passing parameter values from bicep to DSC during runtime

[gihanw80]

Hi,

I'm encountering some issues passing parameter values from a Bicep file to a DSC script. Could you help me understand why this is happening? I've included the code blocks below.

Thanks!

here is the DSC script that have been staged on the storage container:

`Configuration IISRole
{   
    Param (  
        [String]$VaultName,  
        [String]$CertificateName,  
        [String]$ClientId,  
        [securestring]$ClientSecret,  
        [String]$TenantId,
        [securestring]$PfxPassword  
    ) 
    # Import necessary DSC resources  
    Import-DscResource -ModuleName xRemoteDesktopSessionHost,xPSDesiredStateConfiguration,CertificateDsc,@{ModuleName="ComputerManagementDsc";ModuleVersion="9.0.0"}

    Node localhost
     {
         # Configure the Local Configuration Manager (LCM) settings  
        LocalConfigurationManager
        {
            RebootNodeIfNeeded = $true
            ConfigurationMode = "ApplyOnly"
        }
   
        # Ensure the directory 'C:\DSCPackages' exists  
        File setupDir {
            Type            = 'Directory'
            DestinationPath = 'C:\DSCPackages'
            Ensure          = "Present"    
        }
    
        #Downlaod IIS xml file from storage account using SAS token
        xRemoteFile IISXMLDownLoad {  
            Uri             = "xxx" 
            DestinationPath = "C:\xxx"
            DependsOn       = '[File]SetupDir'
            MatchSource     = $false
        }

        #Downlaod rewrite MSI file from storage account, this is a dependency app for wims app.
        xRemoteFile RewriteMSIDownLoad {  
            Uri             = "xxx"
            DestinationPath = "C:\DSCPackages\rewrite_amd64_en-US.msi"
            DependsOn       = '[File]SetupDir'
            MatchSource     = $false
        }

        # Ensure the IIS deployment configuration file is present 
        File IISConfigFile  
        {  
            Type = 'File'  
            DestinationPath = 'C:xxx\IIS_DeploymentConfigTemplate.xml'  
            SourcePath = 'C:xxx\IIS_DeploymentConfigTemplate.xml'  
            Ensure = 'Present'  
            DependsOn = '[File]SetupDir'
        }  
        

        # Script resource to install IIS  
        Script InstallIIS  
        {  
            GetScript = { return @{ Result = 'IIS not yet installed' } }  
            TestScript = { return (Get-WindowsFeature -Name Web-Server).Installed }  
            SetScript = {  
                $xmlPath = "C:xxx\IIS_DeploymentConfigTemplate.xml"  
                $installArgs = "/Install /Config:$xmlPath"  
                $installCmd = "Start-Process -FilePath `"$($env:SystemRoot)\System32\dism.exe`" -ArgumentList `"$installArgs`" -Wait -NoNewWindow"  
                Invoke-Expression -Command $installCmd  
            }  
            DependsOn = '[File]SetupDir','[xRemoteFile]IISXMLDownLoad', '[File]IISConfigFile'   
        }  
        

        # Ensure the IIS feature is installed on the system 
        WindowsFeature WebServer  
        {  
            Ensure = 'Present'  
            Name = 'Web-Server'  
            IncludeAllSubFeature = $true  
            DependsOn = '[Script]InstallIIS'
        }  

        # Script resource to create application folder structure  
        Script CreateAppFolderStructure  
        {  
            GetScript = { return @{ Result = 'Application folder structure not yet created' } }  
            TestScript = { return (Test-Path "C:\inetpub\wwwroot\xxx") }  
            SetScript = {  
                $appFolderPath = "C:\inetpub\wwwroot\xxx"  
                $subFolders = @("xxx", "xxx", "xxx")  
                New-Item -Path $appFolderPath -ItemType Directory | Out-Null  
                foreach ($subFolder in $subFolders) {      
                    New-Item -Path "$appFolderPath\$subFolder" -ItemType Directory | Out-Null      
                }      
                # Set permissions for the IIS_IUSRS group    
                $Acl = Get-Acl $appFolderPath      
                $IisIusrs = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-568")      
                $AccessRule = New-Object System.Security.AccessControl.FileSystemAccessRule($IisIusrs, "Modify", "ContainerInherit,ObjectInherit", "None", "Allow")      
                $Acl.SetAccessRule($AccessRule)      
                Set-Acl $appFolderPath $Acl      
            }  
            DependsOn = '[WindowsFeature]WebServer', '[Script]InstallIIS'  
        }  
        
