hubNetworking module deployment fails when DDoS is disabled

[cconstantin]

What happened? Provide a clear and concise description of the bug, including deployment details.

hubNetworking module deployment fails when DDoS is disabled. This appears to be caused by the DDoS plan reference in the outputs.

Please provide the correlation id associated with your error or bug.

xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx

What was the expected outcome?

Hub networking resources have been created/updated successfully, and DDoS has been disabled on hub vnet.

Relevant log output

Status Message: Resource /subscriptions/<****>/resourceGroups/rg-aci-connectivity/providers/Microsoft.Network/ddosProtectionPlans/alz-ddos-plan not found. (Code: NotFound)

Check previous GitHub issues

• I have searched the issues for this item and found no duplicate

Code of Conduct

• I agree to follow this project's Code of Conduct

[kasimrehman]

Hi, I would like to reopen this issue again. I am having this after deploying ALZ with DDOS protection enabled and then setting parDdosEnabled to false and redeploying. I am working with the newest release.

What I find odd, is that I get the same status message as above when trying to disable the plan, saying alz-ddos-plan not found whereas the default value for the DDOS protection name should have included a company prefix (which was not "alz" for me), so I am not sure where "alz-ddos-plan" is coming from. It's neither the actual DDOS plan I have, nor the default value of parDdosPlanName in my case. In fact I get the same message when I try to disable the DDOS protection plan from the portal. Deleting the association to the hub vnet fails because it says it cannot find "alz-ddos-plan". Well, that plan never existed. The only plan that exists is called alz-ddos-plan-germanywestcentral, which is the name the accelerator generated for parDdosPlanName.

[oZakari]

Hi @kasimrehman, please ensure that you have also set parDdosEnabled to false in the ALZ Defaults Policy Assignment module parameters file. You'll get the error you mentioned as there is a policy assignment that DDoS plan name.

You'll also need to manually remove the policy assignments as Bicep will not be able to remove them after the fact. There will be one policy assignment scoped at the platform's connectivity management group AND another one at the landing zones management group.

Please reach out if you run into any other issues and apologies for any confusion.