Comparison with Bicep Version 1

Oct 13, 2025 by magicalceylontours.com 57 views

Introduction

When creating custom roles in Azure using Bicep, it's essential to ensure that the what-if operation is successful. However, in some cases, the what-if action may fail, especially when trying to deploy a new custom role with * permissions. In this article, we'll investigate the issue of what-if failing on custom role creation and provide a solution to resolve the problem.

Understanding the Error

The error message indicates that the what-if operation failed with an "Invalid count value: -6" error. This error occurs when the Bicep deployment fails to validate the permissions specified in the custom role.

Custom Role Permissions

The custom role being deployed has the following permissions:

permissions: {
  actions: [
    '*'
  ]
...
}

The * permission is used to grant access to all actions within a specific scope. However, this permission is not supported by the what-if operation in Bicep.

What-If Operation

The what-if operation is used to simulate the deployment of a Bicep template without actually making any changes to the Azure resources. This operation is essential for testing and validating the deployment of custom roles.

Bicep Version

The Bicep version being used is 0.33.93. This version may have some limitations or bugs that are causing the what-if operation to fail.

Comparison with Bicep Version 1

When using Bicep version 1, the what-if operation works without issues. This suggests that the problem may be specific to Bicep version 2.

Solution

To resolve the issue, we can modify the custom role permissions to include specific read actions instead of using the * permission. For example:

permissions: {
  actions: [
    '*/read'
    'Microsoft.OperationalInsights/workspaces/analytics/query/action'
    'Microsoft.OperationalInsights/workspaces/search/action'
    'Microsoft.Support/*'
  ]
}

This approach ensures that the what-if operation is successful and allows us to deploy the custom role with the desired permissions.

Conclusion

In conclusion, the what-if operation failing on custom role creation is likely due to the use of the * permission in the custom role. By modifying the permissions to include specific read actions, we can resolve the issue and successfully deploy the custom role using Bicep version 2.

Best Practices

To avoid similar issues in the future, it's essential to follow best practices when creating custom roles in Azure:

Use specific permissions instead of the * permission.
Test the what-if operation before deploying the custom role.
Use Bicep version 1 if possible, as it may have fewer limitations and bugs.

Additional Resources

For more information on creating custom roles in Azure using Bicep, please refer to the following resources:

Introduction

In our previous article, we investigated the issue of what-if failing on custom role creation in Azure using Bicep. We discovered that the problem is likely due to the use of the * permission in the custom role. In this article, we'll provide a Q&A section to address common questions and concerns related to this issue.

**Q: What is the * permission in Azure custom roles?**

A: The * permission is a wildcard character that grants access to all actions within a specific scope. However, this permission is not supported by the what-if operation in Bicep.

Q: Why is the what-if operation failing on custom role creation?

A: The what-if operation is failing because the * permission is not supported. When the what-if operation tries to validate the permissions, it encounters an "Invalid count value: -6" error.

**Q: Can I use the * permission in my custom role?**

A: No, it's not recommended to use the * permission in your custom role. Instead, use specific permissions that grant access to the required actions.

Q: How can I modify my custom role permissions to resolve the issue?

A: You can modify your custom role permissions to include specific read actions instead of using the * permission. For example:

permissions: {
  actions: [
    '*/read'
    'Microsoft.OperationalInsights/workspaces/analytics/query/action'
    'Microsoft.OperationalInsights/workspaces/search/action'
    'Microsoft.Support/*'
  ]
}

Q: Why is Bicep version 2 causing the issue?

A: Bicep version 2 may have some limitations or bugs that are causing the what-if operation to fail. However, using Bicep version 1 may resolve the issue.

Q: Can I use Bicep version 1 to deploy my custom role?

A: Yes, you can use Bicep version 1 to deploy your custom role. However, keep in mind that Bicep version 1 may have some limitations and bugs that are not present in Bicep version 2.

Q: What are the best practices for creating custom roles in Azure?

A: To avoid similar issues in the future, follow these best practices:

Use specific permissions instead of the * permission.
Test the what-if operation before deploying the custom role.
Use Bicep version 1 if possible, as it may have fewer limitations and bugs.

Q: Where can I find more information on creating custom roles in Azure?

A: For more information on creating custom roles in Azure, please refer to the following resources:

By following these best practices and using the modified custom role permissions, you can successfully deploy custom roles in Azure using Bicep version 2.