PSRule does not detect DependsOn correctly

[lassehastrup]

Description of the issue

I recieved the error attached below after running PSRule. The deployment went fine, however PSRule complained about converting a string to an array, which seemed strange to me.

Main.bicep is using two different modules - one that creates the Virtual Machines, and another that will add the maintenanceConfigurationAssignment on the VM's.

However, after moving the sequence modules so that the MaintenanceConfiguration is evaluated first, the error stopped.

I assume therefore, that there might be an issue with "DependsOn" in PSRule.

If needed i can upload the bicep code, however we have a lot of sensitive code/params, so I would have to upload it in private.

To Reproduce

Steps to reproduce the issue:

Expected behaviour

Error output

[ERROR] Unable to expand resources because the source file '/templates/main.bicep' was not valid. An error occurred evaluating expression '[parameters('maintenanceConfigurationIds')[mod(copyIndex(), 2)].id]' line 895. Invalid cast from 'System.String' to 'Newtonsoft.Json.Linq.JArray'.

Module in use and version:

- Module: PSRule
- Version: 2.7.0

Captured output from $PSVersionTable:

Name                           Value                                                                                                                                                                                                                                                                                 
----                           -----
PSVersion                      7.3.3
PSEdition                      Core
GitCommitId                    7.3.3
OS                             Darwin 22.2.0 Darwin Kernel Version 22.2.0: Fri Nov 11 02:03:51 PST 2022; root:xnu-8792.61.2~4/RELEASE_ARM64_T6000
Platform                       Unix

Additional context

This Works

This does NOT work

[github-actions[bot]]

Thanks for raising your first issue, the team appreciates the time you have taken 😉

[BernieWhite]

@lassehastrup Thanks for logging the issue. I agree, there does seem to be some issue with processing dependsOn for your case. Let me see if I can reproduce the issue.

To confirm:

• Within the MaintenanceConfiguration.bicep module you are deploying a single or more then one Microsoft.Maintenance/maintenanceConfigurations?
• The return type of the maintenanceConfigurationIds output. It is an array or string or some other type? If you can provide a screen shot of just the maintenanceConfigurationIds output line or a sanitized snippet of that line that would help, so that I can understand the structure and which type of functions/ references you are using.

[lassehastrup]

Hi @BernieWhite,

We're deploying two Maintenance Configurations.

Here is the output we're generating from it:

And this is how we're processing the output when assigning them to a VM:

Let me know if you any further information

[BernieWhite]

@lassehastrup One further follow up on this can I get a screenshot of the JSON form (after Bicep build):

• the output maintenanceConfigurationIds
• the parameter maintenanceConfigurationId being passed int to the virtualMachines.bicep module.

[lassehastrup]

Hi @BernieWhite ,

Apologies for the delay.

Output of the maintenanceConfigurationIds "maintenanceConfigurationIds": { "type": "array", "copy": { "count": "[length(items(parameters('DcUpdatePhases')))]", "input": { "id": "[resourceId('Microsoft.Maintenance/maintenanceConfigurations', format('Configuration-UpdatePhase-{0}', items(parameters('DcUpdatePhases'))[copyIndex()].key))]" } } }

param value:

"maintenanceConfigurationIds": { "value": "[reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', subscription().subscriptionId, parameters('DcUpdateConfigurationRgName')), 'Microsoft.Resources/deployments', format('deploy-DcUpdatePhases-{0}', parameters('baseTime'))), '2020-10-01').outputs.maintenanceConfigurationIds.value]" }

[BernieWhite]

@lassehastrup Thanks for that. I've been able to reproduce the issue which is related to the dependency chain with the deployment potentially across scopes. I've logged the related issue over on the PSRule for Azure repo. (See Azure/PSRule.Rules.Azure#2111).

We should have a fix for this soon that you can double check resolves your issue.

[BernieWhite]

@lassehastrup Release v1.25.1 of PSRule.Rules.Azure is available. Are you able to verify that this fixes your issue?

[lassehastrup]

@BernieWhite , Appreciate it, thanks! I will test it asap, and let you know

[lassehastrup]

@BernieWhite , Tested locally, and it seems to fix the issue. Appreciate the quick fix, have a nice day.