Arm TTK validation help

Question

I am running arm-ttk validation based on https://learn.microsoft.com/en-us/azure/azure-resource-manager/templates/test-toolkit.

I am on a personal branch forked off of Azure Sentinel and I see many examples for LogsAnalyticsURI being refereced as

"variables" : {
	
"LogAnaltyicsUri":"[replace(environment().portal, 'https://portal', concat('https://', toLower(parameters('WorkspaceId')), '.ods.opinsights'))]"
}

Check this image,

These are solutions that are already checked in which define logAnalyticsUri in this way.
If thats the case, why does arm-ttk complain when I run it locally?

  [-] URIs Should Be Properly Constructed (17 ms)                                                                
        Function 'concat' found within 'LogAnaltyicsUri' Line: 95, Column: 6                                       
        Function 'concat' found within 'LogAnaltyicsUri' Line: 101, Column: 6                                      
          

How to resolve this please?

I tried using

"LogAnaltyicsUri": "[format('https://%s.ods.opinsights.azure.com', parameters('AzureSentinelWorkspaceId'))]",  

even this fails and arm ttk complains that

Function 'format' found within 'LogAnaltyicsUri' Line: 95, Column: 6  

Answer 1

@Ashwin Venkatesha, this seems to be intentional check present in arm-ttk toolkit.

There are workarounds that people have used, for example as mentioned in the discussion below - https://github.com/Azure/arm-ttk/issues/590

However, in the current case as the Azure/Azure-Sentinel has multiple templates following this pattern, I don't think that changing it would be a good idea.

I would suggest filing this as an issue on both the repository so that the respective team is aware of it:

1. Azure/arm-ttk - to update about the unexpected warning for the URI format
2. Azure/Azure-Sentinel - to update about the URI pattern being used being flagged by ttk.

Hope this helps.