[BUG] Exception "Cannot cast Newtonsoft.Json.Linq.JProperty to Newtonsoft.Json.Linq.JToken." when analyzing template using AVM module

[ChrisLGardner]

Describe the bug

We've got some bicep that makes use of the container-registry AVM module and when running it through the template analyzer (using the AzDO security task) we get the following exception "Cannot cast Newtonsoft.Json.Linq.JProperty to Newtonsoft.Json.Linq.JToken". I'm not sure what part of the AVM module is causing this and I don't know enough about how this tool works to properly debug what might be going on here.

This happens whether I try to analyze the bicep file or the built json file.

Expected behavior

Bicep is analyzed and reports back an errors/warnings without throwing an exception.

Reproduction Steps

I've been able to get the exception when using just this as the bicep:

module acr 'br/public:avm/res/container-registry/registry:0.7.0' = {
  name: 'testing'
  params: {
    name: 'testing'
  }
}

Environment

TemplateAnalyzer version 0.8.0 when run in AzDO or latest of main when run locally
.net version is 8.0.405
IDE is VS Code 1.96.4

[JohnathonMohr]

Thank you for reporting this @ChrisLGardner.

After an in-depth investigation, I have found that the JSON templates generated from this Bicep module use languageVersion 2.0. Digging deeper, I found that this module specifically produces languageVersion 2.0 because it uses user-defined data types, which will generate this version of ARM JSON.

languageVersion 2.0 changes the "resources" property from an array to an object, which breaks an assumption Template Analyzer makes. We will need to investigate what is required to support 2.0 (tracked in #390).

In the meantime, I've also created tracking bug #391 to at least detect this version when parsing so Template Analyzer doesn't blow up.

[floydpreyes]

Hello there,

I also here to report I am facing the same issue.

Using the following AVM modules

br/public:avm/res/data-factory/factory:0.9.1
br/public:avm/res/storage/storage-account:0.18.1

[floydpreyes]

Is there a workaround for now?