How to use array output in a for loop

[floriankoch]

Hi,
i try to use a module output (array) in a for loop
(i try to get the OIDS for Azure AD Groups via deploymentscript)

module aadGroupDiscovery '../../../modules/aadDiscovery/v0.1.0/groupDiscovery.bicep' = {
  name: '${rgroup.name}aadgroup'
  scope: resourceGroup(name)
  params: {
    name: '${rgroup.name}aadGroup'
    groupNames: groupNames
    location: location
  }
}

var oids = aadGroupDiscovery.outputs.groupOids

module roleAssingment '../../../modules/authorization/v0.1.0/roleAssingment.bicep' = [ for oid in oids: {

I got an error:

... at the start of the deployment, and cannot depend on any values that have not yet been calculated. You are referencing a variable which cannot be calculated in time ("oids" -> "aadGroupDiscovery"). Accessible properties of aadGroupDiscovery are "name".bicep(BCP178)

I need this to lookup the ObjectID for a Azure AD Group to use in a roleAssingment
Basically this #645

This is my deployment script:

resource deploymentScript 'Microsoft.Resources/deploymentScripts@2020-10-01' = {
  name: 'ds{name}'
  location: location
  kind: 'AzurePowerShell'
  properties: {
    forceUpdateTag: utcValue
    azPowerShellVersion: '6.0'
    timeout: 'PT10M'
    storageAccountSettings: {
      storageAccountName: storageAccount.name
      storageAccountKey: listKeys(storageAccount.id, storageAccount.apiVersion).keys[0].value
    }
    arguments: '-GroupName \'${groupNames}\''
    scriptContent: '''
    param($groupNames)
    $ret=($groupNames| ForEach-Object -Process { (Get-AzADGroup -DisplayNameStartsWith $_).Id })
    $DeploymentScriptsOutputs = @{}
    $DeploymentScriptOutputs['GroupOids'] = $ret
  
    '''
    cleanupPreference: 'OnSuccess'
    retentionInterval: 'P1D'
  }
}

How can i do this?

[alex-frankel]

This is a current ARM deployments runtime limitation unfortunately. The array of a loop cannot be a runtime-only property, which essentially means we have to know the boundaries of all arrays used for loops before the deployment starts. It's definitely a limitation we'd love to lift, but no ETA for when that will happen. Is there a way to know the length of this oids array and provide it as an input parameter instead or is that length going to by dynamic?

[majastrz]

If the oid array is truly dynamic, you should be able to wrap the roleAssingment module array in another module. The runtime allows passing module outputs into other modules via parameters and inside the module, a parameter can be used with a loop.

[floriankoch]

@majastrz this works, thank you!

[brwilkinson]

Hi @floriankoch thanks for the confirmation, if you like you can mark above as a 'answered'.

[ishepherd]

@alex-frankel I guess this is a big lift for your team, but there are plenty use cases! Another: #3724