagePublishers": [
                                    "MicrosoftWindowsServer",
                                    "OpenLogic"
                                  ],
                                  "imageOffers": [
                                    "WindowsServer",
                                    "CentOS"
                                  ],
                                  "imageSkus": [
                                    "2008-R2-SP1",
                                    "2008-R2-SP1-smalldisk",
                                    "2012-Datacenter",
                                    "2012-Datacenter-smalldisk",
                                    "2012-R2-Datacenter",
                                    "2012-R2-Datacenter-smalldisk",
                                    "2016-Datacenter",
                                    "2016-Datacenter-Server-Core",
                                    "2016-Datacenter-Server-Core-smalldisk",
                                    "2016-Datacenter-smalldisk",
                                    "2016-Datacenter-with-Containers",
                                    "2016-Datacenter-with-RDSH",
                                    "7.5"
                                  ],
                                  "vaultName": "Vault1",
                                  "vaultResourceGroup": "BackupVault1",
                                  "vaultLocation": "North Europe",
                                  "policyName": "Default",
                                  "nonComplianceMessage": "Deal with it"
                                },
                                {
                                  "imagePublishers": [
                                    "MicrosoftWindowsServer"
                                  ],
                                  "imageOffers": [
                                    "WindowsServer"
                                  ],
                                  "imageSkus": [
                                    "2012-R2-Datacenter",
                                    "2012-R2-Datacenter-smalldisk",
                                    "2016-Datacenter",
                                    "2016-Datacenter-Server-Core",
                                    "2016-Datacenter-Server-Core-smalldisk",
                                    "2016-Datacenter-smalldisk",
                                    "2016-Datacenter-with-Containers",
                                    "2016-Datacenter-with-RDSH"
                                  ],
                                  "vaultName": "Vault2",
                                  "vaultResourceGroup": "BackupVault2",
                                  "vaultLocation": "West Europe",
                                  "policyName": "Policy1"
                                }
                              ]
                            },
                            "dataLake": {
                              "dataLakeStorageEncryption": {
                                "effect": "audit"
                              }
                            },
                            "guestConfiguration": {
                              "auditWindowsVmsNotSpecifiedApplications": {
                                "applications": "Microsoft SQL Server 2014 (64-bit); Microsoft Visual Studio Code"
                              },
                              "auditWindowsVmsNotSpecifiedTimeZone": {
                                "timeZone": "(UTC+02:00) Helsinki, Kyiv, Riga, Sofia, Tallinn, Vilnius"
                              },
                              "auditWindowsVmsNotJoinedSpecifiedDomain": {
                                "fqdn": "test.local"
                              },
                              "auditWindowsWebServersSecureCommunication": {
                                "enable": true
                              },
                              "auditWindowsVmsSerialConsoleNotEnabled": {
                                "emsPortNumber": 1,
                                "emsBaudRate": 115200
                              },
                              "auditWindowsVmsAdministratorsGroupAnySpecifiedMembers": {
                                "members": "Admin1; Admin2"
                              },
                              "auditLinuxVmsNotSpecifiedApplications": {
                                "applications": "python; powershell"
                              },
                              "auditWindowsVmsPendingReboot": {
                                "enable": true
                              },
                              "auditWindowsVmsPowerShellModules": {
                                "modules": "PSDscResources; SqlServerDsc, 12.0.0.0; ComputerManagementDsc, 6.1.0.0"
                              },
                              "auditWindowsVmsSpecifiedApplications": {
                                "applications": "Microsoft SQL Server 2014 (64-bit); Microsoft Visual Studio Code"
                              },
                              "auditLinuxVmsSpecifiedApplications": {
                                "applications": "python; powershell"
                              },
                              "auditVmsInsecurePasswordSecuritySettings": {
                                "apply": "Enabled"
                              },
                              "auditWindowsVmsNonCompliantDscConfiguration": {
                                "enable": true
                              },
                              "auditWindowsVmsNotRestartedSpecifiedDays": {
                                "numberOfDays": 12
                              },
                              "auditWindowsVmsDefenderExploitGuardNotEnabled": {
                                "machineState": "Non-Compliant"
                              },
                              "auditWindowsVmsExpiringCertificates": {
                                "certificateStorePath": "Cert:",
                                "expirationLimitInDays": 30,
                                "certificateThumbprintsToInclude": "",
                                "certificateThumbprintsToExclude": "",
