Is it possible to pass optional module parameter conditionally only?

[J0F3]

Hi there

Is it possibile to pass a parameter to a module conditionally by using the ternary operator so that when passe the passed value is used and other wises the default value specified in the module?

The idea is to have a default value in a module and if the parameter is not defined during deployment the default is used and otherwise the value specified is used. So the default value can be defined inside of the module but can be overwritten if needed.

To make it maybe more clear here an example what I mean:

The module has defined a parameter with type object and a default value. The parameter is then used to create the resource.
(The property ipsecPolicies of the resource must be set always and can not be null).

param ipsecPolices object = {
  SALifeTimeSeconds: 27000
  SADataSizeKilobytes: 102400000
  IpsecEncryption: 'AES256'
  IpsecIntegrity: 'SHA256'
  IkeEncryption: 'AES256'
  IkeIntegrity: 'SHA256'
  DhGroup: 'DHGroup14'
  PfsGroup: 'PFS2048'
}

resource vpnConnection 'Microsoft.Network/connections@2020-11-01' = {
  name: name
  location: location
  properties: {
    connectionType: 'IPsec'
    sharedKey: preSharedKey
    ipsecPolicies: [
      ipsecPolices
    ]
  }
}

In the main template I have then tried the following:
When the parameter ipsecPolices is not specified during the deployment and is therefore empty it should not passed to the module and instead the default value as defined in the module should be used.

param ipsecPolices object = {}

module testmodule 'modules/testmodule.bicep' = {
  name: 'deploytestmodule'
  params: {
    ipsecPolices : empty(ipsecPolices ) ? null : ipsecPolices 
  }
}

But this does not work because: The property "ipsecPolices " expected a value of type "object" but the provided value is of type "null | object

Is this somehow possibile?
I am afraid that this is not possible due the nature of how parameters in ARM work. But maybe I just missing something...

Thanks!

[brwilkinson]

The solution for this may depend on a few things...

Some things to consider...

1. pass in an object instead of null

ipsecPolices : empty(ipsecPolices ) ? {} : ipsecPolices

2. set a default value on the parameter so that if you pass null it should be allowed?

param ipsecPolices object = {}

[brwilkinson]

Hi @JOF3 did you add more notes /examples? Or else I may have missed it today.

Either way, I'll add some extra info on this tomorrow.

[J0F3]

No all good. I did not add any thing until now.

But I think I have found a solution which would work for my case. It is similar to what you have suggested.

I pass always the ipsecPolices parameter to the module. If the parameter is not specified on the deployment is is an empty object ({}).
Then inside of the module i have a variable with the default settings which is then merged together with the value coming form the parameter, using union:

param ipsecPolices object = {}

var defaultIpsecPolicies = {
  SALifeTimeSeconds: 27000
  SADataSizeKilobytes: 102400000
  IpsecEncryption: 'AES256'
  IpsecIntegrity: 'SHA256'
  IkeEncryption: 'AES256'
  IkeIntegrity: 'SHA256'
  DhGroup: 'DHGroup14'
  PfsGroup: 'PFS2048'
}

resource vpnConnection 'Microsoft.Network/connections@2020-11-01' = {
  name: name
  location: location
  properties: {
    connectionType: 'IPsec'
    sharedKey: preSharedKey
    ipsecPolicies: [
      // Use defaults defined in the module if parameter is empty (not specified in the main template).
      empty(ipsecPolices) ? defaultIpsecPolicies : union(defaultIpsecPolicies, ipsecPolices)
    ]
  }
}

This has even the advantage that only some of the properties can be overwritten during the deployment if needed.

Never the less I am still curious on the extra info from you. 😊

[brwilkinson]

I think you have found an optimal solution there with the merge/union in that case ✅

I was just going to review and test that the solution that I showed is viable.

The solution that you have satisfies some useful design criteria for templates:

• give some good default options
• allow a user to override them as needed.

[brwilkinson]

Hi @J0F3 I will mark this as answered for now, however feel free to continue the discussion if you have any questions or further feedback and info etc.