        # Set starting the service    
        Script StartAspNetStateService  
        {  
            GetScript = { return @{ Result = 'ASP.NET State Service not yet started' } }  
            TestScript = { return (Get-Service -Name aspnet_state).Status -eq 'Running' }  
            SetScript = {  
                sc.exe config aspnet_state start= delayed-auto     
                Start-Service aspnet_state   
            }  
            DependsOn = '[Script]CreateAppFolderStructure'  
        }
        # Set local user "xxx" password to never expire  
        Script SetPasswordNeverExpires  
        {  
            GetScript  = { return @{ Result = 'PasswordNeverExpires not set for xxx' } }  
            TestScript = { return (Get-LocalUser -Name "xxx").PasswordNeverExpires -eq $true }  
            SetScript  = { Set-LocalUser -Name "xxx" -PasswordNeverExpires $true }  
        } 


        # Pull the certificate from Azure Key Vault  
        Script GetCertificateFromKeyVault  
        {  
            GetScript = { return @{ Result = 'Certificate not yet downloaded' } }  
            TestScript = { return Test-Path "C:\DSCPackages\$CertificateName.pfx" }  
            SetScript = {  
                        # Authenticate with Azure AD using App ID and Secret
                        # Body parameters
                            $body = @{
                                grant_type    = "client_credentials"
                                client_id     = $ClientId
                                client_secret = $ClientSecret
                                scope         = "https://vault.azure.net/.default"
                            }
                            $tokenResponse = Invoke-RestMethod -Method Post -Uri "https://login.microsoftonline.com/$TenantId/oauth2/v2.0/token" -ContentType "application/x-www-form-urlencoded" -Body $body

                            
                            $accessToken = $tokenResponse.access_token

                            # Retrieve the certificate from Azure Key Vault
                            $vaultBaseUrl = "https://${VaultName}.vault.azure.net"  
                            $secret = Invoke-WebRequest -Uri "$vaultBaseUrl/secrets/$CertificateName/?api-version=7.0" -Method GET -Headers @{Authorization="Bearer $accessToken"}  
                            $secretContent = ($secret.Content | ConvertFrom-Json).value  

                            # Decode Base64 certificate content
                            $certificateBytes = [Convert]::FromBase64String($secretContent)


                            # Ensure the directory exists
                            $certPath = "C:\DSCPackages"
                            if (-not (Test-Path -Path $certPath)) {
                                New-Item -Path $certPath -ItemType Directory
                            }

                            # Save the certificate to a file
                            $certificateFilePath = "$certPath\$CertificateName.pfx"

                            # Load the certificate and export with password
                            $certificate = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2($certificateBytes, "", [System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::Exportable)
                            $pfxBytes = $certificate.Export([System.Security.Cryptography.X509Certificates.X509ContentType]::Pfx, $PfxPassword)
                            [System.IO.File]::WriteAllBytes($certificateFilePath, $pfxBytes)

                            Write-Output "Certificate saved to $certificateFilePath"

            }  
            DependsOn = '[File]SetupDir','[xRemoteFile]IISXMLDownLoad', '[File]IISConfigFile', '[Script]InstallIIS'   
        }
    }
   
}`


**below is the part of the  Bicep file:** 

`@description('Auto-generated token to access _artifactsLocation')
@secure()
param dscArtifactsLocationSasToken string 

@description('The location of resources such as templates and DSC modules that the script is dependent')
param dscArtifactsLocation string = 'deployment().properties.templateLink.uri'


