Azure / Azure/deployment-stacks

Documentation is incorrect on how to pass "-DenySettingsExcludedAction" and "-DenySettingsExludedPrincipals" in Powershell

Open
#167 4 comments 0 reactions 1 assignee Claimed by @mumian View on GitHub
documentation
Dominant language
Bicep
Stars
101
Forks
13
PR merge metrics
No merged PRs in 30d

Description

**Describe the bug**
In the following example from the documentation, the `DenySettingsExcludedAction` is passed as a string with spaces as an action separator

```powershell
New-AzResourceGroupDeploymentStack -Name "" -ResourceGroupName "" -TemplateFile "" -ActionOnUnmanage "detachAll" -DenySettingsMode "denyDelete" -DenySettingsExcludedAction "Microsoft.Compute/virtualMachines/write Microsoft.StorageAccounts/delete" -DenySettingsExcludedPrincipal ","
```

However, when re-running the command by replacing `New-AzResourceGroupDeploymentStack` with `Set-AzResourceGroupDeploymentStack`, the deployment will fail with `Error: Code=DeploymentStackDenyAssignmentFailure; Message=The deny assignment of one or more resources could not be added or removed.`

When re-running the command by passing something like:

```powershell
Set-AzResourceGroupDeploymentStack -Name "" -ResourceGroupName "" -TemplateFile "" -ActionOnUnmanage "detachAll" -DenySettingsMode "denyDelete" -DenySettingsExcludedAction "Microsoft.Compute/virtualMachines/write Microsoft.StorageAccounts/delete".Split(" ") -DenySettingsExcludedPrincipal ","
```

The command will succeed, showing that `DenySettingsExcludedAction` actually expects a String[] and not a string separated by spaces

**To Reproduce**
Steps to reproduce the behavior:
1. Run the command from the documentation to create a stack with `DenySettingsExcludedAction` set for 2 different actions
2. Wait until the stack state is "success"
3. Rerun the same command with `Set-AzResourceGroupDeploymentStack` instead
4. Stack state fails with `error: 'action1 action2' does not match any of the actions supported by the providers.` on each resource in the stack

**Expected behavior**
The `New-AzResourceGroupDeploymentStack` and `Set-AzResourceGroupDeploymentStack` return an error during parameter validation if `-DenySettingsExcludedAction` is not a string array

**Repro Environment**
Host OS: Linux
Powershell Version: 7.4.2

**Server Debugging Information**
Correlation ID: 8a765b50-5790-4f84-a481-3d00190fb109
Tenant ID: f661a5c5-d1f9-4034-950d-39a1392e8c24
Timestamp of issue (please include time zone): 2024-06-14T07:53:24.8940941Z UTC
Data Center (eg, West Central US, West Europe): West Europe

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.