The request is invalid error when deploying Azure Firewall rule collections

[integyjc]

Hi, apologies if this isnt the right place to ask this (desperation has kicked in). I'm trying to deploy Azure Firewall Policies, rule collection groups and rule collections via Bicep. I've used the MS quickstarts as a base and have a bicep file which shows no errors in VSCode and deploys via powershell using -whatif with no issues. When I go to do the deployment I simply get "Request is invalid" within the raw deployment error. I believe it is something in the rulecollection tripping it up but am struggling to see it and the error is less than helpful. Can anyone more experienced with Bicep give me a steer?! Many thanks in advance. Code below:

resource identityadds 'Microsoft.Network/firewallPolicies/ruleCollectionGroups@2022-01-01' = {
  parent: firewallpolicy
  name: 'platform-identity-prod'
  properties: {
    priority: 200
    ruleCollections: [
      {
        ruleCollectionType: 'FirewallPolicyFilterRuleCollection'
        action: {
          type: 'Allow'
        }
        name: 'adds-inbound-allow'
        priority: 200
        rules: [
          {
            ruleType: 'NetworkRule'
            name: 'vnets-to-dns-inbound'
            ipProtocols: [
              'UDP'
            ]
            sourceIpGroups: [
              uksouthIpGroup.id
            ]
            destinationIpGroups: [
              ipgazureadds.id
            ]
            destinationPorts: [
              '53'
            ]
          }

          {
            ruleType: 'NetworkRule'
            name: 'onpremadds-azureadds-inbound'
            ipProtocols: [
              'TCP,UDP,ICMP'
            ]
            sourceIpGroups: [
              ipgonpremadds.id
            ]
            destinationIpGroups: [
              ipgazureadds.id
            ]
            destinationPorts: [
              '123,135,464,49152-65535,1024-5000,389,636,3268-3269,53,88,445,3389,500,4500'
            ]
          }
        ]
      }
      {
        ruleCollectionType: 'FirewallPolicyFilterRuleCollection'
        action: {
          type: 'Allow'
        }
        name: 'adds-outbound-allow'
        priority: 200
        rules: [
          {
            ruleType: 'NetworkRule'
            name: 'azureadds-to-onpremadds-outbound'
            ipProtocols: [
              'TCP,UDP,ICMP'
            ]
            sourceIpGroups: [
              ipgazureadds.id
            ]
            destinationIpGroups: [
              ipgonpremadds.id
            ]
            destinationPorts: [
              '123,135,464,49152-65535,1024-5000,389,636,3268-3269,53,88,445,3389,500,4500'
            ]
          }
        ]
      }
    ]
  }
}

[brwilkinson]

@integyjc it would also be helpful if you can share a screen shot or copy of the error that you see.

[integyjc]

Sure, thanks for responding:

[brwilkinson]

I think I saw a missing closing brace.

Can you try your code again from above, I edited in the extra }

Are you deploying via copy paste into the portal? Or from powershell/azcli?

[integyjc]

Sorry are you saying you edited my original post and put in an extra closing bracket? As when i copy and paste it back in, i get the same line number. I tested it anyway and it still fails to deploy:

The code above results in a single "The request is invalid error" - apologies my error screenshot earlier was from a similar deployment of three rule collections, which produces three errors.

[brwilkinson]

check your arrays, they should be in this format.

         ipProtocols: [
            'TCP'
            'UDP'
          ]
          destinationPorts: [
            '80'
            '443'
          ]

[integyjc]

Thank you!, schoolboy error on my part. Appreciate you taking the time to help me with this

[integyjc]

For anyone else reading this, a secondary issue I had was that I had set the same priority for multiple rules which also caused the "Request is invalid" error - It would help if the error information when deploying networkrules was a bit more informative!

[brwilkinson]

Thanks for sharing @integyjc