Error handling

[romanrabodzei]

Hi all,

The question is not new, but the proposed solutions are not what I'm looking for.
3 Ways To Check If Resource Exists In Azure Bicep

The goal is to check if the resource exists or not.

The code:

resource functapp 'Microsoft.Web/sites@2022-09-01' existing = {
  name: 'my-func-app'
  location: 'eastus'
}
output resourceExists bool = !empty(functapp)

The output (expected):

{
    "status": "Failed",
    "error": {
        "code": "DeploymentFailed",
        "target": "/subscriptions/***/providers/Microsoft.Resources/deployments/test-deployment",
        "message": "At least one resource deployment operation failed. Please list deployment operations for details. Please see https://aka.ms/arm-deployment-operations for usage details.",
        "details": [
            {
                "code": "ResourceNotFound",
                "message": "The Resource 'Microsoft.Web/sites/my-func-app' under resource group 'my-func-app-rg' was not found. For more details please go to https://aka.ms/ARMResourceNotFoundFix"
            }
        ]
    }
}

With the existing resource:

resource functapp 'Microsoft.Web/sites@2022-09-01' existing = {
  name: 'my-func-app-1'
  location: 'eastus'
}
output resourceExists bool = !empty(functapp)

The output says it does exist.

{
    "id": "/subscriptions/***/resourceGroups/my-func-app-rg/providers/Microsoft.Resources/deployments/test-deployment",
    "location": null,
    "name": "test-deployment",
    "properties": {
        "correlationId": "a635afd6-3adb-4e3d-83f6-130eed90c8fc",
        "debugSetting": null,
        "dependencies": [],
        "duration": "PT3.0432144S",
        "error": null,
        "mode": "Incremental",
        "onErrorDeployment": null,
        "outputResources": [],
        "outputs": {
            "resourceExists": {
                "type": "Bool",
                "value": true
            }
        },
        "parameters": null,
        "parametersLink": null,
        "providers": [],
        "provisioningState": "Succeeded",
        "templateHash": "1967264159388997261",
        "templateLink": null,
        "timestamp": "2023-10-24T08:10:06.570000+00:00",
        "validatedResources": null
    },
    "resourceGroup": "my-func-app-rg",
    "tags": null,
    "type": "Microsoft.Resources/deployments"
}

I know it is possible in Terraform. Looking for something that will work like in Powershel with -errorAction SilentlyContinue

[johnlokerse]

I don't think there is a way to handle it natively with Bicep due to idempotency, but there is a workaround. You can take a look at deployment scripts. By using deployment scripts you can run PowerShell and query a resource via de Azure PowerShell cmdlets.

I have a snippet for you that you can use for testing:

resource resManagedIdentity 'Microsoft.ManagedIdentity/userAssignedIdentities@2022-01-31-preview' = {
  name: 'my-managed-identity'
  location: parLocation
}

resource resDeploymentScript 'Microsoft.Resources/deploymentScripts@2020-10-01' = {
  name: 'check-if-resource-exists'
  location: parLocation
  kind: 'AzurePowerShell'
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '${resManagedIdentity.id}' : {}
    }
  }
  properties: {
    azPowerShellVersion: '9.0'
    retentionInterval: 'P1D'
    scriptContent: '''
      $resourceExists = // Do your check here using Azure PowerShell cmdlets!
      $DeploymentScriptOutputs = @{}
      $DeploymentScriptOutputs['resourceExists'] = $resourceExists
    '''
  }
}

output outExists bool = resDeploymentScript.properties.outputs.resourceExists

[romanrabodzei]

Yup, I know that the deployment script can solve that. I used them before, but as I said, I'd like to avoid that for a couple of reasons:

1. Avoid the creation of new resources in Azure that aren't documented (proved that they are required for a solution, in other words), or I'll be struggling with architects.
2. The deployment script does require to have reader permissions on a resource group level (through system/user-assigned identity). That means my ADO service principal should have UAA permissions for the role assignment, which means I'll struggle with a security team. :)

[johnlokerse]

Hm yes, I don't think it is possible to do this any other way than using deployment scripts. Check out this (still active) thread: #4023