Create networkSecurityGroup destinationPortRanges doesn't match documentation #7625
-
|
Bicep version Describe the bug To Reproduce Additional context This is needed to allow the securityRules section to be filled in by a loop. One needs both xxxPortRange and xxxPortRanges in the bicep file and data for them in the parameter files., since one doesn't know if which of future entries will require single ports or ranges and which will require an array of enumerated values. The documentation at https://docs.microsoft.com/en-us/azure/templates/microsoft.network/2021-08-01/networksecuritygroups?tabs=bicep states that the parameter destinationPortRange is valid. The error message doesn't list it as a valid parameter: |
Beta Was this translation helpful? Give feedback.
Replies: 3 comments 5 replies
-
|
So the issue is that you are creating several @brwilkinson have you come across this and happen to have an example somewhere? |
Beta Was this translation helpful? Give feedback.
-
|
Hi @edgreenberg-mri / @alex-frankel Here is an input that contains both of these elements. Which works fine... however since I pass the whole object in to create the NSG, I don't have to do any special processing for these two propeties. https://github.com/brwilkinson/AzureDeploymentFramework/blob/main/ADF/bicep/NSG.bicep#L53 {
name: 'Inbound_Bastion_GatewayManager_443'
properties: {
protocol: '*'
sourcePortRange: '*'
sourceAddressPrefix: 'GatewayManager'
destinationPortRange: '443'
destinationAddressPrefix: '*'
access: 'Allow'
priority: 110
direction: 'Inbound'
}
}
{
name: 'Inbound_Bastion_DataPlane'
properties: {
protocol: '*'
sourcePortRange: '*'
sourceAddressPrefix: 'VirtualNetwork'
destinationAddressPrefix: 'VirtualNetwork'
access: 'Allow'
priority: 120
direction: 'Inbound'
destinationPortRanges: [
'8080'
'5701'
]
}
}I will take some time to review your code and see what I can find. |
Beta Was this translation helpful? Give feedback.
-
|
Would you mind sharing your code inline or else linking to the code on a public shared repo? I prefer not to download zip files from the internet, however I would like to review your issue. |
Beta Was this translation helpful? Give feedback.
-
|
Sorry about the zip. Github won't that .bicep or .json. Here's my code: network-security-group.bicep parameter file |
Beta Was this translation helpful? Give feedback.
-
|
Thank you for the clean repro / sample. You have quite a few options with this. . . The only thing is that I cannot repo your error? I deployed above successfully.... I would recommend to update to the later API version, however I saw no different either way.
You could also consider the following options.
resource NSG 'Microsoft.Network/networkSecurityGroups@2021-03-01' = [for (subnet, index) in subnetInfo: {
name: '${Deployment}-nsg${toUpper(subnet.name)}'
location: resourceGroup().location
properties: {
securityRules: union(NSGInfo[index].subnetNSGParam, NSGInfo[index].subnetNSGDefault)
}
}]
if you choose this option and don't follow 1) above, then you need to do some extra work similar to what is in 3) below. SNWAF01: [
{
name: 'WAF_Default_Inbound'
properties: {
protocol: 'Tcp'
sourcePortRange: '*'
destinationPortRange: '65200-65535'
sourceAddressPrefix: 'GatewayManager'
destinationAddressPrefix: '*'
access: 'Allow'
priority: 1000
direction: 'Inbound'
}
}
{
name: 'WAF_Web_Inbound'
properties: {
protocol: 'Tcp'
sourcePortRange: '*'
sourceAddressPrefix: 'Internet'
destinationAddressPrefix: 'VirtualNetwork'
access: 'Allow'
priority: 1010
direction: 'Inbound'
destinationPortRanges: [
'80'
'443'
]
}
}
]For the extra work, I prefer the 1) option above, otherwise you have to start doing things like the following. destinationAddressPrefixes: length(securityRule.destinationAddressPrefixes) == 0 ? null : securityRule.destinationAddressPrefixes
//or
destinationAddressPrefixes: contains(securityRule, 'destinationAddressPrefixes') ? securityRule.destinationAddressPrefixes : nullAnyway, let me know which specific sample is giving you the error, I can try to repro. |
Beta Was this translation helpful? Give feedback.
-
|
Ben, I'll try again over the weekend to deploy exactly what I sent you. If you can't duplicate it, and I can, I'll try to get you a complete screen transcript of everything I can. Remember that this is actually an ARM problem. The bicep compiles to ARM successfully. It's ARM that's complaining. I didn't realize that until after I had filed the bug. Looking at your suggestions... #1 is not a bad idea. If it'll work for me. It's actually less typing, since all those params only have to be specified in the parameters. Of course, ARM needs to take it. #2 would work if ARM would take a DestinationPortRanges array with one port. For instance, I need a rule that let's my companies VPN access 3306 for mysql. If I can specify [3306] I'd be fine. I know that I need to specify [80,443] sooner or later. What I don't want is to be unable to handle a single entry (a number or '*') or an array, at need. Let me report back. Ed |
Beta Was this translation helpful? Give feedback.
-
|
Sounds good @edgreenberg-mri ... let me know how it goes, once you get the chance. |
Beta Was this translation helpful? Give feedback.
-
|
HI @edgreenberg-mri did you get a chance to review? |
Beta Was this translation helpful? Give feedback.
So the issue is that you are creating several
securityRules, where some require the singular propertydestinationPortRangeand the other requires the pluraldestinationPortRanges? If the resource type does not support accepting both properties always, then I think the only way around is to use theunion()function to conditionally include the relevant properties.@brwilkinson have you come across this and happen to have an example somewhere?