[AVM Module Issue]: publicNetworkAccess disabled, but still violates the policy da69ba51-aaf1-41e5-8651-607cd0b37088

[Besdima]

Check for previous/existing GitHub issues

• I have checked for previous/existing GitHub issues

Issue Type?

Bug

Module Name

avm/res/document-db/database-account

(Optional) Module Version

0.8.1

Description

We have a policy configured for CosmosDB accounts to disable public network access, and when we provision CosmosDB accounts with the following parameters:

networkRestrictions: {
  publicNetworkAccess: 'Disabled'
  ipRules: []
  virtualNetworkRules: []
}

It still violates the policy:

New-AzResourceGroupDeployment : 1:16:53 AM - Error: Code=RequestDisallowedByPolicy; Message=Resource
'xxxx' was disallowed by policy.

(Optional) Correlation Id

No response

[avm-team-linter]

@Besdima, thanks for submitting this issue for the avm/res/document-db/database-account module!

Important

A member of the @Azure/avm-res-documentdb-databaseaccount-module-owners-bicep or @Azure/avm-res-documentdb-databaseaccount-module-contributors-bicep team will review it soon!

[Besdima]

I run it in the testing environment, and the deployment seems to ignore the publicNetworkAccess parameter and deploys the CDB with the public endpoint on.

Probably there is an issue with this logic in the template:
'publicNetworkAccess', coalesce(tryGet(parameters('networkRestrictions'), 'publicNetworkAccess'), 'Enabled')

[seesharprun]

In the current Azure Cosmos DB configuration, you can only disable public network access if you declare child resources like a NoSQL, Gremlin, MongoDB, or Table database.

Here's the corresponding line: https://github.com/Azure/bicep-registry-modules/blob/main/avm/res/document-db/database-account/main.bicep#L273

I'm testing a change to fix this in a new version so you can disable public network access even if you don't define resources.

[Besdima]

edt.

I see what you mean now - thank you.

[microsoft-github-policy-service]

Warning

Tagging the AVM Core Team (@Azure/avm-core-team-technical-bicep) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

Tip

• To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.
• To avoid this rule being (re)triggered, the ""Needs: Triage 🔍" label must be removed as part of the triage process (when the issue is first responded to)!

[microsoft-github-policy-service]

Warning

Tagging the AVM Core Team (@Azure/avm-core-team-technical-bicep) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

Tip

• To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.
• To avoid this rule being (re)triggered, the ""Needs: Triage 🔍" label must be removed as part of the triage process (when the issue is first responded to)!

[microsoft-github-policy-service]

Caution

**This issue requires the AVM Core Team's (@Azure/avm-core-team-technical-bicep) immediate attention as it hasn't been responded to within 6 business days. **

Tip

• To avoid this rule being (re)triggered, the "Needs: Triage 🔍" and "Status: Response Overdue 🚩" labels must be removed when the issue is first responded to!
• Remove the "Needs: Immediate Attention ‼️" label once the issue has been responded to.

[microsoft-github-policy-service]

Warning

Tagging the AVM Core Team (@Azure/avm-core-team-technical-bicep) due to a module owner or contributor having not responded to this issue within 3 business days. The AVM Core Team will attempt to contact the module owners/contributors directly.

Tip

• To prevent further actions to take effect, the "Status: Response Overdue 🚩" label must be removed, once this issue has been responded to.
• To avoid this rule being (re)triggered, the ""Needs: Triage 🔍" label must be removed as part of the triage process (when the issue is first responded to)!

[microsoft-github-policy-service]

Caution

**This issue requires the AVM Core Team's (@Azure/avm-core-team-technical-bicep) immediate attention as it hasn't been responded to within 6 business days. **

Tip

• To avoid this rule being (re)triggered, the "Needs: Triage 🔍" and "Status: Response Overdue 🚩" labels must be removed when the issue is first responded to!
• Remove the "Needs: Immediate Attention ‼️" label once the issue has been responded to.