Azure / Azure/arm-template-whatif
Noise with Microsoft.Network/firewallPolicies/ruleCollectionGroups
- Dominant language
- HTML
- Stars
- 101
- Forks
- 21
- Avg merge
- 3h 35m
- Merged PRs (30d)
- 1
Description
## Describe the noise
'\- ipv6Rule: false' for each rule (NetworkRule type, others untested) in the rules property. This does not appear to be a valid property per the [docs](https://learn.microsoft.com/en-us/azure/templates/microsoft.network/firewallpolicies/rulecollectiongroups?pivots=deployment-language-bicep#networkrule)
**Resource type** (i.e. Microsoft.Storage/storageAccounts)
Microsoft.Network/firewallPolicies/ruleCollectionGroups
**apiVersion** (i.e. 2019-04-01)
2023-04-01
**Client (PowerShell, Azure CLI, or API)**
Tested in both PowerShell and Azure CLI
**Relevant ARM Template code (we only need the resource object for the above `resourceType` and `apiVersion`, but if it's easier you can include the entire template**
```Bicep
param Location string = resourceGroup().location
resource firewallPolicy 'Microsoft.Network/firewallPolicies@2023-04-01' = {
name: 'ExamplePolicy'
location: Location
properties: {
dnsSettings: {
enableProxy: true
}
sku: {
tier: 'Standard'
}
threatIntelMode: 'Alert'
}
}
resource firewallRuleCollectionGroups 'Microsoft.Network/firewallPolicies/ruleCollectionGroups@2023-04-01' = {
name: 'ExampleRuleCollection'
parent: firewallPolicy
properties: {
priority: 100
ruleCollections: [{
name: 'RuleCollection'
ruleCollectionType: 'FirewallPolicyFilterRuleCollection'
priority: 1000
action: {
type: 'Allow'
}
rules: [
{
ipv6Rule: false
name: 'ExampleRule'
ruleType: 'NetworkRule'
ipProtocols: [
'TCP'
'UDP'
]
destinationAddresses: [
'1.1.1.1'
]
destinationPorts: [
'53'
]
sourceAddresses: [
'*'
]
}
]
}]
}
}
```
**Expected response (i.e. "I expected no noise since the template has not been modified since the resources were deployed)**
I expected no noise since the template has not been modified since the resources were deployed
**Current (noisy) response (either include a screenshot of the what-if output, or copy/paste the text)**
```
Resource and property changes are indicated with these symbols:
- Delete
~ Modify
= Nochange
The deployment will update the following scope:
Scope: /subscriptions//resourceGroups/
~ Microsoft.Network/firewallPolicies/ExamplePolicy/ruleCollectionGroups/ExampleRuleCollection [2023-04-01]
~ properties.ruleCollections: [
~ 0:
~ rules: [
~ 0:
- ipv6Rule: false
]
]
= Microsoft.Network/firewallPolicies/ExamplePolicy [2023-04-01]
Resource changes: 1 to modify, 1 no change.
```
**Additional context**
Add any other context about the problem here.
Despite generating a warning if added, adding the ipv6Rule property to the template will deploy properly and will not emit the errant what-if noise, however then this become a "BCP037" issue instead. Because the property does not seem to appear in the docs, nor is it emitted in the portal template export, I'm reporting it here first rather than at aka.ms/bicep-type-issues
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing the reported deployment with the Microsoft.Network/firewallPolicies/ruleCollectionGroups resource at API version 2023-04-01, using the supplied Bicep template and Azure what-if through PowerShell or Azure CLI. Trace how the what-if result handles the rules property; done means an unchanged deployment no longer reports the spurious ipv6Rule: false deletion.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, powershell
- Domain
- cloud, devtools
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 50/100