Azure / Azure/azure-cli

"KeyError: 'tag_name'" error when attempting to decompile an ARM template

Open
#17,468 5 comments 0 reactions 1 assignee Claimed by @zhoxing-ms View on GitHub
act-identity-squad ARM Service Attention
Dominant language
Python
Stars
4.6k
Forks
3.5k
Avg merge
3d 2h
Merged PRs (30d)
60

Description

### **This is autogenerated. Please review and update as needed.**

## Describe the bug

When trying to decompile a template, I get the verbose error below.
The ARM template is perfectly valid, and I can deploy it successfully using the CLI.

For reference, this is the template i'm trying to decompile.

```json
{
"$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"suppressionEnabled": {
"type": "bool",
"metadata": {
"description": "Determines whether the suppression for this alert rule is enabled or disabled."
},
"defaultValue": false
},
"createIncident": {
"type": "bool",
"metadata": {
"description": "True/False whether to create an incident when the rule is triggered"
},
"defaultValue": false
},
"queryFrequency": {
"type": "string",
"metadata": {
"description": "The frequency (in ISO 8601 duration format) for this alert rule to run. Example: PT1H"
},
"defaultValue": "PT1H"
},
"suppressionDuration": {
"type": "string",
"metadata": {
"description": "The suppression (in ISO 8601 duration format) to wait since last time this alert rule been triggered. Example: PT1H"
},
"defaultValue": "PT1H"
},
"tactics": {
"type": "array",
"metadata": {
"description": "The tactics detected by this rule as mapped to the MITRE ATT&CK framework"
},
"defaultValue": [
"CredentialAccess"
]
},
"severity": {
"type": "string",
"metadata": {
"description": "The severity for alerts created by this alert rule"
},
"defaultValue": "Medium",
"allowedValues": [
"High",
"Medium",
"Low",
"Informational"
]
},
"location": {
"type": "string",
"metadata": {
"description": "The location in which the resource should be deployed"
},
"defaultValue": "[resourceGroup().location]"
},
"triggerThreshold": {
"type": "int",
"metadata": {
"description": "The threshold triggers this alert rule."
},
"defaultValue": 0
},
"triggerOperator": {
"type": "string",
"metadata": {
"description": "The operation against the threshold that triggers alert rule. Allowed values: Equal, GreaterThan, LessThan and NotEqual"
},
"defaultValue": "GreaterThan",
"allowedValues": [
"GreaterThan",
"Equal",
"LessThan",
"NotEqual"
]
},
"workspaceName": {
"type": "string",
"metadata": {
"description": "Workspace name for Log Analytics where Sentinel is setup"
}
},
"ruleId": {
"type": "string",
"metadata": {
"description": "The unique guid for this scheduled alert rule"
},
"defaultValue": "[newGuid()]"
},
"queryPeriod": {
"type": "string",
"metadata": {
"description": "The period (in ISO 8601 duration format) that this alert rule looks at. Example: P2DT1H30M"
},
"defaultValue": "PT1H"
}
},
"variables": {
"ruleDisplayName": "MFA disabled for a user",
"ruleQuery": "(union isfuzzy=true\n(AuditLogs \n| where OperationName =~ \"Disable Strong Authentication\"\n| extend IPAddress = tostring(parse_json(tostring(InitiatedBy.user)).ipAddress) \n| extend InitiatedByUser = iff(isnotempty(tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName)), \n tostring(parse_json(tostring(InitiatedBy.user)).userPrincipalName), tostring(parse_json(tostring(InitiatedBy.app)).displayName))\n| extend Targetprop = todynamic(TargetResources)\n| extend TargetUser = tostring(Targetprop[0].userPrincipalName) \n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by User = TargetUser, InitiatedByUser , Operation = OperationName , CorrelationId, IPAddress, Category, Source = SourceSystem , AADTenantId, Type\n),\n(AWSCloudTrail\n| where EventName in~ (\"DeactivateMFADevice\", \"DeleteVirtualMFADevice\") \n| extend InstanceProfileName = tostring(parse_json(RequestParameters).InstanceProfileName)\n| extend TargetUser = tostring(parse_json(RequestParameters).userName)\n| summarize StartTimeUtc = min(TimeGenerated), EndTimeUtc = max(TimeGenerated) by User = TargetUser, Source = EventSource , Operation = EventName , TenantorInstance_Detail = InstanceProfileName, IPAddress = SourceIpAddress\n)\n)\n| extend timestamp = StartTimeUtc, AccountCustomEntity = User, IPCustomEntity = IPAddress",
"ruleDescription": "Multi-Factor Authentication (MFA) helps prevent credential compromise. This alert identifies when an attempt has been made to diable MFA for a user ",
"entityMappings": [
{
"entityType": "Account",
"fieldMappings": [
{
"identifier": "FullName",
"columnName": "AccountCustomEntity"
}
]
},
{
"entityType": "IP",
"fieldMappings": [
{
"identifier": "Address",
"columnName": "IPCustomEntity"
}
]
}
]
},
"resources": [
{
"type": "Microsoft.OperationalInsights/workspaces/providers/alertRules",
"apiVersion": "2020-01-01",
"location": "[parameters('location')]",
"kind": "Scheduled",
"name": "[concat(parameters('workspaceName'), '/Microsoft.SecurityInsights/', parameters('ruleId'))]",
"properties": {
"ruleDescription": "[variables('ruleDescription')]",
"tactics": "[parameters('tactics')]",
"queryPeriod": "[parameters('queryPeriod')]",
"displayName": "[variables('ruleDisplayName')]",
"suppressionDuration": "[parameters('suppressionDuration')]",
"severity": "[parameters('severity')]",
"triggerOperator": "[parameters('triggerOperator')]",
"createIncident": "[parameters('createIncident')]",
"alertRuleTemplateName": "65c78944-930b-4cae-bd79-c3664ae30ba7",
"queryFrequency": "[parameters('queryFrequency')]",
"triggerThreshold": "[parameters('triggerThreshold')]",
"entityMappings": "[variables('entityMappings')]",
"enabled": true,
"query": "[variables('ruleQuery')]",
"suppressionEnabled": "[parameters('suppressionEnabled')]"
}
}
]
}

