Azure / Azure/bicep

Execute local scripts as a part of bicep deployment

Open
#7,259 15 comments 5 reactions 0 assignees View on GitHub
enhancement Needs: Upvote
Dominant language
Bicep
Stars
3.6k
Forks
830
Avg merge
1d 2h
Merged PRs (30d)
79

Description

**Is your feature request related to a problem? Please describe.**
I would like to be able to execute scripts on the host triggering a deployment as a part of the deployment sequence. Complex deployments usually have some portions of infra that depends other infra + some data plant configuration, so some 'glue' scripts that interact with dataplanes or manipulate local data are required in order to facilitate the subsequent infrastructure steps.

While these steps *can* be facilitated by breaking Bicep into several stages, it requires creating multiple stages of Bicep templates with outputs (or key vault secrets), mapping those to variables in the shell scripts, and then running the shell scripts in between each Bicep stage -- that's a lot of boilerplate and fragmentation for consuming the data outputs that are immediately and readily available within the bicep templates.

Say you go ahead and do that, then you run into a bunch semi-related and frustrating issues like:
* #4917
* #1410
* #4023
* #387
* #2163
* #893

*Tangent: And even if you work around/solve all that, you might be tempted to use a common parameters file to ensure existing resources from prior stages can be referenced exactly without having to declare a parameter file for each bicep stage and risk making a typo - except that cannot be done because parameters must *exactly* match the bicep file - the parameters file cannot contain extraneous parameters that are not declared in a bicep file. So at this point you look [loading JSON](https://github.com/Azure/bicep/issues/893#issuecomment-905092149) but it seems insane to completely circumvent the native parameter functionality.*

Terraform handles this neatly with [local-exec](https://www.terraform.io/language/resources/provisioners/local-exec) to provide script execution inline with IaC declarations and to be able to consume available resource properties directly. Some use cases I've bumped into in the past that local-exec helped with:
* Calling external APIs using output from the deployed infra (e.g. often by pulling a connection string from a newly deployed resource).
* Similarly; if a solution is hosted in Azure but leverages some 3rd party services unmanaged by ARM, local-exec can bootstrap those resources managed externally by calling a CLI or HTTP API
* Generating PAT tokens in DataBricks after a cluster is deployed

**Describe the solution you'd like**
I'd like a resource type that executes a local script similar to local-exec:
* Executes a script or binary on the host running the deployment
* Resource dependencies are evaluated to kick off the script at the right time (i.e. I might want to run the script after deploying a new Key Vault, and pass an output like the new Key Vault's resource ID to the script)
* Other resources can depend on the local script resource, and will wait until it has executed

Contributor guide

Open the contributing guide

Research direction

The issue names no repository files, tests, or entry points. Start by reading the requested local-exec behavior and its dependency and output requirements; done means a supported resource can run a host script during deployment, consume resource outputs, and be depended on by later resources.

Written by the indexing model from the issue text.

Assessment

Tech stack
azure
Domain
cloud, infrastructure
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.