PSRule and Azure site AVM with hybridConnectionRelays

[mikkelh-SDU]

Hey

Firstly I'm not sure if it is a PSRule or AVM fault
When running my psrule test for my main.bicep where i use Azure AVM and I'm in the need of a hybrid connection relay. The module states it need a resourceId for the relay and when i provide it like this:
resourceId: resourceId('Microsoft.Relay/namespaces/hybridConnections', relayNamespaceName, hybridConnectionName)
or
resourceId: '${subscription().id}/resourceGroups/${rgCommonName}/providers/Microsoft.Relay/namespaces/${relayNamespaceName}/hybridConnections/${hybridConnectionName}'

I get this error when running my PSRule:
[ERROR] Failed to expand bicep source 'C:\tfs\TimeEditAPI\infra\main.bicepparam'. Exception calling "GetBicepParamResources" with "2" argument(s): "Unable to expand resources because the source file 'C:\tfs\TimeEditAPI\infra\main.bicepparam' was not valid. An error occurred evaluating expression '[split(substring(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2021-11-01').serviceBusEndpoint, indexOf(reference(extensionResourceId(format('/subscriptions/{0}/resourceGroups/{1}', split(parameters('hybridConnectionResourceId'), '/')[2], split(parameters('hybridConnectionResourceId'), '/')[4]), 'Microsoft.Relay/namespaces', split(parameters('hybridConnectionResourceId'), '/')[8]), '2021-11-01').serviceBusEndpoint, '.servicebus')), ':')[0]]' line 8529. startIndex ('-1') must be a non-negative value. (Parameter 'startIndex') Actual value was -1."

That said if i try to deploy my bicep to Azure, it works in as expected

[BernieWhite]

Hi @mikkelh-SDU, thanks for your question. To enable me to help you:

• Are you able to confirm the AVM module and version you are using?
• If you can provide a Bicep example of how you are calling the AVM module that would be appreciated.

[mikkelh-SDU]

Wow you replied fast!
I use these module:
PSRule v2.9.0
PSRule.Rules.Azure v1.41.0
PSRule.Rules.CAF v0.3.0

And this is my bicep relay AVM module:

module relay 'br/public:avm/res/relay/namespace:0.6.0' = {
  scope: resourceGroup(rgCommonName)
  name: 'relaynamespaceDeployment'
  params: {
    // Required parameters
    name: relayNamespaceName
    // Non-required parameters
    diagnosticSettings: [
      {
        workspaceResourceId: workspace.outputs.resourceId
      }
    ]
    hybridConnections: [
      {
        name: hybridConnectionName
        userMetadata: '[{"key":"endpoint","value":"${hybridConnectionEndpoint}"}]'
      }
    ]
    tags: union(tags, { 'azd-service-name': 'hybridconnection' })
  }
}

And this it my site AVM module:

module site 'br/public:avm/res/web/site:0.13.1' = {
  scope: resourceGroup(rgCommonName)
  name: 'siteDeployment'
  dependsOn: [
    serverfarm
    workspace
    relay
  ]
  params: {
    tags: union(tags, { 'azd-service-name': 'api' })
    // Required parameters
    kind: 'app,linux'
    name: '${abbrs.webSitesAppService}${solutionName}-${environmentName}-${locationShortName}'
    serverFarmResourceId: serverfarm.outputs.resourceId
    // Non-required parameters
    basicPublishingCredentialsPolicies: [
      {
        allow: false
        name: 'ftp'
      }
      {
        allow: false
        name: 'scm'
      }
    ]
    diagnosticSettings: [
      {
        workspaceResourceId: workspace.outputs.resourceId
      }
    ]
    httpsOnly: true
    location: location
    publicNetworkAccess: 'Enabled'
    scmSiteAlsoStopped: true
    clientAffinityEnabled: false
    managedIdentities: {
      systemAssigned: true
    }
    siteConfig: {
      linuxFxVersion: 'DOTNETCORE|8.0'
      http20Enabled: true
      alwaysOn: true
      ftpsState: 'FtpsOnly'
      healthCheckPath: '/healthz'
      metadata: [
        {
          name: 'CURRENT_STACK'
          value: 'dotnetcore'
        }
      ]
      minTlsVersion: '1.2'
    }
    vnetContentShareEnabled: true
    vnetImagePullEnabled: true
    vnetRouteAllEnabled: true
    hybridConnectionRelays: [
      {
        resourceId: '${subscription().id}/resourceGroups/${rgCommonName}/providers/Microsoft.Relay/namespaces/${relayNamespaceName}/hybridConnections/${hybridConnectionName}'
      }
    ]
  }
}

Can i provide the full main.bicep if needed

[BernieWhite]

Thanks for the details @mikkelh-SDU. Quick update, I've started investigating the issue.

[mikkelh-SDU]

Thanks for the update! I look forward to seeing what you find out 😊

[BernieWhite]

Hi @mikkelh-SDU. Thanks for your examples. I've found a bug with the expansion process for parts of your use case with these modules and logged a separate issue for the bug. A fix will be available in PSRule for Azure v1.41.2, and I believe that will fix your issue. #3251

[mikkelh-SDU]

That sounds fantastic! And thanks for picking it up so fast!