Azure / Azure/bicep-registry-modules

[AVM Module Issue]: ApiManagement service-scope and api-scope policies should depend on NamedValues

Open
#7,198 5 comments 0 reactions 1 assignee Assigned to @abhishekaryams View on GitHub
Class: Resource Module :package: Needs: Triage :mag: Status: Response Overdue :triangular_flag_on_post: Type: AVM :a: :v: :m: Type: Bug :bug:
Dominant language
Bicep
Stars
737
Forks
564
Avg merge
3d 15h
Merged PRs (30d)
30

Description

### Check for previous/existing GitHub issues

- [x] I have checked for previous/existing GitHub issues

### Issue Type?

Bug

### Module Name

avm/res/api-management/service

### (Optional) Module Version

0.14.4

### Description

When a service-scope policy (the `policies` param) or an API-scope policy (`apis[].policies`) references an APIM named value via a `{{token}}`, deployment intermittently fails because the policy module is applied in parallel with - and can win the race against - the `named-value` module. APIM validates `{{token}}` references at policy-apply time, so if the named value doesn't exist yet the RP returns:
```
ValidationError: Cannot find a property 'rl-global-limit'
Target: rate-limit-by-key
```

**Root cause**
In `main.bicep`,  module service_policies 'policy/main.bicep'  has no `dependsOn`:
```bicep
module service_policies 'policy/main.bicep' = [
for (policy, index) in (policies ?? []): {
name: '${uniqueString(deployment().name, location)}-Apim-Pol-${index}' // -Apim-Policy-${index} in 0.12.0
params: { apiManagementServiceName: service.name, value: policy.value, format: policy.?format, ... }
// <-- missing: dependsOn: [ service_namedValues ]
}
]
```
There is already a precedent in the same module - `service_loggers` correctly declares the dependency:
```bicep
module service_loggers 'logger/main.bicep' = [ for ... : {
...
dependsOn: [ service_namedValues ]
} ]
```
**Expected behavior**
Any policy that can reference `{{named-value}}` tokens should be deployed after all named values.

**Proposed fix**

1. Add `dependsOn: [ service_namedValues ]` to `service_policies`.
2. Add `service_namedValues` to `service_apis`'s `dependsOn`.

**Repro**
Deploy the module with one named value and a service-scope policy that references it:
```bicep
namedValues: [ { name: 'rl-global-limit', displayName: 'rl-global-limit', value: '1000' } ]
policies: [ { format: 'xml', value: '...' } ]
```

### (Optional) Correlation Id

e44b4f7f-56fd-4998-a9da-63aab8e083c1

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.