Repository: Azure/bicep

Issue #8669: bicep should throw when nesting runtime functions
Created: 2022-10-14T22:31:32Z
Bicep makes a little easier to nest runtime functions now that they can be used in variables.  So when we warn that a symbolic reference cannot be used somewhere, moving to a variable is a natural step to try - though it won't ever "fix" the problem, it just means it doesn't get flagged until preflight.
Since we compile this scenario, we should probably flag it...
The scenario below is another way to run into it - by simply using existing resources and trying to create a result.
param pepname string
param pepRG string
param vnetRG string

resource pep 'Microsoft.Network/privateEndpoints@2022-05-01' existing = {
  name: pepname
  scope: resourceGroup(pepRG)
}

var splitResourceId= split(pep.properties.subnet.id, '/')

resource vnet 'Microsoft.Network/virtualNetworks@2022-05-01' existing = {
  name: splitResourceId[8]   // this may be part of the issue, since it's not allowed on new resources but it is here, so easier to fall into
  scope: resourceGroup(vnetRG)
}

output subnetId string = pep.properties.subnet.id
output vnet array = vnet.properties.virtualNetworkPeerings // when we compile this we should throw

Duplicate issue #8144: Using `reference` of `existing` resource property not expected by Bicep
Created: 2022-08-26T20:51:24Z
Bicep version
Bicep CLI version 0.9.1 (a2950a1)
Describe the bug
For CARML I'm currently working on converting our 'JSON Parameter File'-based testing to a pure 'Bicep'-based testing format (ref) - similar to the approach of the Public Bicep Registry.
For one module, the Virtual Machine, I'm trying to generate and store an SSH key (in a SSH Key resource) as a dependency for the later Linux VM test deployment. This all works nice using a nested 'dependencies.bicep' module with the following code:
(...)

resource managedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2018-11-30' = {
  name: managedIdentityName
  location: location
}

resource sshDeploymentScript 'Microsoft.Resources/deploymentScripts@2020-10-01' = {
  name: sshDeploymentScriptName
  location: location
  kind: 'AzurePowerShell'
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '${managedIdentity.id}': {}
    }
  }
  properties: {
    azPowerShellVersion: '3.0'
    retentionInterval: 'P1D'
    scriptContent: '''
      ssh-keygen -f generated -N (Get-Random -Maximum 99999)

      $DeploymentScriptOutputs = @{
        # privateKey = cat generated | Out-String
        publicKey = cat 'generated.pub'
      }
    '''
  }
}

resource sshKey 'Microsoft.Compute/sshPublicKeys@2022-03-01' = {
  name: sshKeyName
  location: location
  properties: {
    publicKey: sshDeploymentScript.properties.outputs.publicKey
  }
}

@description('The resource ID of the created SSH Key')
output SSHKeyResourceID string = sshKey.id
However, when I want to reference set SSH key in the parent deployment file like
module resourceGroupResources 'dependencies.bicep' = {
// (...)
}

resource sshKey 'Microsoft.Compute/sshPublicKeys@2022-03-01' existing = {
  name: last(split(resourceGroupResources.outputs.SSHKeyResourceID, '/'))
  scope: az.resourceGroup(split(resourceGroupResources.outputs.SSHKeyResourceID, '/')[2], split(resourceGroupResources.outputs.SSHKeyResourceID, '/')[4])
}

module testDeployment '../../deploy.bicep' = {
  scope: resourceGroup
  name: '${uniqueString(deployment().name)}-test-${serviceShort}'
  params: {
    name: '<<namePrefix>>${serviceShort}'
    adminUsername: 'localAdminUser'
    /// (...)
    publicKeys: [
      {
        // Does work
        //keyData: 'ssh-rsa AAAAB3NzaC1yc2EAAAAD...'
        // Not working, but should
        keyData: sshKey.properties.publicKey
        path: '/home/localAdminUser/.ssh/authorized_keys'
      }
    ]
  }
}
I immediatly get the error that keyData: sshKey.properties.publicKey is a no no. The exact error message is:

WARNING: Deployment template validation failed: 'The template resource 'yecqlb5ybknve-test-cvmlinmin' at line '196' and column '9' is not valid: The template function 'reference' is not expected at this location. Please see https://aka.ms/arm-template-expressions for usage details.. Please see https://aka.ms/arm-template-expressions for usage details.'.

I test deployed the dependencies independently and they were created as expected. It only is a problem when I try to reference the Key from the existing resource.
From the documentation I was unable to find a reason to why this would be an incorrect usage of a resource reference. There are workarounds available like storing the Key as a secret in a Key Vault (which however would require additional dependencies to be deployed and permissions to be set) or returning it as a module output (which would mean it's in plain text in the deployment which I try to avoid - even though I don't consider Public Keys very sensitive, but others do).
Any help to get this working would be much appreciated.
To Reproduce
You can test this by running a Test-AzDeployment for this template.
Additional context
Add any other context about the problem here.

Closing comment (2022-11-08T01:00:38Z): Closing as a dup of #8669.