Dependency Validation on conditional modules

[kevball2]

Hi everyone,

just looking to verify this is the expected behavior I am seeing with module dependencies.

// Create the user assigned identity to gain access to key vaul
module uaiSSHDeploy '../../modules/managed-identity/user-assigned-identities/main.bicep' = if (osType == 'Linux') {
  name: 'uaiSSH-${virtualMachineName}-dp'
  params:{
    name:'uaiSSH-${virtualMachineName}'
  }
}

module keyvaultAccess '../../modules/authorization/role-assignments/resource-group/main.bicep' = if (osType == 'Linux') {
  name: guid('uaiSSH-${virtualMachineName}', 'Key Vault Secrets Officer', keyvaultName)
  params: {
    principalId: uaiSSHDeploy.outputs.principalId
    roleDefinitionIdOrName: 'Key Vault Secrets Officer'
    principalType: 'ServicePrincipal'
    resourceGroupName: keyvaultResourceGroup
    subscriptionId: subscription().subscriptionId
  }
}

Both modules are set to only run on osType. What I am finding that the uaiSSHDeploy module is still looking to be deployed when the osType condition is not met.

New-AzResourceGroupDeployment: 2:26:20 PM - The deployment '05_virtualmachinewindows_iac' failed with error(s). Showing 1 out of 1 error(s).
Status Message: Deployment 'uaiSSH-vmiac02-dp' could not be found. (Code:DeploymentNotFound)

CorrelationId: 3c63d3a8-961b-4e81-9268-b465fab49301

the dependency on uaiSSHDeploy.outputs.principalId is causing deployment to expect a module deployment to exist. I don't expect there is way around this but just want to confirm this what is happening.

[jeskew]

This is a known issue in the ARM runtime (see #3990 for more discussion), but there is a workaround you can try. You would essentially have to use the same condition anywhere you want to dereference a property of a conditional resource. So in the keyvaultAccess module, principalId should be defined as osType == 'Linux' ? uaiSSHDeploy.outputs.principalId : ''

[kevball2]

That makes sense thanks! So anywhere a module or resource output is used needs to be set with a conditional as well. A conditional on the module or resource is not enough.