Azure / Azure/bicep

@onlyIfNotExists() blocks immutability policy deployments in storage accounts

Open
#18,508 3 comments 0 reactions 0 assignees View on GitHub
OnlyifNotExists
Dominant language
Bicep
Stars
3.6k
Forks
830
Avg merge
1d 21m
Merged PRs (30d)
79

Description

**Bicep version**
0.38.33

**Describe the bug**
When deploying the following code:

```bicep
resource symbolicname 'Microsoft.Storage/storageAccounts@2025-06-01' = {
name: 'string'
// Remaining properties removed for brevity
}

resource symbolicname 'Microsoft.Storage/storageAccounts/blobServices@2025-06-01' = {
parent: resourceSymbolicName
name: 'default'
// Remaining properties removed for brevity
}

resource symbolicname 'Microsoft.Storage/storageAccounts/blobServices/containers@2025-06-01' = {
parent: resourceSymbolicName
name: 'string'
// Remaining properties removed for brevity
}

@onlyIfNotExists()
resource symbolicname 'Microsoft.Storage/storageAccounts/blobServices/containers/immutabilityPolicies@2025-06-01' = {
parent: resourceSymbolicName
name: 'default'
properties: {
allowProtectedAppendWrites: bool
allowProtectedAppendWritesAll: bool
immutabilityPeriodSinceCreationInDays: int
}
}
```

I expected the immutability policy to be deployed as there were no pre-existing immutability polices within the storage account. However, no policy was deployed. Removing the decorator leads to a successful deployment.

**To Reproduce**
Steps to reproduce the behavior:
1. Create a storage account with a blob container
2. Update the bicep code above to target your blob container.
3. Deploy, and observe that no immutability policy exists on the container by clicking on the container and then going to "Access policy".
4. Remove the decorator and redeploy. Observe that the policy has now been created

**Additional context**
@onlyIfNotExists() would be an excellent use case for immutability policies, as once a policy has been locked through a manual step in the azure portal, further bicep deployments fail even if they have the same resource properties as exists.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the deployment with the provided nested storageAccounts/blobServices/containers/immutabilityPolicies resources, comparing behavior with and without @onlyIfNotExists(). Trace the handling of @onlyIfNotExists() for this nested resource type; done means an absent immutability policy is created while an existing policy, including a manually locked one, is not redeployed.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.