Azure / Azure/bicep-registry-modules
[AVM Module Issue]: var identity is constructed incorrectly on several templates
- Dominant language
- Bicep
- Stars
- 736
- Forks
- 564
- Avg merge
- 3d 15h
- Merged PRs (30d)
- 30
Description
### Check for previous/existing GitHub issues
- [x] I have checked for previous/existing GitHub issues
### Issue Type?
Bug
### Module Name
avm/res/web/static-site
### (Optional) Module Version
_No response_
### Description
The issue is opened for Static Web App because that is where I have noticed and tested it, but the same bug seems to exist in multiple templates:
- avm/res/app-configuration/configuration-store
- avm/res/compute/dis-encryption-set
- avm/res/document-db/database-account
- avm/res/machine-learning-services/workspace/compute
- avm/res/search/search-service
- avm/res/signal-r-service/signal-r
- avm/res/sql/managed-instance
- avm/res/sql/server
- avm/res/web/hosting-environment - ([Microsoft.Web/hostingEnvironments](https://learn.microsoft.com/en-us/azure/templates/microsoft.web/hostingenvironments?pivots=deployment-language-bicep) does not support the identity property, so should be removed I believe)
- avm/res/web/static-site
I would like to request the fix of all bugs in this request - hope that I do not need to open an issue for each module separately.
#### Describe the bug
When deploying the template with system-assigned managed identity explicitly set to false while not providing any user-assigned managed resource id, the deployment validation fails.
#### Error message
New-AzResourceGroupDeployment: 10:09:05 - Error: Code=InvalidTemplate; Message=Deployment template parse failed: 'Required property 'type' expects a value but got null. Path ''.'.
The search/search-service gives a different error:
New-AzResourceGroupDeployment: 10:09:05 - Error: Code=InvalidTemplate; Message=Deployment template parse failed: 'Error converting value "" to type 'Azure.Deployments.Core.Definitions.Resources.ResourceIdentityType'. Path 'type'.'.
#### To Reproduce
Create deployment invoking the module as below.
```bicep
module staticwebapp 'br/public:avm/res/web/static-site:0.8.2' = {
name: 'deploy-static-webapp'
params: {
name: 'nmfstaticwebapp'
managedIdentities: {
systemAssigned: false
userAssignedResourceIds: []
}
}
}
```
#### Root cause and suggested fix
The `identity` property accepts only the following values: `'None' | 'SystemAssigned' | 'SystemAssigned, UserAssigned' | 'UserAssigned'` .
The bicep code in mentioned modules sets the type to `null` or `''` instead of None at the following section:
```bicep
var identity = !empty(managedIdentities)
? {
type: (managedIdentities.?systemAssigned ?? false)
? (!empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'SystemAssigned, UserAssigned' : 'SystemAssigned')
: (!empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'UserAssigned' : null)
userAssignedIdentities: !empty(formattedUserAssignedIdentities) ? formattedUserAssignedIdentities : null
}
: null
```
This can be adjusted to the below to resolve the bug (already implemented the same way in multiple templates, e.g. data-factory/factory).
```bicep
var identity = !empty(managedIdentities)
? {
type: (managedIdentities.?systemAssigned ?? false)
? (!empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'SystemAssigned, UserAssigned' : 'SystemAssigned')
: (!empty(managedIdentities.?userAssignedResourceIds ?? {}) ? 'UserAssigned' : 'None')
userAssignedIdentities: !empty(formattedUserAssignedIdentities) ? formattedUserAssignedIdentities : null
}
: null
```
#### Additional context
This is not a blocking issue because the desired result can be achieved by simply leaving the the managedIdentities parameter out of the deployment. This might lower the priority to fix it, but should happen regardless.
### (Optional) Correlation Id
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.