Azure.Deployment.SecureValue false-Fails while using resource property expression

[yzhu228]

The scenario happened when I tried to store App Insights instrumentation key into a Key Vault secret. The code is listed below. When I ran the code below through Invoke-PSRule, I had a Fail on rule Azure.Deployment.SecureValue. I think it was a false Fail as there is no sensitive info parameter used in the secret value.

My question is: Is there a way to suppress this Fail? So far I have found is to exclude the Azure.Deployment.SecureValue altogether which is no ideal in my situation.

Below is the code that demonstrates this scenario.

param appInsightsName string = 'appi-iac-test'
param appInsightsKeySecretName string = 'APPINSIGHTS-INSTRUMENTATIONKEY'
param keyVaultName string = 'kv-iac-test'

resource keyVault 'Microsoft.KeyVault/vaults@2022-07-01' existing = {
  name: keyVaultName
}

resource appInsights 'Microsoft.Insights/components@2020-02-02' existing = {
  name: appInsightsName
}

resource kvsAppInsightsInstrumentationKey 'Microsoft.KeyVault/vaults/secrets@2022-07-01' = {
  name: appInsightsKeySecretName
  parent: keyVault
  properties: {
    value: appInsights.properties.InstrumentationKey
  }
}

[BernieWhite]

@yzhu228 Thanks for the question.

You can suppress or exclude a rule by following these instructions: https://azure.github.io/PSRule.Rules.Azure/creating-your-pipeline/#ignoring-rules

In this case the name of the resource will be the name of the deployment, the file path to the deployment.

---

I think we should log this as a bug.

[yzhu228]

@BernieWhite Thanks for the reply.

I gave the suppression a try and noticed that it only works if I specify the full path to the bicep file. For example:

Line 24 is for local Invoke-PSRule while line 25 is for running it on Action workflow. I will preferably avoid using absolute path if there is other more portable alternatives.

More interesting, if I specify only the name of the bicep file like appInsights.bicep, I can see the warning that the rule was suppressed (Line 56) but still have the Fail outcome from the rule (Line 64-76).

[BernieWhite]

@yzhu228 Yeah I can see that is not ideal.

For using the suppression: option that is all that is currently supported.

Your other options are excluding the rule entirely via rule.exclude or configure a suppression group.

I think configuring a suppression group like this should meet your requirements. Create it in a Suppression.Rule.yaml file within the .ps-rule/ directory in the root of your repo.

---
# Synopsis: Allow key vault secrets to store app insights key.
apiVersion: github.com/microsoft/PSRule/v1
kind: SuppressionGroup
metadata:
  name: Local.IgnoreAppInsightsKey
spec:
  rule:
  - Azure.Deployment.SecureValue
  if:
    source: Template
    endsWith:
    - '/appInsights.bicep'

I hope that helps.

[yzhu228]

Thank @BernieWhite, the solution works quite well.