                                "includeExpiredCertificates": false
                              }
                            },
                            "compute": {
                              "nonManagedVmDisks": {
                                "effect": "audit"
                              },
                              "vmPlatformImages": {
                                "effect": "audit",
                                "imagePublishers": [
                                  "MicrosoftWindowsServer",
                                  "Canonical"
                                ],
                                "imageOffers": [
                                  "WindowsServer",
                                  "UbuntuServer"
                                ],
                                "imageSkus": [
                                  "2016-Datacenter",
                                  "2016-Datacenter-Server-Core",
                                  "2016-Nano-Server",
                                  "16.04.0-LTS",
                                  "16.04-LTS"
                                ]
                              },
                              "hybridUseBenefitOnCompute": {
                                "effect": "audit"
                              },
                              "customVmImagesFromResourceGroup": {
                                "effect": "audit",
                                "resourceGroupName": "test"
                              },
                              "approvedVmSkus": {
                                "effect": "deny",
                                "listOfVmSkus": [
                                  "Standard_B1ms",
                                  "Standard_B2s",
                                  "Standard_B2ms",
                                  "Standard_B4ms",
                                  "Standard_D2s_v3",
                                  "Standard_D4s_v3",
                                  "Standard_D8s_v3",
                                  "Standard_D16s_v3",
                                  "Standard_D2s_v4",
                                  "Standard_D4s_v4",
                                  "Standard_D8s_v4",
                                  "Standard_D16s_v4"
                                ]
                              },
                              "auditVmExtensions": [
                                {
                                  "publisher": "Microsoft.Azure.Diagnostics",
                                  "type": "LinuxDiagnostic",
                                  "os": "Linux"
                                },
                                {
                                  "publisher": "Microsoft.Azure.Diagnostics",
                                  "type": "IaaSDiagnostics",
                                  "os": "Windows"
                                }
                              ],
                              "vmExtensions": {
                                "effect": "audit",
                                "listOfVmExtensionTypes": [
                                  "VMAccessAgent"
                                ]
                              }
                            },
                            "general": {
                              "resourcesNamePatterns": [
                                {
                                  "effect": "audit",
                                  "namePatterns": [
                                    "*"
                                  ],
                                  "condition": "match",
                                  "resourceTypes": [
                                    "Microsoft.Archive/collections",
                                    "Microsoft.Batch/batchAccounts"
                                  ]
                                },
                                {
                                  "effect": "audit",
                                  "namePatterns": [
                                    "*"
                                  ],
                                  "condition": "like",
                                  "resourceTypes": [
                                    "AppDynamics.APM/services",
                                    "Citrix.Cloud/accounts"
                                  ]
                                },
                                {
                                  "effect": "audit",
                                  "namePatterns": [
                                    "*",
                                    "?"
                                  ],
                                  "condition": "match",
                                  "resourceTypes": [
                                    "Microsoft.BotService/botServices",
                                    "Microsoft.Cache/Redis"
                                  ]
                                },
                                {
                                  "effect": "audit",
                                  "namePatterns": [
                                    "*",
                                    "?"
                                  ],
                                  "condition": "like",
                                  "resourceTypes": [
                                    "Microsoft.Cdn/profiles",
                                    "Microsoft.DBforMariaDB/servers"
                                  ]
                                },
                                {
                                  "effect": "audit",
                                  "namePatterns": [
                                    "*",
                                    "?",
                                    "?-?"
                                  ],
                                  "condition": "match",
                                  "resourceTypes": [
                                    "Microsoft.DataFactory/factories",
                                    "Microsoft.DataLateStore/accounts"
                                  ]
                                },
                                {
