Azure-docs: Dependent resources on conditional resources fail

[artmasa]

having a template looking like this fails to deploy:

resources: [
  {
    type: web/certs
    name: sslcert,
    condition: isProduction
  },
  {
    type: web/sites,
    name: webapp,
  },
  {
    type: web/sites/hostNameBindings,
    name: sslBinding,
    condition: isProduction,
    properties: {
      thumbpring: reference(sslcert).thumbprint
    },
    dependsOn: [
      webapp,
      sslcert
    ]
  }
]

This assumes the isProduction variable returns true or false.
This template fails to deploy because the host name binding resource depends on the ssl certificate and even when both's deployment depends on the same condition the dependsOn of the binding still evaluates and breaks because the certificate is not present.

I think since the binding is also not being deployed because of the condition, the dependsOn property should also be ignored.

The error below would not appear if I remove the binding from the template:
Resource Microsoft.Web/certificates 'sslcert' failed with message '{ "error": { "code": "ResourceNotFound", "message": "The Resource 'Microsoft.Web/certificates/sslcert' under resource group '<my resource group name>' was not found." } }'

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 239d3fb9-5c01-fb3d-f587-86ef2622c4e3
• Version Independent ID: b23932c8-38aa-b992-657e-3b6e66e691c1
• Content: Use condition in Azure Resource Manager templates
• Content Source: articles/azure-resource-manager/resource-manager-tutorial-use-conditions.md
• Service: azure-resource-manager
• GitHub Login: @mumian
• Microsoft Alias: jgao

[femsulu]

@artmasa Thanks for the Comment. We are actively investigating and will get back to you soon.

[mumian]

@artmasa Please contact Microsoft support or use the MSDN Azure forum for specific user issues. I would check whether the certificate resource has been created successfully from the Azure portal. You can find more information about this error at https://docs.microsoft.com/en-us/azure/azure-resource-manager/resource-manager-not-found-errors.

[artmasa]

@mumian, thanks for your response.
I have updated the issue. After investigating further I found out that the problem is not the dependency on the certificate resource, but the reference to it.
I think it would be nice if references inside a conditional object can be evaluated after the check on condition. In my case both resources should not be created when condition isProduction returns false; but because the reference is evaluated regardless of conditions, the whole deployment fails.

[mumian]

@artmasa I am glad you resolved the issue.

please-close

[KrishnaG-MSFT]

@artmasa Closing this issue for now. If there are further questions regarding this matter, please reply and we will gladly continue the discussion.

[artmasa]

Here is a detailed post I wrote on the subject: https://blog.darkloop.com/post/conditional-resources-with-references-to-conditional-resources-in-arm-templates

[vishleshpatel]

Thanks @artmasa .. Your post helped me find similar non-descriptive error in my templates.

[haveyoumetcp]

Thanks @artmasa for the write up. Helped me get past this problem.

However, I really feel like this is a bug. You would think since you have a condition on the a section it wouldn't evaluate the reference.

[artmasa]

@haveyoumetcp, I agree the behavior should be as you described, and the current behavior should be considered a bug.
I think the issue was closed because this is just the documentation repo.
Glad the post helped!

[mumian]

@spottedmahn - thank you for the comment. The information is covered in https://docs.microsoft.com/en-us/azure/azure-resource-manager/conditional-resource-deployment#runtime-functions. Because the tutorials are covering common usages, I will leave it as is for now.

please close

[spottedmahn]

Hi @mumian - I think you meant to comment on https://github.com/MicrosoftDocs/azure-docs/issues/42431 😀. Correct me if I'm wrong.