Problem with If, and getSecret function

[PoborcaMaciej]

Hello,

I have a problem with implementing tests for Bicep where I am using if conditions together with getSecret function. Do you know how I can solve it or if it is something that is not possible to omit?

Example of code that generates error

Exception calling "GetBicepResources" with "3" argument(s): "Unable to expand resources because the source file 'd:\agents\agent_work\24\s/tests/environments/test.bicep' was not valid. The template parameter 'test' does not use the required format."

[github-actions[bot]]

Thanks for raising your first issue, the team appreciates the time you have taken 😉

[BernieWhite]

@PoborcaMaciej Thanks for raising the issue.

It may depend on what your goal is with the condition that either returning a secret or I assume a dummy value.

If you goal is to provide a test with a dummy value because you don't want to expose a secret in code then you shouldn't need to add the condition, you can just reference kv.getSecret() as you normally would where kv is an existing reference. For example:

// ----------
// REFERENCES
// ----------

resource kv 'Microsoft.KeyVault/vaults@2021-06-01-preview' existing = {
  name: 'kv-001'
}

resource ag 'Microsoft.Insights/actionGroups@2021-09-01' existing = {
  name: 'ag-001'
}

resource vnet 'Microsoft.Network/virtualNetworks@2021-05-01' existing = {
  name: 'vnet-001'
}

resource subnet 'Microsoft.Network/virtualNetworks/subnets@2021-05-01' existing = {
  parent: vnet
  name: 'subnet-001'
}

// ---------
// RESOURCES
// ---------

// Test a basic VM
module test_vm_with_no_disks '../main.bicep' = {
  name: 'test_vm_with_no_disks'
  params: {
    name: 'vm001'
    adminUsername: kv.getSecret('vm-username')
    adminPassword: kv.getSecret('vm-password')
    subnetId: subnet.id
    size: 'Standard_D2s_v3'
    imageSKU: '2019-Datacenter-Core'
    actionGroupId: ag.id
  }
}

PSRule for Azure will automatically use a placeholder value during expansion.

---

Since this is more a question, I'm going to move it to discussion so that it might help someone else in the community out.

I hope that helps.

[PoborcaMaciej]

Hi @BernieWhite,

The case is as follows:

We have a template that is run two times. Before executing scripts and after that. The value of the secret is generated during script execution, that's why during first deployment bicep validation gives us error. When second deployment is done - when variable PostDeployment is equal to true - then, secret from value should be read.

Maybe there is some other workaround from bicep perspective but still I cannot find it :(

[BernieWhite]

@PoborcaMaciej Ok thanks for the additional context.

My understanding of your scenario is:

• Deploying a resource, first with a placeholder value.
• Running a script to set a secret in a key vault.
• Updating the resource a providing the secret set in the key vault.

Is this correct?

Some generally approaches would be to set the secret before, or generate it and set using a deployment script.

---

Assuming my understanding is correct, this looks like a bug so I have raised the issue over on the PSRule for Azure repository. You can track it over here: Azure/PSRule.Rules.Azure#2054

As a workaround I would consider duplicating the module deployment and adding an if condition. For example:

module test_beforedeploy '../modules/test.bicep' = if (before) {
  name: 'test_beforedeploy'
  params: {
    dadada: 'placeholder'
  }
}

module test_afterdeploy '../modules/test.bicep' = if (!before) {
  name: 'test_afterdeploy'
  params: {
    dadada: kv.getSecret('name')
  }
}

---

Separately, know that PSRule for Azure will fail some rules (although you shouldn't get an exception). This is because passing a secure value into a non-secure parameter or passing a non-secure value into a secure parameter is generally detected as a security issue. However this can be suppressed for your use case.

---

I hope that helps.

[PoborcaMaciej]

Exactly that the case. Unfortunately, any of the workaround works due to the limitations that we have :(

Thanks for raising a bug.

[BernieWhite]

@PoborcaMaciej Hmm it's not as easy to reproduce as I thought. I have the following code below which is not generating the issue you have described. Using PSRule v2.7.0, PSRule for Azure v1.24.2, and Bicep 0.14.85.

Are you able to provide the version of PSRule, PSRule for Azure, and Bicep you are using?

Also are you able to provide a sample of the parent/ child bicep files being called so I can repo the issue.

param prefix string = 'super'
param deployed bool = true

resource vault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
  name: 'vault1'
}

module withSecret 'Tests.Bicep.17.child.bicep' = {
  name: 'withSecret'
  params: {
    name: '1'
    secret: deployed ? vault.getSecret('${prefix}secret1') : 'placeholder'
  }
}

module withPlaceholder 'Tests.Bicep.17.child.bicep' = {
  name: 'withPlaceholder'
  params: {
    name: '2'
    secret: !deployed ? vault.getSecret('${prefix}secret1') : 'placeholder'
  }
}