Update object value

[kamfaima]

Maybe I'm flogging a dead horse here but I was just wondering if there is a way to update the value of an object's property, then pass the entire object to the suitable resource provider or module for processing?

Basically, I want to be able to convert a friendly name for a resource into the (unfriendly) resource ID name for a resource. In my scenario, I have an array of AzFw rule collection groups (RCG) objects. Each RCG contains one or more rule collections (RC). Within a RC can exist one or more rules. A rule may have a sourceIpGroups or destinationIpGroups property defined. Both these properties are an array of resourceId strings of the IP Groups.

An example structure of this is:

ruleCollectionGroups: [
  {
    name: 'rcg1'
    ruleCollections: [
      {
        name: 'rc1'
        rules: [
          {
            name: 'rule1'
            sourceIpGroups: [
              // Resource ID of IPGs
            ]
            destinationIpGroups: [
              // Resource ID of IPGs
            ]
          }
          {
            name: 'rule2'
            sourceIpGroups: [
              // Resource ID of IPGs
            ]
            destinationIpGroups: [
              // Resource ID of IPGs
            ]
          }
        ]
      }
      {
        // Additonal rule collections
      }
    ]
  }
  {
    // Additonal rule collection groups
  }
]

Currently, when we author the .bicepparam file to feed into our deployment, we need to use the resourceId of the IPG. While the resourceId is somewhat predictable it's still a pain to browse around the portal to get them. I was wondering if we could just use the (short) resource name and have some logic (Bicep, pwsh, magic fairy dust) to convert them into the longer resourceId names that ARM is expecting.

I tried writing modules to do some basic parsing and I had some luck in replacing the short resource name with the resourceId instead. But now I'm stumped as to how to update the object's value, if even possible, then recursively pass the object back up the tree. THEN pass the updated object to the resource provider to deploy the AzFw rule collection group itself. The property is just so deeply nested and iterating over arrays where there can be many elements, then somehow merging the results back together again is doing my head in.

Any thoughts on this? Happy to be told I'm out of my mind of course!

[johnlokerse]

Hey @kamfaima, you are not out of your mind 😄. I think this use-case suits very well with the lambda expression function map(). With this function you can manipulate arrays and then use the output further in your Bicep templates. Here is some documentation on map(): https://learn.microsoft.com/en-us/azure/azure-resource-manager/bicep/bicep-functions-lambda#map

Let me know here if you need any help or need to understand how map works!

[kamfaima]

Sorry for the long delay in getting back to this thread, but I finally got this all done so here's the write-up! It did do my head in with the layers of inception involved and a bit of Bicep learning on the side! As an example, I didn't realise or just plain forgot that I could define/create objects within other function calls.

So my logic to tackle this was to start working from the innermost element, i.e. the object that contains the actual IP Group resources, then work back to the outermost element. Kinda like a loop in a loop inception.

I had to firstly work out how to retrieve the resource IDs of the IPGs and pass it back up the chain, so that's the order I'll document it here too. I actually did start using map() so thank you for confirming I was on the right track! I wrote a module that simply converts the short (friendly) IPG names to the full resource ID in a ipgTranslator.bicep module. That was the easy bit!

ipgTranslator.bicep

param rule object

var translatedIpgs = {
  sourceIpGroups: map(rule.?sourceIpGroups ?? [], ipg => resourceId('Microsoft.Network/ipGroups', ipg))
  destinationIpGroups: map(rule.?destinationIpGroups ?? [], ipg => resourceId('Microsoft.Network/ipGroups', ipg))
}

output updatedRule object = union(rule, translatedIpgs)

Next step was to write the module that loops through all the rules (in a rule collection), passes each one to ipgTranslator.bicep, then outputs/returns the updated array to the calling module.

ruleLooper.bicep

param rules array

module updatedRule 'ipgTranslator.bicep' = [
  for rule in rules: {
    name: 'Update_rule_${replace(rule.name, ' ', '_')}'
    params: {
      rule: rule
    }
  }
]

output updatedRules array = [for (rule, i) in rules: updatedRule[i].outputs.updatedRule]

This next module loops through a rule collection, passes each to ruleLooper.bicep, then outputs/returns the updated array to the calling module.

ruleCollectionLooper.bicep

param ruleCollections array

module updatedRuleCollection 'ruleLooper.bicep' = [
  for ruleCollection in ruleCollections: {
    name: 'Update_rule_collection_${ruleCollection.name}'
    params: {
      rules: ruleCollection.rules
    }
  }
]

output updatedRuleCollections array = [
  for (ruleCollection, i) in ruleCollections: union(ruleCollection, { rules: updatedRuleCollection[i].outputs.updatedRules })
]

This next module takes a rule collection group, passes each to ruleCollectionLooper.bicep, then outputs/returns the updated array to the calling module. It then merges the returned object with the original properties and passes it to the rule collection group RP.

azFwRcgDeployer.bicep

param azFwPolicyName string
param rcgName string
param ruleCollectionGroupProperties object

module updatedRuleCollections 'ruleCollectionLooper.bicep' = {
  name: 'Update_rule_collection_group_${rcgName}'
  params: {
    ruleCollections: ruleCollectionGroupProperties.ruleCollections
  }
}

var updatedProperties = union(ruleCollectionGroupProperties, { ruleCollections: updatedRuleCollections.outputs.updatedRuleCollections })

resource rcg 'Microsoft.Network/firewallPolicies/ruleCollectionGroups@2021-05-01' = {
  name: '${azFwPolicyName}/${rcgName}'
  properties: updatedProperties
}

output updatedRuleCollections object = updatedProperties

Lastly we have our rule collection group looper. It loops through each RCG (in an AzFw policy) and passes it to azFwRcgDeployer.bicep.

param azFirewallPolicy object

@batchSize(1)
module azfwrcg 'azFwRcgDeployer.bicep' = [
  for rcg in azFirewallPolicy.ruleCollectionGroups: {
    name: 'Deploy-${rcg.name}'
    scope: resourceGroup(azFirewallPolicy.resourceGroup)
    params: {
      azFwPolicyName: azFirewallPolicy.name
      rcgName: rcg.name
      ruleCollectionGroupProperties: rcg.properties
    }
  }
]

And that's it, hopefully this approach and code examples helps others! If my code or approach can be refined, please let me know!