                                  "effect": "audit",
                                  "namePatterns": [
                                    "*",
                                    "?",
                                    "test?"
                                  ],
                                  "condition": "like",
                                  "resourceTypes": [
                                    "Microsoft.DevTestLab/labs",
                                    "Microsoft.DocumentDB/databaseAccounts"
                                  ]
                                }
                              ],
                              "disapprovedResourceTypes": {
                                "effect": "audit",
                                "listOfDisapprovedResourceTypes": [
                                  "AppDynamics.APM/services",
                                  "Citrix.Cloud/accounts"
                                ]
                              },
                              "approvedResourceTypes": {
                                "effect": "audit",
                                "listOfApprovedResourceTypes": [
                                  "Microsoft.Archive/collections",
                                  "Microsoft.Batch/batchAccounts"
                                ]
                              },
                              "approvedLocations": {
                                "effect": "deny",
                                "listOfApprovedLocations": [
                                  "West Europe",
                                  "North Europe"
                                ]
                              },
                              "approvedLocationsResourceGroups": {
                                "effect": "deny",
                                "listOfApprovedLocations": [
                                  "West Europe",
                                  "North Europe"
                                ]
                              }
                            },
                            "sql": {
                              "configureSqlDatabaseBackupShortTermRetention": {
                                "retentionDays": 14
                              },
                              "configureSqlDatabaseBackupLongTermRetention": {
                                "effect": "DeployIfNotExists",
                                "weeklyRetention": "PT4W"
                              },
                              "auditAzureSQLAzureADAdministratorSetting": {
                                "enable": true
                              },
                              "auditSQLAuditingSettingOnServerLevel": {
                                "state": "enabled"
                              },
                              "sqlServerVersion12": {
                                "effect": "audit"
                              },
                              "auditSqlDatabaseTransparentDataEncryption": {
                                "enable": true
                              },
                              "auditSQLThreatDetectionSettingOnServerLevel": {
                                "state": "enabled"
                              },
                              "auditSQLThreatDetectionSettingOnDatabaseLevel": {
                                "state": "enabled"
                              },
                              "auditSQLAuditingSettingOnDatabaseLevel": {
                                "state": "enabled"
                              },
                              "sqlDatabaseSkus": {
                                "effect": "audit",
                                "sqlDatabaseSkus": [
                                  "S1"
                                ]
                              }
                            },
                            "network": {
                              "expressRouteSkus": {
                                "effect": "audit",
                                "expressRouteSkus": [
                                  "Standard_MeteredData"
                                ]
                              },
                              "applicationGatewaySkus": {
                                "effect": "audit",
                                "applicationGatewaySkus": [
                                  "Standard_Medium"
                                ]
                              },
                              "expressRoutePeeringLocations": {
                                "effect": "audit",
                                "expressRoutePeeringLocations": [
                                  "West Europe"
                                ]
                              },
                              "expressRouteBandwidthsInMbps": {
                                "effect": "audit",
                                "expressRouteBandwidthsInMbps": [
                                  50,
                                  100,
                                  200,
                                  500
                                ]
                              },
                              "resourceGroupWithExpressRoutevNet": {
                                "effect": "audit",
                                "resourceGroupName": "test"
                              },
                              "auditNetworkWatcherExistence": {
                                "networkWatchersResourceGroup": "NetworkWatcherRG",
                                "networkWatchersLocations": [
                                  "West Europe",
                                  "North Europe"
                                ]
                              },
                              "userDefinedRouteTableOnVNets": {
                                "effect": "audit"
                              }
                            },
                            "monitoring": {
                              "auditDiagnosticSettingForResourceTypes": {
                                "resourceTypes": [
                                  "Microsoft.Storage/storageAccounts"
                                ]
