Template Validation is failing with a message "invalid copy batch size" while using batchsize decorator and empty array in for loop

[HariRajan2014]

Hi ,

I am experiencing an issue which I have tried my best but not sure how this can be resolved. Could you please help me on the same.

I'm doing the RBAC assignment code , as I need to assign multiple identities in to the specific role so looped it. But noticed that code fails if the array of objects which I have looped is empty. I have set an if condition to validate whether it is empty but still the template validation is failing because of this decorator @batchsize(1) when an array is empty. I set this because I need serial execution . To isolate it further I have commented the //@batchsize(1)* and then the code is working fine.

if array called v_mgrbacproperties.contributor.AccessGrantedADObjectIds is null below code fails with below error.

InvalidTemplate - Deployment template validation failed: 'The template 'copy' definition at line '1' and column '5817' has an invalid copy batch size. The copy batch size must be a non-negative integer value and cannot exceed the copy count '0'. Please see https://aka.ms/arm-copy for usage details.

Inputs are

1. empty array

AccessGrantedADObjectIds: [

        ]

2. not an empty array
   AccessGrantedADObjectIds: [
   {
   Name : 'mg1pxtestgroup'
   Objectid: '17ea184b-e6e6-4fec-a0d7-878ce5d85d49'
   ObjectidType: 'security group'
   }
   ]

// This must be changed to each role.
var ContributorAccessGrantedADObjectIds = v_mgrbacproperties.contributor.AccessGrantedADObjectIds

var ContributorArraycount = length(ContributorAccessGrantedADObjectIds)

output arraylength int = ContributorArraycount


var ContributorArrayisnotempty = empty(ContributorAccessGrantedADObjectIds) 

output arrayempty bool = ContributorArrayisnotempty



@batchSize(1) 
resource r_mg1_mgt_sdlc_01_contributor_rbac_assignment 'Microsoft.Authorization/roleAssignments@2018-09-01-preview'  = [for principal in ContributorAccessGrantedADObjectIds: if(ContributorArrayisnotempty) {
  name: guid(r_mg1_mgt_sdlc_01_contributor.id, v_roledefinitionuniqueid, principal.Objectid)
  properties: {
    
    //roleDefinitionId: '/providers/${r_tu_mgt_sdlc_01_contributor.id}'
    roleDefinitionId: startsWith(r_mg1_mgt_sdlc_01_contributor.id, 'Microsoft.Authorization') ? '/providers/${r_mg1_mgt_sdlc_01_contributor.id}' : r_mg1_mgt_sdlc_01_contributor.id
    principalId: principal.Objectid
  }
} ]

Now I have commented batchsize then the code works fine.

// This must be changed to each role.
var ContributorAccessGrantedADObjectIds = v_mgrbacproperties.contributor.AccessGrantedADObjectIds

var ContributorArraycount = length(ContributorAccessGrantedADObjectIds)

output arraylength int = ContributorArraycount


var ContributorArrayisnotempty = empty(ContributorAccessGrantedADObjectIds) 

output arrayempty bool = ContributorArrayisnotempty



//@batchSize(1) 
resource r_mg1_mgt_sdlc_01_contributor_rbac_assignment 'Microsoft.Authorization/roleAssignments@2018-09-01-preview'  = [for principal in ContributorAccessGrantedADObjectIds: if(ContributorArrayisnotempty) {
  name: guid(r_mg1_mgt_sdlc_01_contributor.id, v_roledefinitionuniqueid, principal.Objectid)
  properties: {
    
    //roleDefinitionId: '/providers/${r_tu_mgt_sdlc_01_contributor.id}'
    roleDefinitionId: startsWith(r_mg1_mgt_sdlc_01_contributor.id, 'Microsoft.Authorization') ? '/providers/${r_mg1_mgt_sdlc_01_contributor.id}' : r_mg1_mgt_sdlc_01_contributor.id
    principalId: principal.Objectid
  }
} ]

Could you please let me know how this can be resolved . Thank You.

[anthony-c-martin]

See #4319 - we have a fix for this that'll be deployed to the platform in the next ~3 weeks.

[HariRajan2014]

@anthony-c-martin - Thanks for replying quite fast and really appreciate that.

I was doing little more digging and found these , Is that the reason for this issue please ?. thanks.

As per the documentation .

The value for batchSize can't exceed the value for count in the copy element
https://docs.microsoft.com/en-us/azure/azure-resource-manager/templates/copy-resources#serial-or-parallel

If I pass empty array above condition won't be true , is that creating this issue .

batchSize = 1
copyCount = 0

   "principalId": "[variables('ContributorAccessGrantedADObjectIds')[copyIndex()].Objectid]"
            },
            "copy": {
                "name": "r__01_contributor_rbac_assignment",
                "count": "[length(variables('ContributorAccessGrantedADObjectIds'))]"  -------- 0
            },
            "condition": "[variables('ContributorArrayisnotempty')]"
        },

"copy": {
              "name": "r_mg1_mgt_sdlc_01_auditor_rbac_assignment",
              "count": "[length(variables('auditorAccessGrantedADObjectIds'))]",           ---        0
              "mode": "serial",
              "batchSize": 1                                                                                               ----  1
          }

[anthony-c-martin]

If I pass empty array above condition won't be true , is that creating this issue .

Yes, that's exactly right. The fix will relax this requirement, so that we allow the batchSize to be greater than the count.

[HariRajan2014]

Thank You.