[AVM Module Issue]: How to conditionally define network security group in subnets

[teemukom]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Issue Type?

I'm not sure

Module Name

avm/res/network/virtual-network

(Optional) Module Version

0.1.1

Description

I'm unable to find a way to conditionally define network security group for a subnet. For example I would like to define NSG id if the subnet's name is AzureBastionSubnet but not for others. The most obvious approach would be:

subnets: [for subnet in subnets: {
  name: subnet.name
  addressPrefix: subnet.addressPrefix
  networkSecurityGroupResourceId: (subnet.name == 'AzureBastionSubnet') ? nsg.id : null
}]

But it seems that the value if set can't be null:

     | InvalidRequestFormat)    - Value for the id property is invalid.
     | Expecting a string. Actual value is Null. Path
     | properties.subnets[0].properties.networkSecurityGroup.
     | (Code:InvalidJsonPropertyType)

### (Optional) Correlation Id

_No response_

[microsoft-github-policy-service]

Important

The "Needs: Triage 🔍" label must be removed once the triage process is complete!

Tip

For additional guidance on how to triage this issue/PR, see the BRM Issue Triage documentation.

Note

This label was added as per ITA06.

[elbatane]

Hi @teemukom, thank you very much for opening the issue. We will com back to you with an answer as soon as possible

[cloudchristoph]

I have checked various options and found that as soon as the parameter networkSecurityGroupResourceId is specified, there is no chance to leave it empty (empty string, null, false, ...)

The submodule for subnets has handled this better. It checks whether the parameter is empty, not whether it is included.

From subnet module:

    networkSecurityGroup: !empty(networkSecurityGroupResourceId)
      ? {
          id: networkSecurityGroupResourceId
        }
      : null

I suggest that the main module also checks for “empty”. In addition to “contains”.

From virtual network module:

      networkSecurityGroup: contains(subnet, 'networkSecurityGroupResourceId')
        ? {
            id: subnet.networkSecurityGroupResourceId
          }
        : null

My proposal for networkSecurityGroups.

And at the same time we should also adapt it for natGateway and routeTable. For all other parameters I can either pass “null” directly or an empty array, so that's fine.

Any objections?

[elbatane]

HIi @cloudchristoph , could you please create a PR with the changes you are proposing? Thank you very much

[cloudchristoph]

Sure! Will send a PR tomorrow.

[AlexanderSehr]

I'm a bit late to the part, but one option to achieve this with the module today would be to only add the property to the subnets if the condition is true in the first place. This can be done using the union() function that merges the main chunk of the object with a conditional block that's only added if your condition is true.

This would look like this

var test = [
  for subnet in subnets: union(
    {
      name: subnet.name
      addressPrefix: subnet.addressPrefix
    },
    (subnet.name == 'AzureBastionSubnet' ? { networkSecurityGroupResourceId : nsg.id } : {})
  )
]

[teemukom]

I'm a bit late to the part, but one option to achieve this with the module today would be to only add the property to the subnets if the condition is true in the first place. This can be done using the union() function that merges the main chunk of the object with a conditional block that's only added if your condition is true.

This would look like this

var test = [
  for subnet in subnets: union(
    {
      name: subnet.name
      addressPrefix: subnet.addressPrefix
    },
    (subnet.name == 'AzureBastionSubnet' ? { networkSecurityGroupResourceId : nsg.id } : {})
  )
]

@AlexanderSehr thanks for the reply. Actually I also figured this earlier. Not nice but doable.

[AlexanderSehr]

I'm a bit late to the part, but one option to achieve this with the module today would be to only add the property to the subnets if the condition is true in the first place. This can be done using the union() function that merges the main chunk of the object with a conditional block that's only added if your condition is true.
This would look like this

var test = [
  for subnet in subnets: union(
    {
      name: subnet.name
      addressPrefix: subnet.addressPrefix
    },
    (subnet.name == 'AzureBastionSubnet' ? { networkSecurityGroupResourceId : nsg.id } : {})
  )
]

@AlexanderSehr thanks for the reply. Actually I also figured this earlier. Not nice but doable.

We continue to discuss the best solution in @cloudchristoph's PR 😉