                              }
                            },
                            "storage": {
                              "storageAccountHttpsTraffic": {
                                "effect": "audit"
                              },
                              "storageAccountBlobEncryption": {
                                "effect": "audit"
                              },
                              "storageAccountSkus": {
                                "effect": "audit",
                                "storageAccountSkus": [
                                  "Premium_LRS ",
                                  "Standard_GRS",
                                  "Standard_LRS",
                                  "Standard_RAGRS",
                                  "Standard_ZRS"
                                ]
                              },
                              "storageAccountCoolAccessTiering": {
                                "effect": "audit"
                              },
                              "storageAccountFileEncryption": {
                                "effect": "audit"
                              }
                            },
                            "tags": {
                              "applyTagAndValuePairs": [
                                {
                                  "tagName": "env",
                                  "tagValue": "TST"
                                }
                              ],
                              "tagValuePairOnResources": {
                                "effect": "audit",
                                "tagName": "env",
                                "tagValue": "TST"
                              },
                              "tagValuePairOnResourceGroups": {
                                "effect": "audit",
                                "tagName": "ENV",
                                "tagValue": "Test"
                              },
                              "matchPatternOnTagValue": [
                                {
                                  "effect": "audit",
                                  "tagName": "cost",
                                  "tagValuePattern": "cost##"
                                },
                                {
                                  "effect": "audit",
                                  "tagName": "dep",
                                  "tagValuePattern": "dep?"
                                }
                              ],
                              "inheritTagsFromSubscriptionIfMissing": [
                                {
                                  "tagName": "stan"
                                }
                              ],
                              "inheritTagsFromResourceGroupIfMissing": [
                                {
                                  "tagName": "stan"
                                }
                              ],
                              "inheritTagsFromSubscription": [
                                {
                                  "tagName": "stan"
                                }
                              ],
                              "inheritTagsFromResourceGroup": [
                                {
                                  "tagName": "stan"
                                }
                              ],
                              "requireTagsOnSubscription": [
                                {
                                  "tagName": "stan"
                                }
                              ],
                              "appendTagAndValuePairsResourceGroups": [
                                {
                                  "tagName": "stan",
                                  "tagValue": "stan1"
                                }
                              ],
                              "appendTagAndValuePairsFromResourceGroup": [
                                {
                                  "tagName": "stan"
                                }
                              ],
                              "addTagsToResources": [
                                {
                                  "tagName": "stan2",
                                  "tagValue": "stan6"
                                }
                              ],
                              "addTagsToResourceGroups": [
                                {
                                  "tagName": "stan2",
                                  "tagValue": "stan6"
                                }
                              ],
                              "addOrReplaceTagsOnResources": [
                                {
                                  "tagName": "stan2",
                                  "tagValue": "stan6"
                                }
                              ],
                              "addOrReplaceTagsOnResourceGroups": [
                                {
                                  "tagName": "stan2",
                                  "tagValue": "stan6"
                                }
                              ],
                              "requireTagsOnResources": [
                                {
                                  "tagName": "stna"
                                }
                              ],
                              "requireTagsOnResourceGroups": [
                                {
                                  "tagName": "stna"
                                }
                              ]
                            }
                          }
                          builtInInitiatives     Object                     {}
                          exemptions             Array                      []
                          resourceGroups         Array                      []
                          subscriptionTags       Object                     {}
                          deploymentLocation     String                     West Europe
                          uniqueDeploymentId     String                     de96812c-34b7-4c08-a9d1-d61e95eacde9

