Azure / Azure/deployment-stacks
Documentation is incorrect on how to pass "-DenySettingsExcludedAction" and "-DenySettingsExludedPrincipals" in Powershell
- Dominant language
- Bicep
- Stars
- 101
- Forks
- 13
- PR merge metrics
- No merged PRs in 30d
Description
**Describe the bug**
In the following example from the documentation, the `DenySettingsExcludedAction` is passed as a string with spaces as an action separator
```powershell
New-AzResourceGroupDeploymentStack -Name "" -ResourceGroupName "" -TemplateFile "" -ActionOnUnmanage "detachAll" -DenySettingsMode "denyDelete" -DenySettingsExcludedAction "Microsoft.Compute/virtualMachines/write Microsoft.StorageAccounts/delete" -DenySettingsExcludedPrincipal ","
```
However, when re-running the command by replacing `New-AzResourceGroupDeploymentStack` with `Set-AzResourceGroupDeploymentStack`, the deployment will fail with `Error: Code=DeploymentStackDenyAssignmentFailure; Message=The deny assignment of one or more resources could not be added or removed.`
When re-running the command by passing something like:
```powershell
Set-AzResourceGroupDeploymentStack -Name "" -ResourceGroupName "" -TemplateFile "" -ActionOnUnmanage "detachAll" -DenySettingsMode "denyDelete" -DenySettingsExcludedAction "Microsoft.Compute/virtualMachines/write Microsoft.StorageAccounts/delete".Split(" ") -DenySettingsExcludedPrincipal ","
```
The command will succeed, showing that `DenySettingsExcludedAction` actually expects a String[] and not a string separated by spaces
**To Reproduce**
Steps to reproduce the behavior:
1. Run the command from the documentation to create a stack with `DenySettingsExcludedAction` set for 2 different actions
2. Wait until the stack state is "success"
3. Rerun the same command with `Set-AzResourceGroupDeploymentStack` instead
4. Stack state fails with `error: 'action1 action2' does not match any of the actions supported by the providers.` on each resource in the stack
**Expected behavior**
The `New-AzResourceGroupDeploymentStack` and `Set-AzResourceGroupDeploymentStack` return an error during parameter validation if `-DenySettingsExcludedAction` is not a string array
**Repro Environment**
Host OS: Linux
Powershell Version: 7.4.2
**Server Debugging Information**
Correlation ID: 8a765b50-5790-4f84-a481-3d00190fb109
Tenant ID: f661a5c5-d1f9-4034-950d-39a1392e8c24
Timestamp of issue (please include time zone): 2024-06-14T07:53:24.8940941Z UTC
Data Center (eg, West Central US, West Europe): West Europe
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.