Bicep deployment validation shows up only the first module to be created

[dani3lheidemann]

Bicep version
Bicep CLI version 0.4.63 (7ebed03)

Describe the bug
Hi all,
I'm facing the problem that I want to deploy my main.bicep file, which contains a couple of bicep modules. So far, it works, but I recognized, that after the validation part which is done by "New-AzResourceGroupDeployment" only the first module is shown to be created. The strange thing about this is that Bicep/ARM knows and shows all other modules when I run with -verbose parameter, but just the first module shows up to be created.

Part of my main.bicep where I call the modules from:

// ++++++++++++++++++++++++++++++++++++++++++
module nsg '../../Modules/network-security-group.bicep' = {
  name: 'Deploy-Hub-NSG'
  params: {
    nsg_name: nsg_name
  }
}

// ++++++++++++++++++++++++++++++++++++++++++
//
// Deploy Hub Virtual Network
//
// ++++++++++++++++++++++++++++++++++++++++++
module vnet '../../Modules/virtual-network.bicep' = {
  name: 'Deploy-Hub-VNET'
  params: {
    vnet_name: vnet_name
    vnet_address_prefix: vnet_address_prefix
    nsg_name: nsg.outputs.o_nsg_name
    subnet_definitions: subnet_definitions
  }
}

// ++++++++++++++++++++++++++++++++++++++++++
// 
// AZURE BASTION HOST SETUP
//
// ++++++++++++++++++++++++++++++++++++++++++
module bastion '../../Modules/bastion-host.bicep' = {
  name: 'Deploy-Hub-Bastion'
  params: {
    bastion_name: bastion_name
    bastion_pip_name: bastion_pip_name
    vnet_name: vnet.outputs.o_vnet_name
  }
}

My Bicep -> JSON output with -verbose parameter. Note that all deployments (modules) are in plus the first module additionally as a resource. The curious thing is that when I remove the nsg module so that the vnet module is the "first" one, the vnet module is shown twice - as a deployment and as a resource, but no more resources.

"validatedResources": [
      {
        "id": "/subscriptions/xxx/resourceGroups/rg-xxx/providers/Microsoft.Resources/deployments/Deploy-Hub-NSG"
      },
      {
        "id": "/subscriptions/xxx/resourceGroups/rg-xxx/providers/Microsoft.Resources/deployments/Deploy-Hub-VNET"
      },
      {
        "id": "/subscriptions/xxx/resourceGroups/rg-xxx/providers/Microsoft.Resources/deployments/Deploy-Hub-Bastion"
      },
      {
        "id": "/subscriptions/xxx/resourceGroups/rg-xxx/providers/Microsoft.Resources/deployments/Deploy-PrivateDNS-VNET-Links"
      },
      {
        "id": "/subscriptions/xxx/resourceGroups/rg-xxx/providers/Microsoft.Resources/deployments/Deploy-Hub-VPN"
      },
      {
        "id": "/subscriptions/xxx/resourceGroups/rg-xxx/providers/Microsoft.Network/networkSecurityGroups/nsg-xxx"
      }
    ]

My bicep validation output before I'm asked to deploy:

Resource and property changes are indicated with this symbol:
  + Create

The deployment will update the following scope:

Scope: /subscriptions/xxx/resourceGroups/rg-xxx

  + Microsoft.Network/networkSecurityGroups/nsg-xxx[2020-06-01]

      apiVersion: "2020-06-01"
      id:         "/subscriptions/xxx/resourceGroups/rg-xxx/providers/Microsoft.Network/networkSecurityGroups/nsg-xxx"
      location:   "southafricanorth"
      name:       "nsg-xxx"
      type:       "Microsoft.Network/networkSecurityGroups"

Resource changes: 1 to create.

Can anyone help me to figure out what's wrong here? The only change I made is that I'm pretty sure that this has been working in version v0.3.539.

Thank you very much,
Daniel

[alex-frankel]

Can you check if what you are seeing is an instance of this issue? Azure/arm-template-whatif#157

Are you referencing any resource properties (runtime-only values) as the value for one of the params of a module? This can cause issues in our preflight validation/what-if process.

[dani3lheidemann]

Hi @alex-frankel,
we can close this one, since it's the same issue. Thank you!