Outputs                 :
                          Name                  Type                       Value
                          ====================  =========================  ==========
                          uniqueDeploymentId    String                     de96812c-34b7-4c08-a9d1-d61e95eacde9
bmoore-msft commented 2 years ago

Should we simply add the properties of the deployment object directly to the stack?

slavizh commented 2 years ago

@bmoore-msft yes if you ask me. New-AzSubscriptionDeploymentStack should behave and have the same output as New-AzDeployment but with the additional stuff to stacks, including -verbose functionality.

bmoore-msft commented 2 years ago

@slavizh - ack on the output - are there other spots where they don't behave the same? (and maybe enter new issues for those)

slavizh commented 2 years ago

@bmoore-msft no, I do not think so. I think in this issue I have described all the things that are currently different between those and should be the same.

bmoore-msft commented 2 years ago

Grabbing this along with #11

harshpatel17 commented 2 years ago

@slavizh Just released a new Powershell build that attempts to match stack outputs with deployment outputs. https://github.com/Azure/deployment-stacks/releases/tag/v0.1.5

slavizh commented 2 years ago

@harshpatel17 awesome. I will try to test it in the next days and provide feedback.

slavizh commented 2 years ago

@harshpatel17 I am not sure if I spot the change. You say that the output matches the output of regular deployment but I do not see that. I do not see input parameters or output data being displayed at the end of deployment stack. When I read the release notes it says only the error output. But even in that I see some inconsistencies when we compare deployment stack vs deployment error:

Deployment stacks

New-AzSubscriptionDeploymentStack: 15:48:38 - The deployment 'lz-analysis-services-monitoring' failed with error(s). Showing 3 out of 3 error(s).
Error: Code=DeploymentStackUpdateFailed; Message=One or more stages of the deploymentStack failed. See snapshot '/subscriptions/<sub id>/providers/Microsoft.Resources/deploymentStacks/lz-analysis-services-monitoring/snapshots/2022-06-23-12-47-50-86fa7' for more details. Correlation id: 'e91659fa-df37-4f04-b0be-e9ef74473b24'
Error: Code=DeploymentFailed; Message=At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.
Error: Code=DeploymentFailed; Message=At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.

deployment

New-AzDeployment: 15:50:33 - The deployment 'stan343' failed with error(s). Showing 2 out of 2 error(s).
Status Message: {
  "error": {
    "code": "InvalidRequestContent",
    "message": "The request content was invalid and could not be deserialized: 'Frequency of 16 minutes is not supported. Supported Frequencies are: 1, 5, 10, 15, 30, 45, 60, 120, 180, 240, 300, 360, 1440'"
  }
} (Code:BadRequest)
Status Message: At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details. (Code: DeploymentFailed)
 - {
  "status": "Failed",
  "error": {
    "code": "ResourceDeploymentFailure",
    "message": "The resource operation completed with terminal provisioning state 'Failed'.",
    "details": [
      {
        "code": "DeploymentFailed",
        "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
        "details": [
          {
            "code": "BadRequest",
            "message": "{\r\n  \"error\": {\r\n    \"code\": \"BadRequest\",\r\n    \"message\": \"{\\r\\n  \\\"error\\\": {\\r\\n    \\\"code\\\": \\\"InvalidRequestContent\\\",\\r\\n    \\\"message\\\": \\\"The request content was invalid and could not be deserialized: 'Frequency of 16 minutes is not supported. Supported Frequencies are: 1, 5, 10, 15, 30, 45, 60, 120, 180, 240, 300, 360, 1440'\\\"\\r\\n  }\\r\\n}\"\r\n  }\r\n}"
          }
        ]
      }
    ]
  }
} (Code:Conflict)
CorrelationId: 37f50c38-acf1-4203-a30f-8be94ed4dba7

You can clearly see how deployment is able to expose the actual error at least where deployment stack fails.

I have unzipped the new bits, uninstalled previous version and installed the new one.

bmoore-msft commented 2 years ago

@slavizh - do you have a template and params file you can share - the "bad request" path is always trick (even if too common) - I want see see the code path the service takes to get you there...

slavizh commented 2 years ago

@bmoore-msft will send e-mail with the code.

slavizh commented 2 years ago

@harshpatel17 any update after providing the template?

bmoore-msft commented 2 years ago

@harshpatel17 - is on vacation for a few weeks, IDK how far he got before he left... hang tight.

slavizh commented 2 years ago

ok, no problem. Relaxing vacation.

slavizh commented 2 years ago

@harshpatel17 any update?

harshpatel17 commented 2 years ago

@slavizh Sorry about the late response. I'll take another look at the template and will get back to you by EoD tomorrow.

