Pass array to ARM Template - azure-devops

Question

I am trying to pass an array from an AzurePowerShell task to an ARM template but I am not sure how to do this.
I get the error:
Not valid json when I attempt to pass it as a string and then use json function in ARM although when I print the json out and lint it, it is valid json.
Can't convert string to object when the template expects an object.
Any help is appreciated.
I have a powershell script that grabs the access policies from my key vault:
$keyVault = Get-AzKeyVault -Name $keyVaultName -ResourceGroupName $resourceGroupName
$keyVaultAccessPolicies = $keyVault.AccessPolicies
$json = $keyVaultAccessPolicies | ConvertTo-Json -Compress
Write-Host "##vso[task.setvariable variable=SAUCE;isOutput=true;]$json"
EDIT
I can see the value when debugging to be an array as its surrounded by square brackets. However, when outputted in pipelines the square bracket is omitted out. I find this strange and don't understand why its doing that.
However, how do I now pass this to a template?
- task: AzureResourceManagerTemplateDeployment#3
displayName: 'Provision Key Vault'
inputs:
deploymentScope: 'Resource Group'
azureResourceManagerConnection: ${{ parameters.azureSubscriptionName }}
subscriptionId: ${{ parameters.azureSubscriptionId }}
action: 'Create Or Update Resource Group'
resourceGroupName: '$(Resource.Group.Name)'
location: '$(Region)'
templateLocation: 'Linked artifact'
csmFile: '$(Provisioning.Package.Name)/Templates/key-vault-deploy.json'
deploymentMode: 'Incremental'
overrideParameters: >-
-name "$(KeyVault.Name)"
-foo "$env:accesspolicyreference_SAUCE"
The is the key vault template
{
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"name": {
"type": "string"
},
"fooBar": {
"type": "string"
}
},
"variables": {
},
"resources": [
{
"apiVersion": "2018-02-14",
"name": "[parameters('name')]",
"location": "[parameters('location')]",
"type": "Microsoft.KeyVault/vaults",
"properties": {
"accessPolicies": "[json(parameters('fooBar'))]",
"enabledForDeployment": false,
"enabledForTemplateDeployment": true,
"enabledForDiskEncryption": false,
"enableRbacAuthorization": false,
"tenantId": "[parameters('tenant')]",
"sku": {
"name": "Standard",
"family": "A"
},
"enableSoftDelete": false,
"networkAcls": {
"defaultAction": "allow",
"bypass": "AzureServices",
"ipRules": [],
"virtualNetworkRules": []
}
},
"tags": "[variables('tags')]",
"dependsOn": []
}
],
"outputs": {}
}

Answer 1

There are several issues here:
Overriding an arm template parameter with a json string can get you into trouble, if it is not escaped correctly. I suggest, you encode the json as a base64 string:
$keyVault = Get-AzKeyVault -Name 'vaultbyenar2htogee'
$keyVaultAccessPolicies = $keyVault.AccessPolicies
$json = $keyVaultAccessPolicies | ConvertTo-Json -Compress
$sauce64 = [Convert]::ToBase64String([System.Text.Encoding]::UTF8.GetBytes($json))
Write-Host "##vso[task.setvariable variable=SAUCE]$sauce64"
There is an arm template function base64ToJson() that directly decodes base64 encoded json strings into objects:
"variables": {
"fooBar": "[base64ToJson(parameters('fooBar'))]"
}
The object that you get from $keyVault.AccessPolicies is not a valid value for the accessPolicies property in the arm template. In order to make it work, you need to map the values into the correct structure with a copy-loop:
{
"$schema": "http://schema.management.azure.com/schemas/2015-01-01/deploymentTemplate.json#",
"contentVersion": "1.0.0.0",
"parameters": {
"name": {
"type": "string"
},
"location": {
"type": "string"
},
"fooBar": {
"type": "string"
}
},
"variables": {
"fooBar": "[base64ToJson(parameters('fooBar'))]"
},
"resources": [
{
"apiVersion": "2018-02-14",
"name": "[parameters('name')]",
"location": "[parameters('location')]",
"type": "Microsoft.KeyVault/vaults",
"properties": {
"copy": [ {
"name": "accessPolicies",
"count": "[length(variables('fooBar'))]",
"input": {
"tenantId": "[subscription().tenantId]",
"objectId": "[variables('fooBar')[copyIndex('accessPolicies')].ObjectId]",
"permissions": {
"keys": "[variables('fooBar')[copyIndex('accessPolicies')].PermissionsToKeys]",
"secrets": "[variables('fooBar')[copyIndex('accessPolicies')].PermissionsToSecrets]",
"certificates": "[variables('fooBar')[copyIndex('accessPolicies')].PermissionsToCertificates]"
}
}
}],
"enabledForDeployment": false,
"enabledForTemplateDeployment": true,
"enabledForDiskEncryption": false,
"enableRbacAuthorization": false,
"tenantId": "[subscription().tenantid]",
"sku": {
"name": "Standard",
"family": "A"
},
"enableSoftDelete": false,
"networkAcls": {
"defaultAction": "allow",
"bypass": "AzureServices",
"ipRules": [],
"virtualNetworkRules": []
}
},
"dependsOn": []
}
],
"outputs": {}
}
No need to use ;isOutput=true if you will use the pipeline variable in a downstream task within the same job. (Otherwise you need to prefix the variable with the name of the task in which it was set, like: $(myTask.SAUCE)).