// param dscStorageAccountName string 
param dscstorageContainerName string 
param dscstorageBlobName string
param dscProvisioningZipArchiveName string
// param dscProvisioningZipArchiveNameDotNet string

var blobURL = uri(dscArtifactsLocation,'/${dscstorageContainerName}/${dscstorageBlobName}/${dscProvisioningZipArchiveName}?')


param VaultName string
param CertificateName string
param ClientID string
@secure()
param ClientSecret string
param TenantId string
@secure()
param PfxPassword string


resource vmDSCExtension 'Microsoft.Compute/virtualMachines/extensions@2023-09-01'= {
  parent: virtualMachine
  name: 'IISRole-And-Dependencies'
  location: location
  properties: {
    publisher: 'Microsoft.Powershell'
    type: 'DSC'
    typeHandlerVersion: '2.9'
    autoUpgradeMinorVersion: true
    forceUpdateTag: '3'
    settings: {
      configuration: {
        url: blobURL
        script: 'dsc_wims_iis.ps1'
        function: 'IISRole'
      }
      configurationArguments: {
        VaultName: VaultName
        CertificateName: CertificateName
        ClientId: ClientID
        TenantId: TenantId
        }
    }
     
    protectedSettings: {
      configurationArguments: {
        ClientSecret: ClientSecret
        PfxPassword: PfxPassword
      }
      configurationUrlSasToken: dscArtifactsLocationSasToken
    }
    
  }
}`


**here is what I have set up the parameters.json file for the bicep template**

`{
  "$schema": "https://schema.management.azure.com/schemas/2019-04-01/deploymentParameters.json#",
  "contentVersion": "1.0.0.0",

    "dscArtifactsLocationSasToken":{
      "reference": {
        "keyVault": {
          "id": "XXX"
        },
        "secretName": "XXX"
      }
    },

    "dscArtifactsLocation": {
        "value": "https://:xxy.blob.core.windows.net"
    },


    "dscstorageContainerName": {
      "value": "xxx"
    },

    "dscstorageBlobName":{
        "value": "IIS"
    },

    "dscProvisioningZipArchiveName": {
      "value": "xxx-Setup.zip"
    },

    "CertificateName":{
      "value": "xxx"
    },

    "ClientID":{
      "value": "xxx"
    },

    "ClientSecret":{
      "reference": {
        "keyVault": {
          "id": "XXX"
        },
        "secretName": "xxx"
      }
    },

    "PfxPassword":{
      "reference": {
        "keyVault": {
          "id": "XXX"
        },
        "secretName": "xxx"
      }
    },

    "TenantId":{
      "value": "xxx"
    },

    "VaultName":{
      "value": "xxx"
    }
  }
}`

here is what i see on the log for the extension on the Azure VM. It fails only on certificate script block and install IIS role and folder etc for me

[[Script]GetCertificateFromKeyVault] Performing the operation "Set-TargetResource" on target "Executing the SetScript
with the user supplied credential".
VERBOSE: [2024-06-25 20:59:45Z] [VERBOSE] [ ]:
[[Script]GetCertificateFromKeyVault] POST https://login.microsoftonline.com//oauth2/v2.0/token with -1-byte payload
VERBOSE: [2024-06-25 20:59:46Z] [VERBOSE] [ ]: LCM: [ End Set ]
[[Script]GetCertificateFromKeyVault] in 1.3440 seconds.
VERBOSE: [2024-06-25 20:59:46Z] [ERROR] PowerShell DSC resource MSFT_ScriptResource failed to execute
Set-TargetResource functionality with error message: The remote server returned an error: (404) Not Found.

[brwilkinson]

Any variable used inside the script block in the script resource require the $using:tenant format.

• https://learn.microsoft.com/en-us/powershell/dsc/reference/resources/windows/scriptresource?view=dsc-1.1#example-2-compare-version-information-using-a-script-resource

[gihanw80]

Thank you very much. thats was the issue :)