slavizh commented 1 year ago

@harshpatel17 any update? Overall should we expect any updates on the proposed behavior for New-AzSubscriptionDeploymentStack or currently focus is the next milestone for deployment stacks and after that work on the tooling experience?

harshpatel17 commented 1 year ago

Hi @slavizh, yes my goal is to have the changes requested in by the end of this milestone. My estimate would be the changes should get in within this month.

dantedallag commented 1 year ago

@slavizh we updated the stack view in the new version to more closely match deployments. Could you take a look and get back to us if anything still seems to be missing?

Also, there is still an issue we are dealing with on the error (the entity error in stacks may be not as descriptive as deployments) related to https://github.com/Azure/deployment-stacks/issues/78. I am still looking into this. Hoping to get your feedback on everything besides the error here and we can keep the error discussion in the other issue.

slavizh commented 1 year ago

@dantedallag Unfortunately I do not see any difference at all.

Here is what I saw as error in January release:

New-AzSubscriptionDeploymentStack: 15:48:38 - The deployment 'lz-analysis-services-monitoring' failed with error(s). Showing 3 out of 3 error(s).
Error: Code=DeploymentStackUpdateFailed; Message=One or more stages of the deploymentStack failed. See snapshot '/subscriptions/<sub id>/providers/Microsoft.Resources/deploymentStacks/lz-analysis-services-monitoring/snapshots/2022-06-23-12-47-50-86fa7' for more details. Correlation id: 'e91659fa-df37-4f04-b0be-e9ef74473b24'
Error: Code=DeploymentFailed; Message=At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.
Error: Code=DeploymentFailed; Message=At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.

Here is the March release:

New-AzSubscriptionDeploymentStack: 14:09:14 - The deployment 'lz-analysis-services-monitoring' failed with error(s). Showing 3 out of 3 error(s).
Error: Code=DeploymentStackUpdateFailed; Message=One or more stages of the deploymentStack failed. Correlation id: 'b4e88da9-0655-4444-b05c-9a881e411ea0'

Error: Code=DeploymentFailed; Message=At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.

Error: Code=DeploymentFailed; Message=At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.

Screenshot as well: image

As you can see no difference at all between those releases.

Here is what New-AzSubscriptionDeployment outputs as error:

New-AzDeployment: 14:15:06 - The deployment 'lz-analysis-services-monitoring' failed with error(s). Showing 2 out of 2 error(s).
Status Message: Deployment template validation failed: 'The template resource '[items(parameters('analysisServiceMonitoring').alertRules)[copyIndex()].value.id]' at line '1' and column '8050' is not valid: The language expression property 'id' doesn't exist, available properties are 'deploy, frequencyInMinutes, timeWindowInMinutes, description'.. Please see https://aka.ms/arm-functions for usage details.'. (Code:InvalidTemplate)

Status Message: At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details. (Code: DeploymentFailed)
 - {
  "error": {
    "code": "InvalidTemplate",
    "message": "Deployment template validation failed: 'The template resource '[items(parameters('analysisServiceMonitoring').alertRules)[copyIndex()].value.id]' at line '1' and column '8050' is not valid: The language expression property 'id' doesn't exist, available properties are 'deploy, frequencyInMinutes, timeWindowInMinutes, description'.. Please see https://aka.ms/arm-functions for usage details.'.",
    "additionalInfo": [
      {
        "type": "TemplateViolation",
        "info": {
          "lineNumber": 1,
          "linePosition": 8050,
          "path": "properties.template.resources[0]"
        }
      }
    ]
  }
} (Code:BadRequest)

CorrelationId: 9c6e2db3-859c-4342-ac19-eb8a2b109d3a

Screenshot as well:

image

dantedallag commented 1 year ago

@slavizh I'm going to close this one as well as this issue involves multiple things, many of which have been fixed or have their own issue being tracked. Please create a new issue for anything you feel has not been addressed with the current release.