Azure / Azure/bicep

Errors in nested modules

Open
#2,760 0 comments 1 reaction 0 assignees View on GitHub
enhancement error-message intermediate language
Dominant language
Bicep
Stars
3.6k
Forks
830
Avg merge
1d 21m
Merged PRs (30d)
79

Description

**Is your feature request related to a problem? Please describe.**
When errors occur in a sub module, the error message from ARM can become pretty hard to read - you can easily get a response with a single line string of over 1000 characters, of which the error you care about is burried somewhere in the middle. This can be particularly bad if errors occur several layers deep

Whilst this issue seems to be with nested deployments rather than bicep specifically, bicep's encouraging of modules makes this much more likely to be encountered

```json
"details": [
{
"code": "DeploymentFailed",
"message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
"details": [
{
"code": "Conflict",
"message": "{\r\n \"status\": \"Failed\",\r\n \"error\": {\r\n \"code\": \"ResourceDeploymentFailure\",\r\n \"message\": \"The resource operation completed with terminal provisioning state 'Failed'.\",\r\n \"details\": [\r\n {\r\n \"code\": \"DeploymentFailed\",\r\n \"message\": \"At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.\",\r\n \"details\": [\r\n {\r\n \"code\": \"Forbidden\",\r\n \"message\": \"{\\r\\n \\\"error\\\": {\\r\\n \\\"code\\\": \\\"LinkedAuthorizationFailed\\\",\\r\\n \\\"message\\\": \\\"The client 'REDACTED' with object id 'REDACTED' has permission to perform action 'Microsoft.DocumentDB/databaseAccounts/write' on scope 'REDACTED'; however, it does not have permission to perform action 'joinViaServiceEndpoint/action' on the linked scope(s) 'REDACTED' or the linked scope(s) are invalid.\\\"\\r\\n }\\r\\n}\"\r\n }\r\n ]\r\n }\r\n ]\r\n }\r\n}"
}
]
}
```

**Describe the solution you'd like**

As an example, here is the earlier as an object rather than a string - whilst still overly verbose, it is at least significantly more readable than the original:

```json
"details": [
{
"code": "DeploymentFailed",
"message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
"details": [
{
"code": "Conflict",
"message": {
"status": "Failed",
"error": {
"code": "ResourceDeploymentFailure",
"message": "The resource operation completed with terminal provisioning state 'Failed'.",
"details": [
{
"code": "DeploymentFailed",
"message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
"details": [
{
"code": "Forbidden",
"message": {
"error": {
"code": "LinkedAuthorizationFailed",
"message": "The client 'c703cecf-dbc6-4a43-95fe-d01c542d811e' with object id 'c703cecf-dbc6-4a43-95fe-d01c542d811e' has permission to perform action 'Microsoft.DocumentDB/databaseAccounts/write' on scope 'REDACTED'; however, it does not have permission to perform action 'joinViaServiceEndpoint/action' on the linked scope(s) 'REDACTED' or the linked scope(s) are invalid."
}
}
}
]
}
]
}
}
}
]
}
```

Although even then, there's a lot of cruft there - there are 4 layers of error messages (as the module that fails was 4 deep), but frankly the outer errors are just echoing that one of the inner modules failed. If this example only had the inner most error, I'm not sure there has been any loss of useful information.

```json
"details": [
{
"code": "LinkedAuthorizationFailed",
"message": "The client 'REDACTED' with object id 'REDACTED' has permission to perform action 'Microsoft.DocumentDB/databaseAccounts/write' on scope 'REDACTED'; however, it does not have permission to perform action 'joinViaServiceEndpoint/action' on the linked scope(s) 'REDACTED' or the linked scope(s) are invalid."
}
]
```

A nice bonus as well would be if the error could include the module name it came from. Line numbers would be even better.

Contributor guide

Open the contributing guide

Research direction

No repository files, tests, or entry points are named in the issue; start by tracing the Azure ARM nested-deployment error response represented in the examples. Done means defining and implementing an agreed representation that avoids redundant wrapper errors, with module names and line numbers treated as optional follow-up requirements.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.