search

OfficeDev / teams-toolkit

Developer tools for building Teams apps
Other
450 stars 176 forks source link

Support for defining resource metadata (tags etc) #1251

Closed marcus-crane closed 2 years ago

marcus-crane commented 3 years ago

Is your feature request related to a problem? Please describe. As a developer, I can't actually deploy using the "Provision in the Cloud" feature for testing. My workplace enforces required tags (using Azure policy service as I understand it).

From having a look through the codebase, it seems that tags can't be defined and the location is hardcoded as "global".

I'm not sure if Bot Service has a concept of being regionless but if not, I imagine we'd want to specify a particular region as well, for data sovereignty (ie GDRP/European data protection) reasons.

EDIT: Having deployed an Azure Bot Service using an ARM template now, I can confirm that global works fine and that my understanding of bot regions wasn't correct (despite what the errors says interestingly) but tags would still be required to deploy all of the required resources "out of the box".

Similarly, the ability to define the resource group name explicitly to match with already existing conventions would be nice.

Describe the solution you'd like The ability to define resource metadata for provisioning a bot. At least initially for testing in environments that are a bit more constrained than a pure sandbox.

Perhaps it's an extra JSON block that lives in .fx/settings.json or .fx/env.default.json but I don't have a good understanding of what each file relates to just yet.

Describe alternatives you've considered I haven't gone down this path yet, and I imagine we will anyway just to keep resource definitions explicit, but presumably our alternative will be to define an Azure Bot Service bot as an ARM template.

I'm relatively new to the Teams Toolkit (plus it has changed radically since v1 as I found out today) so I don't have enough information to know what the logistics of deployment (outside of TeamsFx/Teams Toolkit) will look like.

I've successfully deployed an Azure Bot Service... resource(?) using an ARM template and will continue with this method since it's how most of our projects are set up. Having said that, I'm sure other users will presumably find this issue valuable.

Additional context

Related stack trace:

[2021-06-01T02:38:35.545Z] [Error] - code:Core.UncatchedError, message: Resource 'fxbugreport-rg' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"Azure-ResourceGroupLocations","id":"/subscriptions/<snip>/providers/Microsoft.Authorization/policyAssignments/Azure-ResourceGroupLocations"},"policyDefinition":{"name":"Allowed locations for resource groups","id":"/providers/Microsoft.Authorization/policyDefinitions/<snip>"}},{"policyAssignment":{"name":"Azure-ResourceGroupTagOwner","id":"/subscriptions/<snip>/providers/Microsoft.Authorization/policyAssignments/Azure-ResourceGroupTagOwner"},"policyDefinition":{"name":"Require a tag on resource groups","id":"/providers/Microsoft.Authorization/policyDefinitions/<snip>"}}]'., stack: Error: Resource 'fxbugreport-rg' was disallowed by policy. Policy identifiers: '[{"policyAssignment":{"name":"Azure-ResourceGroupLocations","id":"/subscriptions/<snip>/providers/Microsoft.Authorization/policyAssignments/Azure-ResourceGroupLocations"},"policyDefinition":{"name":"Allowed locations for resource groups","id":"/providers/Microsoft.Authorization/policyDefinitions/<snip>"}},{"policyAssignment":{"name":"Azure-ResourceGroupTagOwner","id":"/subscriptions/<snip>/providers/Microsoft.Authorization/policyAssignments/Azure-ResourceGroupTagOwner"},"policyDefinition":{"name":"Require a tag on resource groups","id":"/providers/Microsoft.Authorization/policyDefinitions/<snip>"}}]'

Expanded policy violation from the above stacktrace for readability

[
  {
    "policyAssignment": {
      "name": "Azure-ResourceGroupLocations",
      "id": "/subscriptions/<snip>/providers/Microsoft.Authorization/policyAssignments/Azure-ResourceGroupLocations"
    },
    "policyDefinition": {
      "name": "Allowed locations for resource groups",
      "id": "/providers/Microsoft.Authorization/policyDefinitions/<snip>"
    }
  },
  {
    "policyAssignment": {
      "name": "Azure-ResourceGroupTagOwner",
      "id": "/subscriptions/<snip>/providers/Microsoft.Authorization/policyAssignments/Azure-ResourceGroupTagOwner"
    },
    "policyDefinition": {
      "name": "Require a tag on resource groups",
      "id": "/providers/Microsoft.Authorization/policyDefinitions/<snip>"
    }
  }
]

Unrelated but congrats on V2! It seems like a solid improvement.

Let me know if this is already supported but I've taken a pretty thorough poke around the codebase and I can't find anything related into resource tags or configuration.

marcus-crane commented 3 years ago

Whoa, thanks for the fast response 🙂

I've edited some parts of the issue to reflect my current state (I've got everything set up using an ARM template) but as mentioned, I'm sure other users just getting started may find this to be useful. I'll be keeping an eye on how TeamsFx comes along though!

zhenyasav commented 3 years ago

Thank you so much for taking such a close look at this new tooling. Agreed, we have a lot of work left to do to be more palatable for production. A big feature we're currently working hard to finish is better support and exposure of those ARM (or bicep) templates such that you can do the things you mentioned. This is super useful input, we'll take a look at exposing the resource group naming convention as well. Our vision is to help you essentially generate and interop with these ARM templates so that you can neatly add more resources to the ones we generate, or vice-versa, where we extend your existing templates with resources for your Teams app. In short, we don't support your use case very well just yet, but making ARM templates more exposed is one of our top priorities at the moment. Stay tuned! Thanks again!

MuyangAmigo commented 2 years ago

Hey, we have included a preview feature in the latest Teams Toolkit with ARM support, if you wish to give it a try, please follow the Wiki Page to Enable ARM Support! Feel free to raise an issue should you meet any problems.

adashen commented 2 years ago

Hey @marcus-crane, thanks again for your feedback, we just released Teams Toolkit V3 that should support your ask - customizing the behavior of provisioning Azure resources. Please find following link for reference: