Azure DevOps using Bicep has different behave on local machine compared to ADO runner

Question

I am deploying very simple Azure log search alert rules using Bicep. Code sample:

param alertLocation string = resourceGroup().location

var umAlertRules = [
  {
    name: 'Update Manager Schedule Failures'
    query: 'here is query, not important for explanation to have here'
    description: 'Update schedules with status other than succeded'
    displayName: 'Update Manager Schedule Failures'
    enabled: true
    evaluationFrequency: 'PT5M'
    severity: 1
    windowSize: 'PT5M'
  }
  {
    name: 'Patch Installation Failures'
    query: 'here is query, not important for explanation to have here'
    description: 'Patch installation with other than succeded status'
    displayName: 'Patch Installation Failures'
    enabled: true
    evaluationFrequency: 'P1D'
    severity: 1
    windowSize: 'P1D'
  }
]

resource umAlertRule 'Microsoft.Insights/scheduledQueryRules@2023-03-15-preview' = [for umAlertRule in umAlertRules:{
  name: umAlertRule.name
  location: alertLocation
  tags: resourceGroup().tags
  identity: {
    type: 'UserAssigned'
    userAssignedIdentities: {
      '/subscriptions/subscription_id/resourceGroups/myRG/providers/Microsoft.ManagedIdentity/userAssignedIdentities/idName': {}
    }
  }
  properties: {
    actions: {
      actionGroups: [
        'subscriptions/subscription_id/resourceGroups/myRG/providers/microsoft.insights/actiongroups/ag-updatemanager'
      ]
      actionProperties: {}
      customProperties: {}
    }
    autoMitigate: false
    criteria: {
      allOf: [
        {
          dimensions: []
          failingPeriods: {
            minFailingPeriodsToAlert: 1
            numberOfEvaluationPeriods: 1
          }
          operator: (contains(umAlertRule, 'criteriaOperator')) ? umAlertRule.criteriaOperator : 'GreaterThanOrEqual' // THIS PART IS CAUSING ISSUE IN ADO PIPELINE
          query: umAlertRule.query
          threshold: 1
          timeAggregation: 'Count'
        }
      ]
    }
    description: umAlertRule.description
    displayName: umAlertRule.displayName
    enabled: umAlertRule.enabled
    evaluationFrequency: umAlertRule.evaluationFrequency
    muteActionsDuration: (contains(umAlertRule, 'muteActionsDuration')) ? umAlertRule.muteActionsDuration : null  // THIS PART IS CAUSING ISSUE IN ADO PIPELINE
    scopes: [
      'subscriptions/subscription_id'
    ]
    severity: umAlertRule.severity
    skipQueryValidation: true
    targetResourceTypes: []
    windowSize: umAlertRule.windowSize
  }
}]

When I am running Bicep configuration on localhost using command az deployment group what-if on WSL Ubuntu or using Powershell Core command New-AzResourceGroupDeployment, there is no error reported and deployment succeeds. This is on output operator: "GreaterThanOrEqual"

But using following tasks in Azure DevOps:

- task: AzureCLI@2
  name: BicelPlan
  displayName: Bicep Plan
  inputs:
    azureSubscription: $(azureServiceConnection)
    scriptType: 'bash'
    workingDirectory: 'bicep'
    scriptLocation: 'inlineScript'
    inlineScript: |
      az deployment group what-if \
      --resource-group 'myRG' \
      --template-file 'um_alerts.bicep'

pipeline using public runner, it fails with following error:

/home/vsts/work/1/s/bicep/um_alerts.bicep(75,79) : Error BCP053: The type "object" does not contain property "criteriaOperator". Available properties include "description", "displayName", "enabled", "evaluationFrequency", "name", "query", "severity", "windowSize".*

The goal of this, is to use similar approach as in Terraform locals, where not all properties are specified and try function is used in configuration.

Did anyone experienced same? Obviously the point here is to DRY.

Answer 1

I can reproduce the same issue when using the latest bicep file.

The cause of the issue is that the Pipeline is using the Az.bicep version v0.27.1 by default.

Refer to this release note: Azure.bicep v0.28.1

Allow dot property access on union of objects with undeclared property

To solve this issue, you need to upgrade the az.bicep version to v0.28.1 to run the deployment command.

Use command:

 az bicep upgrade

Here is an example:

steps: 

- task: AzureCLI@2
  name: BicelPlan
  displayName: Bicep Plan
  inputs:
    azureSubscription: 'xx'
    scriptType: 'bash'
    scriptLocation: 'inlineScript'
    inlineScript: |
      az bicep upgrade
      az deployment group what-if \
      --resource-group 'xx' \
      --template-file 'xx.bicep'

Result: