Conditionally use a param, or Null the entire object if nothing set

[fluffy-cakes]

I know I can nullify a parameter with a ternary condition if the evaluation is false; however it would be good to nullify the entire object if no other parameters are set.

As an example I would like to null the entire networkSecurityGroup object if no value was set in a parameter object passed to it. At the moment I can only do that if networkSecurityGroup: null

Bicep params passed in via module:

param p_vnetObject object = {
    name                 : 'asdf1'
    cidr                 : [
        '10.0.0.0/22'
    ]
    subnets              : [
        {
            name         : 'subnet1'
            addressPrefix: '10.0.0.0/24'
            nsgName      : 'myNsg'
        }
        {
            name         : 'subnet2'
            addressPrefix: '10.0.1.0/24'
            nsgName      : ''
        }
    ]
}

param p_nsg array                           = [
    {
        nsgName                             : 'myNsg'
        rules                               : [
            {
                name                        : 'rule1'
                properties                  : {
                    access                  : 'Allow'
                    destinationAddressPrefix: '*'
                    destinationPortRange    : '*'
                    direction               : 'Inbound'
                    priority                : 100
                    protocol                : '*'
                    sourceAddressPrefix     : '*'
                    sourcePortRange         : '*'
                }
            }
            {
                name                        : 'rule2'
                properties                  : {
                    access                  : 'Allow'
                    destinationAddressPrefix: '*'
                    destinationPortRange    : '*'
                    direction               : 'Outbound'
                    priority                : 110
                    protocol                : '*'
                    sourceAddressPrefix     : '*'
                    sourcePortRange         : '*'
                }
            }
        ]
    }
]

param p_nsg  array
param p_vnet object

resource vnet 'Microsoft.Network/virtualNetworks@2020-06-01' = {
    name                            : p_vnet.name
    location                        : resourceGroup().location
    properties                      : {
        addressSpace                : {
            addressPrefixes         : p_vnet.cidr
        }
        subnets                     : [for subitem in p_vnet.subnets: {
            name                    : subitem.name
            properties              : {
                addressPrefix       : subitem.addressPrefix
                networkSecurityGroup: {
                    id              : empty(subitem.nsgName) ? null : resourceId('Microsoft.Network/networkSecurityGroups', subitem.nsgName)
                }
            }
        }]
    }
    dependsOn                       : nsg
}

resource nsg 'Microsoft.Network/networkSecurityGroups@2020-06-01' = [for item in p_nsg: {
    name                                : item.nsgName
    location                            : resourceGroup().location
    properties                          : {
        securityRules                   : [for subitem in item.rules: {
            name                        : subitem.name
            properties                  : {
                access                  : subitem.properties.access
                destinationAddressPrefix: subitem.properties.destinationAddressPrefix
                destinationPortRange    : subitem.properties.destinationPortRange
                direction               : subitem.properties.direction
                priority                : subitem.properties.priority
                protocol                : subitem.properties.protocol
                sourceAddressPrefix     : subitem.properties.sourceAddressPrefix
                sourcePortRange         : subitem.properties.sourcePortRange
            }
        }]
    }
}]

Output error:

Deployment failed. Correlation ID: 6c732f8a-0d4f-4797-93a4-7f23f7f09acb. {
  "status": "Failed",
  "error": {
    "code": "ResourceDeploymentFailure",
    "message": "The resource operation completed with terminal provisioning state 'Failed'.",
    "details": [
      {
        "code": "DeploymentFailed",
        "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/DeployOperations for usage details.",
        "details": [
          {
            "code": "BadRequest",
            "message": "{\r\n  \"error\": {\r\n    \"code\": \"InvalidRequestFormat\",\r\n    \"message\": \"Cannot parse the request.\",\r\n    \"details\": [\r\n      {\r\n        \"code\": \"MissingJsonReferenceId\",\r\n        \"message\": \"Value for reference id is missing. Path properties.subnets[1].properties.networkSecurityGroup.\"\r\n      }\r\n    ]\r\n  }\r\n}"
          }
        ]
      }
    ]
  }
}

