AVM 'br/public:avm/res/operational-insights/workspace' outputs primarySharedKey and secondarySharedKey

[mikkelh-SDU]

I need some help to understand PSRule while using Azure verified modules (AVM).
I'm using the AVM 'br/public:avm/res/operational-insights/workspace:0.11.2' which outputs primarySharedKey and secondarySharedKey and I'm getting this error:

 -> workspaceDeployment : Microsoft.Resources/deployments [6/7]

    [FAIL] Azure.Deployment.OutputSecretValue (AZR-000279)
    | Parameter: infra/main.bicepparam:0:0

    | RECOMMEND:
    | Consider removing any output values that return secret values in code.

    | REASON:
    | - Path properties.template.outputs.primarySharedKey: The output 'primarySharedKey' exposes a secure value.
    | - Path properties.template.outputs.secondarySharedKey: The output 'secondarySharedKey' exposes a secure value.

    | HELP:
    | - https://azure.github.io/PSRule.Rules.Azure/en/rules/Azure.Deployment.OutputSecretValue/

Is there something I need to do differently or am I missing something?

I have used the WAF example from Azure verified module (AVM):
https://github.com/Azure/bicep-registry-modules/tree/main/avm/res/operational-insights/workspace#example-4-waf-aligned

One way I can workaround it was creating a suppressiongroup like so:

apiVersion: github.com/microsoft/PSRule/v1
kind: SuppressionGroup
metadata:
  name: Local.IgnoreWorkspaceSharedKeys
spec:
  rule:
  - Azure.Deployment.OutputSecretValue
  if:
    field: name
    equals: workspaceDeployment

But it seems strange to do so since it is an Azure verified module (AVM)

[BernieWhite]

Thanks for the question @mikkelh-SDU.

Secure outputs are a recent addition to Bicep and to the avm/res/operational-insights/workspace module, which started using the feature early in the lifecycle of adding support to Bicep. The reason you are getting this message is because it is a brand-new feature that don't have full support yet within PSRule for Azure.

You could use an older version of the module before the latest update however support has been added to PSRule for Azure in v1.44.0 which will be released in the next week. Or you can try it now be using the latest pre-release v1.44.0-B0052.

Adding @krbar the owner of the module may have further insights.

---

Yes, you can use a suppression group to suppress the issue if you don't want to use the pre-release at this stage. Some additional variations are.

apiVersion: github.com/microsoft/PSRule/v1
kind: SuppressionGroup
metadata:
  name: Local.IgnoreWorkspaceSharedKeys
spec:
  rule:
  - Azure.Deployment.OutputSecretValue
  if:
    name: '.'
    equals: workspaceDeployment

Alternatively you could suppress by file:

apiVersion: github.com/microsoft/PSRule/v1
kind: SuppressionGroup
metadata:
  name: Local.IgnoreWorkspaceSharedKeys
spec:
  rule:
  - Azure.Deployment.OutputSecretValue
  if:
    source: Parameter
    withinPath: infra/main.bicepparam

---

I hope that answers the question.

[mikkelh-SDU]

Thanks for the fast reply!
I was just worried that I was missing something or did not fully understand what I was doing!
But I will go with the suppression group for now and wait for the v1.44.0 update 🎉

[BernieWhite]

@mikkelh-SDU v1.44.0 is released.

[mikkelh-SDU]

@mikkelh-SDU v1.44.0 is released.

Thanks for the reminder! 🎉