policyAssignment name schema validation incorrect

[matt-FFFFFF]

Hi,

I understand this is likely an external issue, but raising here.

The schema validation fails for the resource name of Microsoft.Authorization/policyAssignments.

Period characters . are valid in the name, but cannot be used at the start or end.

Is this an error with the Bicep types package?

Re: https://learn.microsoft.com/azure/azure-resource-manager/management/resource-name-rules#microsoftauthorization

Thanks

[ms-henglu]

Hi @matt-FFFFFF ,

Thank you for taking time to report this issue.

I reproduce this issue by the below config:

terraform {
  required_providers {
    azapi = {
      source = "Azure/azapi"
    }
  }
}


provider "azapi" {
  skip_provider_registration = false
}

data "azapi_client_config" "current" {}

resource "azapi_resource" "policyDefinition" {
  type      = "Microsoft.Authorization/policyDefinitions@2021-06-01"
  parent_id = data.azapi_client_config.current.subscription_resource_id
  name      = "test-policy-definition"
  body = {
    properties = {
      description = "Test policy definition"
      displayName = "Test Policy Definition"
      mode        = "All"
      parameters = {
        allowedLocations = {
          metadata = {
            description = "The list of allowed locations for resources."
            displayName = "Allowed locations"
            strongType  = "location"
          }
          type = "Array"
        }
      }
      policyRule = {
        if = {
          not = {
            field = "location"
            in    = "[parameters('allowedLocations')]"
          }
        }
        then = {
          effect = "audit"
        }
      }
      policyType = "Custom"
    }
  }
  schema_validation_enabled = true
  response_export_values    = ["*"]
}

# Test policy assignment with period in name (should work but currently fails due to schema validation)
resource "azapi_resource" "policyAssignment" {
  type      = "Microsoft.Authorization/policyAssignments@2022-06-01"
  parent_id = data.azapi_client_config.current.subscription_resource_id
  name      = ".my.policy.assignment."  # This should be valid according to Azure docs
  body = {
    properties = {
      displayName        = "Test Policy Assignment with Periods"
      enforcementMode    = "Default"
      policyDefinitionId = azapi_resource.policyDefinition.id

      parameters = {
        allowedLocations = {
          value = [
            "West Europe",
            "East US",
          ]
        }
      }
    }
  }
  schema_validation_enabled = true
  response_export_values    = ["*"]
}

And I encountered this error:

│ --------------------------------------------------------------------------------
│ RESPONSE 400: 400 Bad Request
│ ERROR CODE: InvalidResourceName
│ --------------------------------------------------------------------------------
│ {
│   "error": {
│     "code": "InvalidResourceName",
│     "message": "The resource name '.my.policy.assignment.' has this invalid trailing character '.'.  The name can not end with characters: '. '"
│   }
│ }
│ --------------------------------------------------------------------------------

This error is returned by the API, so this name is not allowed.

[matt-FFFFFF]

Hi @ms-henglu

Apologies I should have been more specific.

This is the configuration that causes the error with the schema validation, where the name contains a period but not at the start or end:

resource "azapi_resource" "policyAssignment" {
  type      = "Microsoft.Authorization/policyAssignments@2022-06-01"
  parent_id = data.azapi_client_config.current.subscription_resource_id
  name      = "my.policy.assignment"  # This should be valid according to Azure docs
  body = {
    properties = {
      displayName        = "Test Policy Assignment with Periods"
      enforcementMode    = "Default"
      policyDefinitionId = azapi_resource.policyDefinition.id

      parameters = {
        allowedLocations = {
          value = [
            "West Europe",
            "East US",
          ]
        }
      }
    }
  }
  schema_validation_enabled = true
}