PSRule.Rules.Azure/using-bicep/

[giscus[bot]]

PSRule.Rules.Azure/using-bicep/

Ready to go validation and governance controls for Azure Infrastructure as Code (IaC).

https://azure.github.io/PSRule.Rules.Azure/using-bicep/

[kschinspari]

Hello and thanks for this very interesting project.

I cant find an example of bicepconfig.json - could you direct me to one?

[BernieWhite]

@kschinspari Thanks for your question. You can find details around the bicepconfig.json file over here: https://learn.microsoft.com/azure/azure-resource-manager/bicep/bicep-config as this is a file specific to Bicep.

An example might look like this:

{
  "moduleAliases": {
    "br": {
      "prod": {
        "registry": "myregistry.azurecr.io",
        "modulePath": "private/bicep/modules/prod"
      },
      "dev": {
        "registry": "myregistry.azurecr.io",
        "modulePath": "private/bicep/modules/dev"
      }
    }
  },
  "cloud": {
    "currentProfile": "AzureCloud",
    "credentialPrecedence": ["Environment", "AzureCLI", "AzurePowerShell"]
  },
  "analyzers": {
    "core": {
      "enabled": true,
      "rules": {
        "explicit-values-for-loc-params": {
          "level": "off"
        }
      }
    }
  }
}

[dkaubar]

how can modules with object property as input be mocked/configured?
Example:

resource keyVaultKey ... existing = {}

module moduleName 'module.bicep' = {
  name: 'moduleName'
  params: {
    keyName: BYOKKeyVaultKeyName
    keyVersion: last(split(keyVaultKey.properties.keyUriWithVersion, '/'))
  }
}

getting an error:
Unable to expand resources because the source file 'template.bicep' was not valid. ... Index was outside the bounds of the array.
which makes sense since it tries to split and take a value of null
is there a way to resolve this?

[BernieWhite]

@dkaubar Runtime properties such as keyUriWithVersion can be tricky, in the past we've tried to bug fix cases as they come up. For the sake of a mock you could provide a constant since it is probably not super important that you provide a real value.

Alternatively you could look at AZURE_PARAMETER_DEFAULTS which does something similar.

But really we should just raise this as a bug and get a fix.

[dkaubar]

can you point me to an example of how constants can be defined?
I only tried setting AZURE_PARAMETER_DEFAULTS and that did not work. I suspect it's because the error is not in the input value itself but rather in trying to parse a value that does not exist

[BernieWhite]

@dkaubar You can do something like:

module moduleName 'module.bicep' = {
  name: 'moduleName'
  params: {
    keyName: BYOKKeyVaultKeyName
    keyVersion: 'version-for-test'
  }
}

[BernieWhite]

Also I logged bug #1830 for this issue. It should be fixed in v1.21.2.

[ryancolley]

Hi Bernie, thanks for the awesome work here :)

Is there a more firm ETA as to when support for .bicepparam files goes stable?
I can see its pulled in here:
Azure/bicep#8082

We have been eagerly testing .bicepparam files and wish to refactor our module library to modernise and optimise, with a view to implementing PSRule across the board in our organisation.

Kind regards

[BernieWhite]

@ryancolley Thanks for the feedback.

Getting it across the line for v1.34.0 should be possible, so I'd tentatively suggest a stable release late February to early March.

There isn't any expected major changes to the behaviour except we intend to turning it on by default by flipping AZURE_BICEP_PARAMS_FILE_EXPANSION to default to true instead of the current default of false.

Feel free to use it by setting AZURE_BICEP_PARAMS_FILE_EXPANSION to true on the current release.

Post release, you could either keep as is or inherit the default AZURE_BICEP_PARAMS_FILE_EXPANSION value.

[ryancolley]

Amazing, thanks so much Bernie!