bicep module object output incomplete

[grabery]

Hello

Following scenario.
I have a main bicep file and three bicep modules which are being used. One of the modules defines a storage account. For the configuration of other modules, I wanted to have an output of the whole object of the storage account (as following) and use the properties of the object later on in other bicep modules and main bicep.

param location string
param InstanceID string

resource storageAccount 'Microsoft.Storage/storageAccounts@2021-04-01' = {
  name: 'stbc${InstanceID}${uniqueString(resourceGroup().id)}'
  location: location 
  sku: {
    name: 'Standard_LRS'
  }
  kind: 'Storage'
  properties: {
    supportsHttpsTrafficOnly: true
    encryption: {
      services: {
        file: {
          keyType: 'Account'
          enabled: true
        }
        blob: {
          keyType: 'Account'
          enabled: true
        }
      }
      keySource: 'Microsoft.Storage'
    }
  }
}

output outStorageAccount object = storageAccount

If I use this object in an other module and / or main.bicep, I run in to an error.

'name': 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING'
        'value': 'DefaultEndpointsProtocol=https;AccountName=${outStorageAccount.name};EndpointSuffix=${environment().suffixes.storage};AccountKey=${listKeys(outStorageAccountID, outStorageAccount.apiVersion).keys[0].value}'

_New-AzResourceGroupDeployment: 13:03:09 - The deployment 'bcdepl01' failed with error(s). Showing 2 out of 2 error(s).
Status Message: Deployment template validation failed: 'The template reference 'stbc001ido7na2tdujse' is not valid: could not find template resource or resource copy with this name. Please see https://aka.ms/arm-template-expressions/#reference for usage details.'. (Code:InvalidTemplate)
Status Message: Deployment template validation failed: 'The template reference 'stbc001ido7na2tdujse' is not valid: could not find template resource or resource copy with this name. Please see https://aka.ms/arm-template-expressions/#reference for usage details.'. (Code:InvalidTemplate)
_

The error does not make a lot of sense to me, especially as the storage account clearly exist and if I do everything in the same bicep file, it works just fine. Also to read some other properties out of this object worked just fine. I was able to solve the problem now, by creating an output for every property of the storage account directly in the storageaccount.bicep file as a string. Instead of just a single object output and use the object like storageaccount.name.

output outStorageAccountID string = storageAccount.id
output outStorageAccountName string = storageAccount.name
output storageAccountConnectionString string = 'DefaultEndpointsProtocol=https;AccountName=${storageAccount.name};EndpointSuffix=${environment().suffixes.storage};AccountKey=${listKeys(storageAccount.id, storageAccount.apiVersion).keys[0].value}'

Is this expected and recommended to work with outputs for every property needed, or is it a bug?
Despite the error does not make sense to me in this context anyway, I think it would be nice if objects are fully supported and reusable with all the properties and not just partially.

Any thoughts on this?

[StefanIvemo]

This is the expected behavior, in order to use a property from a resource declared in a module you need to make sure it's defined as an output in the module file. Your suggestion above to use all properties from the resources in modules has been discussed before in #923.

I agree with you that the most natural way when authoring templates and consuming modules would be to be able to access all properties from the resources defined in the modules. Defining outputs for every possible scenario makes the authoring experience a bit clunky sometimes. I believe that this will be even more frustrating for user when we start to consume modules from the Bicep registry or template specs where the author might not even have permissions to publish an updated version of the module if another property is needed.

[grabery]

Thank you very much for your answer. Highly appreciated. I think my topic is slightly different than the one you posted. I can see that it is expected behavior, that the output does not contain by default the whole resource. But what I did is, I declared the explicitly the whole resource as an object output with `output outStorageAccount object = storageAccount`. The fun thing is that my deployment works if I declare the following value as a string output already in the module with ``` output outStorageAccountConnectionString string = 'DefaultEndpointsProtocol=https;AccountName=${outStorageAccount.name};EndpointSuffix=${environment().suffixes.storage};AccountKey=${listKeys(outStorageAccountID, outStorageAccount.apiVersion).keys[0].value} ``` But not if I use the object output properties in other bicep files as following. ``` 'name': 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING' 'value': DefaultEndpointsProtocol=https;AccountName=${outStorageAccount.name};EndpointSuffix=${environment().suffixes.storage};AccountKey=${listKeys(outStorageAccountID, outStorageAccount.apiVersion).keys[0].value}' ``` I think it does make sense that not by default the whole object can be read, but it should be possible if I explicitly define the whole object as an output. But maybe it’s just me who thinks that declare a whole object as output would be very handy instead of manually configure every single output string. Cheers

[brwilkinson]

There are a few requests floating around for similar things.

The main thing (that you already discovered) is that the 'resource' is not the object, it's more of a reference to the object.

I would like to see some working examples from you on what is working or not? if you have a small repro example code ?

here is an example of a module that outputs some disks format options which is actually an object: https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/y.disks.bicep

here is the VM template that calls the module:
https://github.com/brwilkinson/AzureDeploymentFramework/blob/5344448370b0d8776e930569cce1e83b70f0305c/ADF/bicep/VM.bicep#L246

Then in the same file later on reference the outputs from the module that was called:
https://github.com/brwilkinson/AzureDeploymentFramework/blob/5344448370b0d8776e930569cce1e83b70f0305c/ADF/bicep/VM.bicep#L299

I just want to ensure we didn't miss anything, i couldn't quite pick up on what you were saying in your examples, I just need some more info on the whole context, if you can provide.

[brwilkinson]

looping back on this one again. I think it makes the most sense to do the following here, since you don't want to be passing storage keys in outputs.

resource SADiag 'Microsoft.Storage/storageAccounts@2021-04-01' existing = {
  name: SADiagName
}

...
        {
          name: 'WEBSITE_CONTENTAZUREFILECONNECTIONSTRING'
          value: 'DefaultEndpointsProtocol=https;AccountName=${SADiag.name};AccountKey=${SADiag.listKeys().keys[0].value};EndpointSuffix=${environment().suffixes.storage}'
        }
...

This is the associated template this came from:
https://github.com/brwilkinson/AzureDeploymentFramework/blob/0aa5f1500b29fc7327956d3af621514625bf371b/ADF/bicep/AppServiceFunction.bicep#L87

NOTE

The same string should work in output as well, it's just not secure

output outStorageAccountConnectionString string = 'DefaultEndpointsProtocol=https;AccountName=${SADiag.name};AccountKey=${SADiag.listKeys().keys[0].value};EndpointSuffix=${environment().suffixes.storage}'

[brwilkinson]

output outStorageAccountConnectionString string = 'DefaultEndpointsProtocol=https;AccountName=${outStorageAccount.name};EndpointSuffix=${environment().suffixes.storage};AccountKey=${listKeys(outStorageAccountID, outStorageAccount.apiVersion).keys[0].value}

It does look like you are missing the ending ` single quote on your example, so not sure if that was the only issue you were running into.

[brwilkinson]

@grabery please let us know if you have resolved this issue now?

[brwilkinson]

I don't believe we got to the bottom of your requirements here?

Perhaps take a look at this PR and review if it meets some of your needs?

#4971

Otherwise, feel free to provide some extra info in order resolve your query.

[brwilkinson]

going to mark as answered, feel free to follow up as required.