Azure / Azure/Azure-Landing-Zones

[Feature Request]: ALZ Library improved schema checking/error handling

Open
#3,975 1 comment 0 reactions 0 assignees View on GitHub
Product: ALZ Provider (Terraform) Product: Azure Policy :shield: Product: Terraform (AVM)
Dominant language
PowerShell
Stars
96
Forks
70
Avg merge
3d 1h
Merged PRs (30d)
7

Description

### Which product(s) are you raising for?

Azure Policy

### What is the feature request?

Hi

I'm using the ALZ accelerator and as a result the Azure Landing Zones Library to manage an Azure Landing Zone. I was trying to create a new policy_set_definition (initiative) that included a custom policy and a built-in policy to be applied to my landingzones management group.

While trying to develop the alz_policy_set_definition.json file I was missing the "policyDefinitionReferenceId" field in the policyDefinitions item.

```
"policyDefinitions": [
{
"definitionVersion": "6.*.*",
"groupNames": [],
"parameters": {
"effect": {
"value": "[parameters('effect')]"
},
"scopeToSupportedImages": {
"value": "[parameters('scopeToSupportedImages')]"
},
"listOfLinuxImageIdToInclude": {
"value": "[parameters('listOfLinuxImageIdToInclude')]"
},
"dcrResourceId": {
"value": "[parameters('dcrResourceId')]"
},
"resourceType": {
"value": "[parameters('resourceType')]"
}
},
"policyDefinitionId": "/providers/Microsoft.Authorization/policyDefinitions/2ea82cdd-f2e8-4500-af75-67a2e084ca74",
"policyDefinitionReferenceId": "Modify-VM-DCR"
}
]
```

The error I was getting when Terraform tried to do run a plan was a stack trace dump as seen below.

```
Stack trace from the terraform-provider-alz_v0.18.0 plugin:

panic: runtime error: invalid memory address or nil pointer dereference
[signal SIGSEGV: segmentation violation code=0x1 addr=0x0 pc=0x917fc0]

goroutine 241 [running]:
github.com/Azure/alzlib/deployment.(*HierarchyManagementGroup).generatePolicyAssignmentAdditionalRoleAssignments(0xc000da8320)
github.com/Azure/alzlib@v0.26.0/deployment/managementgroup.go:287 +0x1480
github.com/Azure/alzlib/deployment.(*Hierarchy).PolicyRoleAssignments(0xc001399b48, {0x0?, 0x0?})
github.com/Azure/alzlib@v0.26.0/deployment/hierarchy.go:110 +0x1d3
github.com/Azure/terraform-provider-alz/internal/provider.(*architectureDataSource).Read(0xc0012af800, {0x11e6ff8, 0xc00139c990}, {{{{0x11eedd0, 0xc0013b8ff0}, {0xef4c20, 0xc0013a6ae0}}, {0x11f1ec0, 0xc000f81740}}, {{{0x0, ...}, ...}, ...}, ...}, ...)
github.com/Azure/terraform-provider-alz/internal/provider/architecture_data_source.go:159 +0xc67
github.com/hashicorp/terraform-plugin-framework/internal/fwserver.(*Server).ReadDataSource(0xc0001972c0, {0x11e6ff8, 0xc00139c990}, 0xc001363240, 0xc0013c96e0)
github.com/hashicorp/terraform-plugin-framework@v1.11.0/internal/fwserver/server_readdatasource.go:103 +0x74f
github.com/hashicorp/terraform-plugin-framework/internal/proto6server.(*Server).ReadDataSource(0xc0001972c0, {0x11e6ff8?, 0xc00139c8a0?}, 0xc00139c840)
github.com/hashicorp/terraform-plugin-framework@v1.11.0/internal/proto6server/server_readdatasource.go:55 +0x389
github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server.(*server).ReadDataSource(0xc000244820, {0x11e6ff8?, 0xc0005f5e00?}, 0xc001346870)
github.com/hashicorp/terraform-plugin-go@v0.23.0/tfprotov6/tf6server/server.go:688 +0x26a
github.com/hashicorp/terraform-plugin-go/tfprotov6/internal/tfplugin6._Provider_ReadDataSource_Handler({0x1018a00, 0xc000244820}, {0x11e6ff8, 0xc0005f5e00}, 0xc001356e00, 0x0)
github.com/hashicorp/terraform-plugin-go@v0.23.0/tfprotov6/internal/tfplugin6/tfplugin6_grpc.pb.go:572 +0x1a6
google.golang.org/grpc.(*Server).processUnaryRPC(0xc000177000, {0x11e6ff8, 0xc0005f5d70}, {0x11f0700, 0xc000224680}, 0xc00138f560, 0xc00030da40, 0x19364a0, 0x0)
google.golang.org/grpc@v1.66.0/server.go:1393 +0xe08
google.golang.org/grpc.(*Server).handleStream(0xc000177000, {0x11f0700, 0xc000224680}, 0xc00138f560)
google.golang.org/grpc@v1.66.0/server.go:1804 +0xe8a
google.golang.org/grpc.(*Server).serveStreams.func2.1()
google.golang.org/grpc@v1.66.0/server.go:1029 +0x7f
created by google.golang.org/grpc.(*Server).serveStreams.func2 in goroutine 29
google.golang.org/grpc@v1.66.0/server.go:1040 +0x11d

Error: The terraform-provider-alz_v0.18.0 plugin crashed!
```

Would it be possible to return a more meaningful error message that identifies that the definition itself is incomplete?

Thanks

### Potential implementation/configuration

```Text

```

Contributor guide

Open the contributing guide

Research direction

Start with deployment/managementgroup.go at generatePolicyAssignmentAdditionalRoleAssignments and hierarchy.go at PolicyRoleAssignments, the locations shown in the stack trace. Reproduce the incomplete policy definition without policyDefinitionReferenceId and trace where validation is absent. Done means the input produces a meaningful incomplete-definition error instead of a nil-pointer panic.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, go, terraform
Domain
cloud, tooling
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.