```

**Command Name**
`az bicep decompile`

**Errors:**
```
'tag_name'
Traceback (most recent call last):
cli\Lib\site-packages\knack\cli.py, ln 233, in invoke
azure\cli\core\commands\__init__.py, ln 660, in execute
azure\cli\core\commands\__init__.py, ln 723, in _run_jobs_serially
azure\cli\core\commands\__init__.py, ln 716, in _run_job
artifacts\cli\Lib\site-packages\six.py, ln 703, in reraise
azure\cli\core\commands\__init__.py, ln 694, in _run_job
azure\cli\core\commands\__init__.py, ln 331, in __call__
site-packages\azure\cli\core\__init__.py, ln 811, in default_command_handler
azure\cli\command_modules\resource\custom.py, ln 3206, in decompile_bicep_file
azure\cli\command_modules\resource\_bicep.py, ln 41, in run_bicep_command
azure\cli\command_modules\resource\_bicep.py, ln 102, in get_bicep_latest_release_tag
KeyError: 'tag_name'
```

## To Reproduce:
Steps to reproduce the behavior. Note that argument values have been redacted, as they may contain sensitive information.

- `az bicep decompile -f MFADisabledForAUser.json`

## Expected Behavior

The ARM template is decompiled into a new .bicep file

## Environment Summary
```
Windows-10-10.0.21343-SP0
Python 3.6.8
Installer: MSI

azure-cli 2.21.0

Extensions:
azure-devops 0.18.0
sentinel 0.1.0

```
## Additional Context

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.