Azure / Azure/bicep-registry-modules

[AVM Module Issue]: var identity is constructed incorrectly on several templates

Open
#4,701 9 comments 0 reactions 1 assignee Claimed by @ChrisSidebotham View on GitHub
Class: Resource Module :package: Type: AVM :a: :v: :m: Type: Bug :bug:
Dominant language
Bicep
Stars
736
Forks
564
Avg merge
3d 15h
Merged PRs (30d)
30

Description

### Check for previous/existing GitHub issues

- [x] I have checked for previous/existing GitHub issues

### Issue Type?

Bug

### Module Name

avm/res/web/static-site

### (Optional) Module Version

_No response_

### Description

The issue is opened for Static Web App because that is where I have noticed and tested it, but the same bug seems to exist in multiple templates:
- avm/res/app-configuration/configuration-store
- avm/res/compute/dis-encryption-set
- avm/res/document-db/database-account
- avm/res/machine-learning-services/workspace/compute
- avm/res/search/search-service
- avm/res/signal-r-service/signal-r
- avm/res/sql/managed-instance
- avm/res/sql/server
- avm/res/web/hosting-environment - ([Microsoft.Web/hostingEnvironments](https://learn.microsoft.com/en-us/azure/templates/microsoft.web/hostingenvironments?pivots=deployment-language-bicep) does not support the identity property, so should be removed I believe)
- avm/res/web/static-site

I would like to request the fix of all bugs in this request - hope that I do not need to open an issue for each module separately.

#### Describe the bug
When deploying the template with system-assigned managed identity explicitly set to false while not providing any user-assigned managed resource id, the deployment validation fails.

#### Error message
New-AzResourceGroupDeployment: 10:09:05 - Error: Code=InvalidTemplate; Message=Deployment template parse failed: 'Required property 'type' expects a value but got null. Path ''.'.

The search/search-service gives a different error:
New-AzResourceGroupDeployment: 10:09:05 - Error: Code=InvalidTemplate; Message=Deployment template parse failed: 'Error converting value "" to type 'Azure.Deployments.Core.Definitions.Resources.ResourceIdentityType'. Path 'type'.'.

#### To Reproduce
Create deployment invoking the module as below.
```bicep
module staticwebapp 'br/public:avm/res/web/static-site:0.8.2' = {
name: 'deploy-static-webapp'
params: {
name: 'nmfstaticwebapp'
managedIdentities: {
systemAssigned: false
userAssignedResourceIds: []
}
}
}
```

#### Root cause and suggested fix
The `identity` property accepts only the following values: `'None' | 'SystemAssigned' | 'SystemAssigned, UserAssigned' | 'UserAssigned'` .

The bicep code in mentioned modules sets the type to `null` or `''` instead of None at the following section:
```bicep
var identity = !empty(managedIdentities)
? {
type: (managedIdentities.?systemAssigned ?? false)
? (!empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'SystemAssigned, UserAssigned' : 'SystemAssigned')
: (!empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'UserAssigned' : null)
userAssignedIdentities: !empty(formattedUserAssignedIdentities) ? formattedUserAssignedIdentities : null
}
: null
```

This can be adjusted to the below to resolve the bug (already implemented the same way in multiple templates, e.g. data-factory/factory).
```bicep
var identity = !empty(managedIdentities)
? {
type: (managedIdentities.?systemAssigned ?? false)
? (!empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'SystemAssigned, UserAssigned' : 'SystemAssigned')
: (!empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'UserAssigned' : 'None')
userAssignedIdentities: !empty(formattedUserAssignedIdentities) ? formattedUserAssignedIdentities : null
}
: null
```

#### Additional context
This is not a blocking issue because the desired result can be achieved by simply leaving the the managedIdentities parameter out of the deployment. This might lower the priority to fix it, but should happen regardless.

### (Optional) Correlation Id

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.