[fluffy-cakes]

Using: https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/template-functions-any

I have found that the following works, but it would be nice to null the entire object from a level below if nothing is used.

resource vnet 'Microsoft.Network/virtualNetworks@2020-06-01' = {
    name                            : p_vnet.name
    location                        : resourceGroup().location
    properties                      : {
        addressSpace                : {
            addressPrefixes         : p_vnet.cidr
        }
        subnets                     : [for subitem in p_vnet.subnets: {
            name                    : subitem.name
            properties              : {
                addressPrefix       : subitem.addressPrefix
                networkSecurityGroup: any((subitem.nsgName == '')) ? null : {
                    id: resourceId('Microsoft.Network/networkSecurityGroups', subitem.nsgName)
                }
            }
        }]
    }
    dependsOn                       : nsg
}

[brwilkinson]

Hi @fluffy-cakes

if you like you can build/deploy your RT and NSG separately, instead of defining it within the VNET. That allows for different deployment lifecycles. i.e. deploy just a change to the RT without having to deploy a VNET.

If that is something you want to look into, you can start by defining your NSG and RT above as standalone resources in the VNET template, then just reference the ID from those resources within the VNET definition. That should simplify things quite a bit.

just create these resources separately

• https://docs.microsoft.com/en-us/azure/templates/microsoft.network/routetables?tabs=bicep
• https://docs.microsoft.com/en-us/azure/templates/microsoft.network/networksecuritygroups?tabs=bicep

you can use the same inputs, so the data structure stays the same.

[brwilkinson]

Hi @fluffy-cakes it looks like you came up with a solution, would you be able to provide a small repro of what you want to null ?

[fluffy-cakes]

Belated reply

resource vnet 'Microsoft.Network/virtualNetworks@2020-06-01' = {
  name                            : p_vnet.name
  location                        : resourceGroup().location
  properties                      : {
      addressSpace                : {
          addressPrefixes         : p_vnet.cidr
      }
      subnets                     : [for subitem in p_vnet.subnets: {
          name                    : subitem.name
          properties              : {
              addressPrefix       : subitem.addressPrefix
              networkSecurityGroup: {
                  id: any((subitem.nsgName == '')) ? null : resourceId('Microsoft.Network/networkSecurityGroups', subitem.nsgName)
              }
          }
      }]
  }
  dependsOn                       : nsg
}

this should be possible instead of having to do it on the networkSecurityGroup key. from whence i was testing, it would crap out saying that no params are supplied for networkSecurityGroup

[fluffy-cakes]

thus if id is not supplied, then the whole object is null'd

[brwilkinson]

Oh I see, yes that makes sense, you nearly have it there, you just need to move your check outside of the object.

    subnets: [for (sn,index) in SubnetInfo: {
      name: sn.name
      properties: {
        addressPrefix: '${((sn.name == 'snMT02') ? networkIdUpper : networkId)}.${sn.Prefix}'
        networkSecurityGroup: ! (contains(sn, 'NSG') && (sn.NSG == 1)) ? null : /*
        */  {
              id: NSG[index].id
            }
        natGateway: ! (contains(sn, 'NGW') && (sn.NGW == 1)) ? null : /*
        */  {
              id: resourceId('Microsoft.Network/natGateways','${Deployment}-ngwNAT01')
            }
        routeTable: contains(sn, 'Route') && (sn.Route == 1) ? RouteTableGlobal : null
        privateEndpointNetworkPolicies: 'Disabled'
        delegations: contains(sn, 'delegations') ? delegations[sn.delegations] : delegations.default
      }
    }] 

Check out this full example here:
https://github.com/brwilkinson/AzureDeploymentFramework/blob/60c512e796c9af223e1424eff85743de84d71eda/ADF/bicep/VNET.bicep#L124

Note I am just using the comments (for formatting) to split onto a new line, since Bicep is new line sensitive.