Azure / Azure/bicep-types-az

[Microsoft.VirtualMachineImages/imageTemplates]: Lacking validation of `identity.type` field

Open
#2,007 2 comments 1 reaction 0 assignees View on GitHub
Compute - Images Service Attention
Dominant language
TypeScript
Stars
108
Forks
44
Avg merge
18h 53m
Merged PRs (30d)
29

Description

### Resource Type

Microsoft.VirtualMachineImages/imageTemplates

### Api Version

2023-07-01

### Issue Type

Resource fails to deploy

### Other Notes

When deploying image template for Azure VM Image Builder, one can provide an user-assigned identity, which is supposed to be used by the service. In Bicep, the identity is defined like so:
```
identity: {
type: 'UserAssigned'
userAssignedIdentities: {
'${uai.id}': {}
}
}
```
However, omitting the property `type` inside the definition causes a deployment to fail because of `InvalidTemplate` error:
```
{"code": "InvalidTemplate", "message": "Deployment template parse failed: 'Required property 'type' not found in JSON. Path '', line 43, position 19.'."}
```
While this issue is quite easy to fix when deploying to a resource group, when using the very same template, but deploying as module on e.g. subscription level, makes debugging much more difficult:
```
{"code": "InvalidTemplate", "target": "/subscriptions/.../resourceGroups/.../providers/Microsoft.Resources/deployments/it", "message": "Deployment template parse failed: 'Required property 'type' not found in JSON. Path '', line 1, position 1524.'."}
```
The `position` indicated by the error is nowhere related to the real position where error occurs.

To avoid such difficult to find & fix errors, Bicep should validate if the `identity.type` field exists and mark a resource definition as invalid if the field doesn't exist.

### Bicep Repro

```
param parName string
param parLocation string = resourceGroup().location
param parIdentityName string
param parLocationSuffix string = 'we'
param parImageName string
param runSuffix string = utcNow()
param parCustomizers array

resource it 'Microsoft.VirtualMachineImages/imageTemplates@2023-07-01' = {
name: 'it-${parName}-${parLocationSuffix}'
location: parLocation
identity: {
//type: 'UserAssigned'
userAssignedIdentities: {
'${uai.id}': {}
}
}
properties: {
distribute: [
{
location: parLocation
#disable-next-line use-resource-id-functions
imageId: '/subscriptions/${subscription().subscriptionId}/resourceGroups/${resourceGroup().name}/providers/Microsoft.Compute/images/${parImageName}'
runOutputName: '${parImageName}-${runSuffix}'
type: 'ManagedImage'
}
]
source: {
type: 'PlatformImage'
publisher: 'Canonical'
offer: '0001-com-ubuntu-server-jammy'
sku: '22_04-lts-gen2'
version: 'latest'
}
customize: parCustomizers
}
}

resource uai 'Microsoft.ManagedIdentity/userAssignedIdentities@2023-01-31' = {
name: 'uai-${parIdentityName}-${parLocationSuffix}'
location: parLocation
}
```

### Bicep params
```
using 'image-template.bicep'

param parName = 'somename'
param parLocation = 'westeurope'
param parIdentityName = 'it'
param parImageName = 'imagename'
param parCustomizers = [
{
type: 'Shell'
name: 'InstallUpgrades'
inline: [
'sudo apt install unattended-upgrades'
]
}
]

```

### Confirm

- [X] I have read the troubleshooting guide and looked for duplicates.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start from the Microsoft.VirtualMachineImages/imageTemplates type definition in this repository and reproduce the supplied Bicep example with identity.type omitted, including subscription-level module deployment. Trace whether the resource schema represents identity.type as required; done means the invalid resource definition is diagnosed and flagged before deployment, with coverage for the reported case.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure, typescript
Domain
cloud, tooling
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.