@onlyIfNotExists() blocks immutability policy deployments in storage accounts
- Dominant language
- Bicep
- Stars
- 3.6k
- Forks
- 830
- Avg merge
- 1d 21m
- Merged PRs (30d)
- 79
Description
**Bicep version**
0.38.33
**Describe the bug**
When deploying the following code:
```bicep
resource symbolicname 'Microsoft.Storage/storageAccounts@2025-06-01' = {
name: 'string'
// Remaining properties removed for brevity
}
resource symbolicname 'Microsoft.Storage/storageAccounts/blobServices@2025-06-01' = {
parent: resourceSymbolicName
name: 'default'
// Remaining properties removed for brevity
}
resource symbolicname 'Microsoft.Storage/storageAccounts/blobServices/containers@2025-06-01' = {
parent: resourceSymbolicName
name: 'string'
// Remaining properties removed for brevity
}
@onlyIfNotExists()
resource symbolicname 'Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies@2025-06-01' = {
parent: resourceSymbolicName
name: 'default'
properties: {
allowProtectedAppendWrites: bool
allowProtectedAppendWritesAll: bool
immutabilityPeriodSinceCreationInDays: int
}
}
```
I expected the immutability policy to be deployed as there were no pre-existing immutability polices within the storage account. However, no policy was deployed. Removing the decorator leads to a successful deployment.
**To Reproduce**
Steps to reproduce the behavior:
1. Create a storage account with a blob container
2. Update the bicep code above to target your blob container.
3. Deploy, and observe that no immutability policy exists on the container by clicking on the container and then going to "Access policy".
4. Remove the decorator and redeploy. Observe that the policy has now been created
**Additional context**
@onlyIfNotExists() would be an excellent use case for immutability policies, as once a policy has been locked through a manual step in the azure portal, further bicep deployments fail even if they have the same resource properties as exists.
Contributor guide
Research direction
Start by reproducing the deployment with the provided nested storageAccounts/blobServices/containers/immutabilityPolicies resources, comparing behavior with and without @onlyIfNotExists(). Trace the handling of @onlyIfNotExists() for this nested resource type; done means an absent immutability policy is created while an existing policy, including a manually locked one, is not redeployed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure
- Domain
- cloud, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100