Azure / Azure/arm-template-whatif

what-if result inaccuracies across scope boundaries.

Open
#313 3 comments 0 reactions 0 assignees View on GitHub
Needs Triage :mag: Needs: Triage :mag:
Dominant language
HTML
Stars
101
Forks
21
Avg merge
3h 35m
Merged PRs (30d)
1

Description

### Discussed in https://github.com/Azure/bicep/discussions/10332

Originally posted by **JoshuaXu-Wen** April 6, 2023
Hi there, I write a resource group module, the main.bicep target scope is 'resourceGroup'.

```bicep
module resourceGroupPrimary 'Module/resourceGroup.bicep' = {
scope: subscription(subscriptionId)
name: 'resourceGroupPrimaryDeploy-${uniqueString(deployment().name)}'
params: {
location: locationPrimary
rgName: rgPrimaryName
tags: tags
}
```

When I use what-if to verify the result, the deployment gives the following error:
DeploymentWhatIfResourceError - The request to predict template deployment changes to scope '/subscriptions/XXXXXXXXXXXXX/resourceGroups/rg-Backup' has failed due to a resource error. See details for more information.
ResourceGroupNotFound - Resource group 'rg-Primary' could not be found.

If I create the resourceGroup, the script can create the resource group 'rg-Primary' correctly.

az bicep version: Bicep CLI version 0.16.1 (d77dcc750a)

---
more information

@JoshuaXu-Wen

##### Adding code in case anyone else wants to test this out OR view the scope specific issue examples

#### main. Bicep - resource group scoped deployment
```bicep
param location string = 'eastus'
param rgName string = 'myRG2'

// targetScope = 'subscription'

module RG 'temp.bicep' = {
name: 'rg'
scope: subscription()
params: {
location: location
rgName: rgName
}
}

output rgname string = RG.outputs.RGName
```
#### temp.bicep
```bicep
param rgName string
param location string
param tags object = {}

targetScope = 'subscription'

resource RG 'Microsoft.Resources/resourceGroups@2022-09-01' = {
name: rgName
location: location
tags: tags
properties: {}
}

output RGName string = RG.name
```

1) If the resource group does not exist, you will get an error, since going across scopes it is unable to complete the `what-if`
> 'The request to predict template deployment changes to scope '/subscriptions/4185fa9b-f470-466a-b3ae-8e6c3314a543/resourceGroups/AEU1-PE-CTL-RG-D1' has failed due to a resource error. 🟥

2) if the resource group does exist, it doesn't detect it and it shows it will create it. 🟥

![image](https://user-images.githubusercontent.com/3605266/230535467-1f4a9451-0fc6-482e-ac90-882e2344c0d9.png)

#### It appears this is a result from going across scopes: Resource Group --> Subscription --> Resource group.

#### The workaround

1) Deploy in the subscription scope initially and what-if works as expected

```bicep
param location string = 'eastus'
param rgName string = 'myRG2'

targetScope = 'subscription'

module RG 'temp.bicep' = {
name: 'rg'
// scope: subscription()
params: {
location: location
rgName: rgName
}
}

output rgname string = RG.outputs.RGName
```

1) When no RG exists - corretly shows it will be created ✅

![image](https://user-images.githubusercontent.com/3605266/230536270-7f6e408e-2e03-4335-929f-81128636ca26.png)

2) When the RG exists - correctly shows it will be ignored ✅

![image](https://user-images.githubusercontent.com/3605266/230536355-389b4585-68f0-49ed-91f7-2d00d4a75e73.png)

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the main Bicep and temp.bicep examples in the issue, using a subscription-to-resource-group deployment and testing both an existing and missing resource group. Compare what-if output with the documented subscription-scoped workaround. Done means cross-scope what-if no longer reports an incorrect error or creation result.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.